Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense and openvpn for new users tutorial <– with Site-To-Site now

    Scheduled Pinned Locked Moved OpenVPN
    37 Posts 12 Posters 62.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dairaen
      last edited by

      cheers,

      updated some parts to prevent further problems like:
      http://forum.pfsense.org/index.php/topic,2448.0.html

      As usual, latest version is found here:
      http://www.uplinksecurity.de/data/pfsense-ovpn.pdf

      keep on & kind regards
      dairaen

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by

        pfSense openvpn tutorial sync'd.

        Thanks!

        1 Reply Last reply Reply Quote 0
        • D
          dairaen
          last edited by

          cheers,

          again some updates:

          • added a FAQ section at the bottom with solutions to the latest
            postings
          • added link to "my certificate wizard"

          http://www.uplinksecurity.de/data/pfsense-ovpn.pdf

          kind regards
          dairaen

          1 Reply Last reply Reply Quote 0
          • H
            hoba
            last edited by

            @dairaen:

            again some updates:

            kind regards
            dairaen

            Thanks for your work! We really appreciate your help on this!  :D

            1 Reply Last reply Reply Quote 0
            • S
              sullrich
              last edited by

              File in the tutorial section has been sync'd.  Thanks!

              1 Reply Last reply Reply Quote 0
              • M
                micromani
                last edited by

                For first time: sorry for my english  ::)

                Second: little problem

                I've log in my pfsense by putty (for windows)

                Option 8 (Shell)

                down penvpn-2.0.9.tar.gz

                tar -xvzf openvpn-2.0.9.tar.gz

                cd openvpn-2.0.9

                cd easy-rsa

                vi vars

                […] After that some scripts need to be executed, if asked for “Common Name” enter
                the hostname you used in “General Setup” this time. Here are my keystrokes:
                [/tmp/openvpn-2.0.8/easy-rsa]# source ./vars […]

                source ./vars

                export: Command not found.
                D: Undefined variable.

                Why?

                My Vars file:
                _# NOTE: If you installed from an RPM,

                don't edit this file in place in

                /usr/share/openvpn/easy-rsa –

                instead, you should copy the whole

                easy-rsa directory to another location

                (such as /etc/openvpn) so that your

                edits will not be wiped out by a future

                OpenVPN package upgrade.

                This variable should point to

                the top level of the easy-rsa

                tree.

                export D=/tmp/

                This variable should point to

                the openssl.cnf file included

                with easy-rsa.

                export KEY_CONFIG=$D/openssl.cnf

                Edit this variable to point to

                your soon-to-be-created key

                directory.

                WARNING: clean-all will do

                a rm -rf on this directory

                so make sure you define

                it correctly!

                export KEY_DIR=$D/keys

                Issue rm -rf warning

                echo NOTE: when you run ./clean-all, I will be doing a rm -rf on $KEY_DIR

                Increase this to 2048 if you

                are paranoid.  This will slow

                down TLS negotiation performance

                as well as the one-time DH parms

                generation process.

                export KEY_SIZE=1024

                These are the default values for fields

                which will be placed in the certificate.

                Don't leave any of these fields blank.

                export KEY_COUNTRY=KG
                export KEY_PROVINCE=NA
                export KEY_CITY=BISHKEK
                export KEY_ORG="OpenVPN-TEST"
                export KEY_EMAIL="me@myhost.mydomain"_

                I must tell too:

                D=5

                D=5: Command not found.

                while if I make 'D=5' on other shell (like ubuntu o similar) I write a variable.

                I'm niubby for linux but I think that the Shell from prompt is'nt usually shell!

                Help me!

                1 Reply Last reply Reply Quote 0
                • GruensFroeschliG
                  GruensFroeschli
                  last edited by

                  you use a TAP device but have to use a TUN device

                  if you use the redirect it has to like like this:
                  push "redirect-gateway def1"
                  push "dhcp-option DNS x.x.x.x"

                  you push the custom DNS since the clients loose their route to their local DNS after the redirect is in place.

                  We do what we must, because we can.

                  Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                  1 Reply Last reply Reply Quote 0
                  • C
                    callinectes
                    last edited by

                    I followed the instructions on setting up remote VPN's and it worked wonderfully.  I am having one problem though - i have come back to create a new client cert using build-key but when i run it i am getting an error listing a bunch of options - almost like it doesn't know what to do.  Does anyone have any suggestions on what I might do to be able to build a new key that will connect to our existing server (and its already generated keys)?  I know all of the files that were originally generated still exist.

                    1 Reply Last reply Reply Quote 0
                    • GruensFroeschliG
                      GruensFroeschli
                      last edited by

                      if i remember right you just need to run the vars before using the build-key again.

                      We do what we must, because we can.

                      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                      1 Reply Last reply Reply Quote 0
                      • C
                        callinectes
                        last edited by

                        Thanks…  I tried that - no joy  :-[

                        1 Reply Last reply Reply Quote 0
                        • GruensFroeschliG
                          GruensFroeschli
                          last edited by

                          Can you describe the exact steps you took?

                          We do what we must, because we can.

                          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                          1 Reply Last reply Reply Quote 0
                          • C
                            callinectes
                            last edited by

                            I ran it again, step by step, and its working now.  It is simply running vars, then build-key <machinename>.  Evidently I didn't type something correctly.

                            Thanks for your help. </machinename>

                            1 Reply Last reply Reply Quote 0
                            • W
                              Wasca
                              last edited by

                              Hey Guys

                              The Link to this article is no longer working

                              http://www.uplinksecurity.de/data/pfsense-ovpn.pdf

                              Could the owner please update the link

                              Thanks

                              1 Reply Last reply Reply Quote 0
                              • GruensFroeschliG
                                GruensFroeschli
                                last edited by

                                I already mailed him. No answer.
                                In the meantime you can find it here:
                                http://www.pfsense.org/mirror.php?section=tutorials/openvpn/pfsense-ovpn.pdf

                                Also note that on page 21 is a typo.
                                The field "Interface IP" should be 192.168.10.0/24 and NOT 192.168.1.0/24

                                We do what we must, because we can.

                                Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.