Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    open vpn ip

    Scheduled Pinned Locked Moved OpenVPN
    32 Posts 4 Posters 2.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      viragomann @vusqq
      last edited by

      @vusqq
      It is. But it can be used in different ways.
      So without any information about what you intend, we can’t give support.

      V 1 Reply Last reply Reply Quote 0
      • V
        vusqq @viragomann
        last edited by

        @viragomann I intend to use it as a regular vpn thats installed on my router (netgate which is connected to my isp) to give my connected devices a different ip
        after exporting file, this is the error message that im getting
        TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
        TLS Error: TLS handshake failed
        im a newbie so im not familiar with any of this but thanks for the assist, if it gets too complicated I will just proceed to purchase express

        V 1 Reply Last reply Reply Quote 0
        • V
          viragomann @vusqq
          last edited by

          @vusqq
          This error message indicates that the client does not get a response from the server. Most probably reason for this is that the server is not reachable.

          Does the pfSense have a real public WAN IP?
          Or maybe it is behind an ISP router or the ISP provides only a CG-NAT to you?

          V 1 Reply Last reply Reply Quote 0
          • V
            vusqq @viragomann
            last edited by

            @viragomann yes, it has a real public wan ip

            V 1 Reply Last reply Reply Quote 0
            • V
              viragomann @vusqq
              last edited by viragomann

              @vusqq
              I assume, you're able to determine this, but refer to https://en.wikipedia.org/wiki/Private_network, which describes what are non-public IPs.

              For investigation you can go to Diagnostic > Packet Capture on pfSense and sniff the traffic on WAN interface. Set the port filter to that one you use for OpenVPN (e.g. 1194), start the capture and try to connect from the internet.

              After stopping the capture, you should see packets, if they arrived at your WAN.

              1 Reply Last reply Reply Quote 0
              • chpalmerC
                chpalmer @vusqq
                last edited by

                @vusqq said in open vpn ip:

                @viragomann okay maybe I got this all wrong
                im under the assumption openvpn is a free vpn service that I can use on pfsense

                What server are you trying to connect to?

                You do realize that this is not a VPN service such as being advertised out there to hide you on the internet.. correct? although there are services that allow you to use OpenVPN to connect to them..

                Triggering snowflakes one by one..
                Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                V 2 Replies Last reply Reply Quote 0
                • V
                  vusqq @chpalmer
                  last edited by

                  @chpalmer I was under the assumption, but now im realizing. thanks for the clarification.

                  1 Reply Last reply Reply Quote 0
                  • V
                    vusqq @chpalmer
                    last edited by

                    @chpalmer I just tried installing expressvpn on my netgate1100 and was told by a express rep that its not compatible? is wireguard a vpn that will hide my ip?

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @vusqq
                      last edited by

                      @vusqq said in open vpn ip:

                      I just tried installing expressvpn on my netgate1100 and was told by a express rep that its not compatible?

                      Hummm.
                      Install Google ad fire it up.
                      Enter pfsense expressvpn

                      and admire the results.
                      The very first link is www.expressvpn.com - this might actually be the site of ExpressVPN.
                      I'll leave it up to you to see if that's true.
                      Expressvpn : Setup Tutorials : How to set up ExpressVPN on pfSense (OpenVPN)

                      The thing is : ExpressVPN, or not, they want you should install on any device, your phone, PC, whatever, their 'app'. They control and develop that app, they tested it for you.
                      If you decide to use ExpressVPN (any VPN) on your own router, like pfSense, you need to handle this :

                      dev tun
fast-io
persist-key
persist-tun
nobind
remote netherlands-amsterdam-ca-version-2.expressnetw.com 1195
remote-random
pull
comp-lzo no
tls-client
verify-x509-name Server name-prefix
ns-cert-type server
key-direction 1
route-method exe
route-delay 2
tun-mtu 1500
fragment 1300
mssfix 1200
verb 3
cipher AES-256-CBC
keysize 256
auth SHA512
sndbuf 524288
rcvbuf 524288
auth-user-pass
etc etc etc

                      yourself.
                      I know, you are paying every month, but they are not going to help with that.

                      I'm using ExpresVPN right now, with pfSense as a OpenVPN client.
                      That is, it's connected. I'm routing nothing over it, it's just a spare WAN-IP connection.

                      ce27deac-de70-4bbc-b124-2c3584c0e857-image.png

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      V 2 Replies Last reply Reply Quote 0
                      • V
                        vusqq @Gertjan
                        last edited by

                        @gertjan appreciate the help
                        I will try to do it right now, just hope there isn't an issue with my openvpn server (in learning)

                        1 Reply Last reply Reply Quote 0
                        • V
                          vusqq @Gertjan
                          last edited by

                          @gertjan expressvpn status shows down
                          the tunnel ip I used for openvpn server is 192.168.2.0/24, my lan is default pfsense
                          is the firewall aliases Network or FQDN: Enter 192.168.1.0 suppose to match?
                          also there was 2 steps on the setup guide that I did not see on pfsense
                          enable nap-uncheck this box and Compression: Select Adaptive LZO Compression [Legacy, comp-lzo adaptive].

                          GertjanG 1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @vusqq
                            last edited by

                            @vusqq :

                            This is what I have :

                            cd6facca-ed06-4b95-9c31-31fa8a2a5fb8-image.png

                            And these are the custom settings :

                            193654f9-c96a-4846-bcda-b50e88f69674-image.png

                            @vusqq said in open vpn ip:

                            expressvpn status shows down

                            In that case, go have a look why 😊

                            Check the last line of Status > System Logs > OpenVPN
                            Now (re)start the OpenVPN express vpn client instance (on the dashboard).
                            Check again Status > System Logs > OpenVPN : everything that was added is probably from the openvpn client trying to connect to expressvpn : what does it say ?

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              vusqq @Gertjan
                              last edited by

                              @gertjan thanks a lot for the screenshot
                              guide didn't state I have to change "allow compression" so it didn't give me the option to choose "adaptive lzo compression"
                              but now it shows expressvpn is up but status shows "Reconnecting (Auth Failure)"
                              im pretty sure my ovpn server isn't configured right which ive been messing around with.
                              should I leave it "peer2peer or last option even though I won't be needing to log in outside my home?
                              also what ip should I insert for tunnel on a default network? and im leaving local blank if thats okay.

                              1 Reply Last reply Reply Quote 0
                              • V
                                vusqq
                                last edited by

                                do I have to have openvpn server up and running in order for expressvpn to work or can I just delete openvpn completely?

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @vusqq
                                  last edited by

                                  @vusqq said in open vpn ip:

                                  do I have to have openvpn server up and running in order for expressvpn to work

                                  OpenVPN server and OpenVPN client are two different programs.

                                  See the OpenVPN server as a web server. You can use it to connect you phone to your home network, when your out there in the world.
                                  OpenVPN client is the browser. You use the OpenVPN client to connect another OpenVPN server, like ExpressVPN or another pfSense with Open server.

                                  @vusqq said in open vpn ip:

                                  can I just delete openvpn completely?

                                  What do you mean ? OpenVPN server ? If you don't need or use the server, you can delete it.

                                  @vusqq said in open vpn ip:

                                  status shows "Reconnecting (Auth Failure)"

                                  The logs lines say ?

                                  Auth failure = one of these is wrong :

                                  da38ca9d-2344-4fb3-9ab0-51e87ead85c5-image.png

                                  or your crypto settings :

                                  013d8a09-0368-444e-aff8-5a7559a7324c-image.png

                                  @vusqq said in open vpn ip:

                                  also what ip should I insert for tunnel on a default network?

                                  Your client connects to a Express VPN server, and that one will send over the details.

                                  Btw : to understand why there are slight differences with the settings on the express vpn web page, and pfSense : pfsense uses openVPN (OpenSSL) version 2.6.x. Express is using another, older (?) version. They probably also compiled their own optimized version.

                                  @vusqq said in open vpn ip:

                                  im pretty sure my ovpn server

                                  ? OpenVPN client is used to connect to ExpressVPN.

                                  What is your goal ?
                                  Using the OpenVPN server ?
                                  I was understanding you wanted to use ExpressVPN.

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  V 1 Reply Last reply Reply Quote 0
                                  • V
                                    vusqq @Gertjan
                                    last edited by

                                    @gertjan thanks for explaining.
                                    yes just to use express vpn. i deleted the openvpn server as i dont have any use for it and its ca/cert.
                                    i followed a guide last night for my systems version (23.01), (though it mightve worked if i wouldve checked my cryptographic settings) and now its connected and giving me a virtual ip but still showing my current ip on browser?
                                    these are first 4 log lines

                                    MANAGEMENT: Client disconnected
                                    Mar 28 07:17:48 openvpn 95571 MANAGEMENT: CMD 'status 2'
                                    Mar 28 07:17:48 openvpn 95571 MANAGEMENT: CMD 'state 1'
                                    Mar 28 07:17:48 openvpn 95571 MANAGEMENT: Client connected from /var/etc/openvpn/client3/sock

                                    and these are the 2 warnings that i see

                                    VERIFY WARNING: depth=1, unable to get certificate CRL: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
                                    Mar 28 07:17:43 openvpn 95571 VERIFY WARNING: depth=0, unable to get certificate CRL: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-10802-0a, emailAddress=support@expressvpn.com

                                    GertjanG 1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @vusqq
                                      last edited by

                                      @vusqq said in open vpn ip:

                                      .... and now its connected and giving me a virtual ip but still showing my current ip on browser?

                                      When it's up, you see things like this :

                                      Dashboard, OpenVPN widget :

                                      40ac088c-408e-4b7f-95a9-71578127bda1-image.png

                                      and on the Status > OpenVPN page :

                                      69b89574-17a8-4a9a-b899-b8b50e35c7cd-image.png

                                      @vusqq said in open vpn ip:

                                      and these are the 2 warnings that i see
                                      VERIFY WARNING: depth=1, unable to get certificate CRL: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
                                      Mar 28 07:17:43 openvpn 95571 VERIFY WARNING: depth=0, unable to get certificate CRL: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-10802-0a, emailAddress=support@expressvpn.com

                                      You can safely ignore these two.
                                      They are 'normal' in this kind of setup.

                                      The thing is, you've reached what I have now. As I'm not actually using ExpressVPN right now.

                                      You are now here, on step 3 : https://www.expressvpn.com/fr/support/vpn-setup/pfsense-avec-expressvpn-openvpn/#route

                                      Just follow the manual.
                                      The example uses "191.168.1.0/24" as an example, the default pfSense setup.
                                      The example routes your entire LAN through ExpressVPN.

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      V 1 Reply Last reply Reply Quote 0
                                      • V
                                        vusqq @Gertjan
                                        last edited by

                                        @gertjan awesome, it worked.
                                        thank you very much for your knowledge, clear instructions, and patience. hope you have a great day.
                                        also thank you @chpalmer @viragomann for helping out

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.