RESOLVED: Another noob trying to use OpenVPN and PIA

[rick020200]

My goal is to be able to route traffic from any host in the 10.0.0.0/16 network out through pfSense->OpenVPN->Private Internet Access.

My home network looks like this:

Internet <- Cable Modem <- ASUS RT-N16 (192.168.1.1)
{maintaining the ASUS router helps keep the family sane while I figure this out}

pfSense is installed inside for VMWare ESXi with two virtual interfaces. The physical host has two NICs connected to a switch.
The pfSense WAN interface is DHCP (currently 192.168.1.95) and correctly points to default gateway on the ASUS.
The pfSense LAN interface is static 10.0.0.1/16.

If OpenVPN isn't connected or configured, I can successfully route traffic through pfSense by setting my laptop IP to 10.0.0.5 and gateway 10.0.0.1.

I have configured an OpenVPN connection to PIA following this document.
https://www.privateinternetaccess.com/pages/client-support/pfsense

When I'm done (including a reboot), I can still route through pfSense, but I don't pass any traffic through PIA even though Status/OpenVPN says I'm connected, and the logs don't show anything in the way of errors.

Attached are screen shots.

Thanks for your assistance.

[Derelict]

It would surprise me if 10.0.0.0/16 does not conflict with something at PIA somehow.

That is a pretty lousy choice for your private IP space if you want to VPN with anyone else on the planet.

Looks like you got lucky and (at least that PIA endpoint … today) is giving you something in 10.16.0.0 as the tunnel address.

From the looks of things it should be working. Did you assign an interface to the PIA OpenVPN instance?

[rick020200]

Could you please elaborate on how 10.0.0.0/16 is a lousy choice? Its my understanding that 10.* is private and cannot be routed publicly, therefore making it an equivalent choice to 192.168.0.0/16

As for the interface, in the current incarnation (following the PIA documents exactly) I did not manually create an interface for PIA/OpenVPN. I have tried that in the course of my troubleshoot, however.

[Derelict]

Because when you are connecting VPNs, you need to be distinct from the private addresses on the other side and in the tunnel addresses, etc. You conflict/collide with everyone else using anything in 10.0.0.0/16 which is probably millions of other sites.

[johnpoz]

Other than the larger your network mask the more likely it is to conflict where your trying to vpn to or from, etc.

Its also just screams – person doesn't know what they are doing at all ;)  Do you have some 65K devices that you want on the same L2?  Use network that is appropriately sized.. A /16 mask should never be on any sort of device.. /16 is something you would use in a firewall rule or route summary, etc.  Not on an interface..

Your best bet is to pick something odd ball that is not common... 10.0.0 with any sort of mask is going to be used all over the place.. so even a 10.0.0/24 could run into a overlap.. Maybe something like 10.14.52/24 which be far less likely for some other network you might need to connect to or from to conflict with, etc.

[rick020200]

Its also just screams – person doesn't know what they are doing at all ;)

Then that seems to have served my purpose well. I changed my LAN interface to 10.233.233.1/24 and everything is working now!

Thanks for the feedback. I'm still trying to wrap my head around how it was a problem but for now I'll have to accept that I'm not as smart as my mom tells me I am.