OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warrior)

GruensFroeschli

What exactly does not work with UDP?
The problem with TCP is: TCP over TCP should generally not be used where it can be avoided.
–> http://sites.inka.de/~W1011/devel/tcp-tcp.html

Wasca

I found this information on this forum page http://forum.pfsense.org/index.php/topic,8297.msg46717.html#msg46717

as soon as I swapped over to using TCP and updated my WAN2 rules to use TCP I could connect to the OpenVPN service on WAN2 (OPT1)

rpryor

followed this tutorial but can only ping and connect to the pfsense box

protocol: udp
locol port: 1194
address pool: 192.168.20.0/27
local network: 192.168.6.0/25

attached two pics are firewall rules

results of ipconfig:


C:\Documents and Settings\Administrator>ipconfig

Windows IP Configuration

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.1.104
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1

Ethernet adapter TAP-Win32 Adapter V9:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.20.6
        Subnet Mask . . . . . . . . . . . : 255.255.255.252
        Default Gateway . . . . . . . . . :

Results of Route Print:


Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1   192.168.1.104       25
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.0.0    255.255.255.0      192.168.0.1     192.168.0.1       20
      192.168.0.1  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.0.255  255.255.255.255      192.168.0.1     192.168.0.1       20
      192.168.1.0    255.255.255.0    192.168.1.104   192.168.1.104       25
    192.168.1.104  255.255.255.255        127.0.0.1       127.0.0.1       25
    192.168.1.255  255.255.255.255    192.168.1.104   192.168.1.104       25
      192.168.6.0  255.255.255.128     192.168.20.5    192.168.20.6       1
     192.168.14.0    255.255.255.0     192.168.20.5    192.168.20.6       1
     192.168.20.1  255.255.255.255     192.168.20.5    192.168.20.6       1
     192.168.20.4  255.255.255.252     192.168.20.6    192.168.20.6       30
     192.168.20.6  255.255.255.255        127.0.0.1       127.0.0.1       30
   192.168.20.255  255.255.255.255     192.168.20.6    192.168.20.6       30
    192.168.122.0    255.255.255.0    192.168.122.1   192.168.122.1       20
    192.168.122.1  255.255.255.255        127.0.0.1       127.0.0.1       20
  192.168.122.255  255.255.255.255    192.168.122.1   192.168.122.1       20
        224.0.0.0        240.0.0.0      192.168.0.1     192.168.0.1       20
        224.0.0.0        240.0.0.0    192.168.1.104   192.168.1.104       25
        224.0.0.0        240.0.0.0     192.168.20.6    192.168.20.6       30
        224.0.0.0        240.0.0.0    192.168.122.1   192.168.122.1       20
  255.255.255.255  255.255.255.255      192.168.0.1     192.168.0.1       1
  255.255.255.255  255.255.255.255    192.168.1.104   192.168.1.104       1
  255.255.255.255  255.255.255.255    192.168.1.104           f0008       1
  255.255.255.255  255.255.255.255    192.168.1.104           10007       1
  255.255.255.255  255.255.255.255     192.168.20.6    192.168.20.6       1
  255.255.255.255  255.255.255.255    192.168.122.1   192.168.122.1       1
Default Gateway:       192.168.1.1

wan_firewall.JPG_thumb

lan_firewall.JPG_thumb

Wasca

followed this tutorial but can only ping and connect to the pfsense box

protocol: udp
locol port: 1194
address pool: 192.168.20.0/27
local network: 192.168.6.0/25

attached two pics are firewall rules

Are your clients using Vista?

I had to add the following to my Vista clients config

route-method exe
mssfix 1200
route-delay 2

And then in the client specifc section in the OpenVPN setup I added the following to the custom options (not the server custom options, the client)

route-delay 2; ns-cert-type server; msssfix 1200; route-method exe;

Give that a try

rpryor

right now just using xp clients and those settings did not help :o(

i can connect to both the vpn interface of the pfsense box and its LAN ipaddress (192.168.6.45) from the laptop on the opposite end of the vpn

i just cant ping/browse/http/telnet into any other system in the 192.168.6.0/25 and to top it off there is no log in the firewall that would suspect it of any misconfiguration

its boggling the mind and body!

–--------------------------------------
got it to work, i had to change all of the gateways on the servers that i wanted to access from the vpn...that will change when i place the proxy server before the pfsense box and should just work as they are all pointing to the proxy right now

im soooooooo flipping excited that i got all of these features for the school that i work for without paying thousands on router equipment and licensing fees!

next step is to create batch files for the staff to auto create all of the client files so i do not get phone calls after hours trying to get them to vpn to the district applications....THANK YOU PFSENSE!

lifethetech

So I've followed the instructions in this discussion, by the way great job on the howto When I get a little more familiar I'll share too.

Anyway this one got me stumped completely. I'm setting up a Vista (Ultimate) roadwarrior config to a pfsense box with dual wan, opt1 wan is static, wan is dynamic
I had issues at first with UDP, switching to TCP was helpful (proto tcp), thanks for the comments on the article guys :)

Anyway I've done the vista workaround in the client config:

route-method exe
route-delay 20

In the server client-specific configuration I specify

route-delay 10; ns-cert-type server; route-method exe

That being said I'm still getting this error:

Thats even after attempting the same command myself using administrator mode of course.

Fri Jun 13 23:34:54 2008 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.200.6/255.255.255.252 on interface {C22CAE94-9A35-48E5-B606-DEF049045B02} [DHCP-serv: 192.168.200.5, lease-time: 31536000]
Fri Jun 13 23:34:54 2008 Successful ARP Flush on interface [22] {C22CAE94-9A35-48E5-B606-DEF049045B02}
Fri Jun 13 23:35:05 2008 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Fri Jun 13 23:35:05 2008 route ADD 192.168.0.1 MASK 255.255.255.0 192.168.200.5
The route addition failed: The parameter is incorrect.
Fri Jun 13 23:35:05 2008 route ADD 192.168.200.1 MASK 255.255.255.255 192.168.200.5
OK!
Fri Jun 13 23:35:05 2008 Initialization Sequence Completed

The thing that sticks in my mind is why just the one route ADD command that fails?

Oh an before anyone asks I'm running the latest RC build (2.1 rc7) and running OpenVPN GUI in administrator mode

And thats the saga, now if one of you fine gents could spare a couple minutes I'd REALLY appreciate it :)
I'm sure its gotta be something reasonably simple that I'm just not getting.

Thanks in advance,
lifethetech

Wasca

Does the Vista PC have UAC enabled on it?

I enabled UAC the other day and then tried to connect to work using OpenVPN and the routes were not added. If you have UAC on try disabling it.

lifethetech

I did have UAC on, but I've turned it off and tested again, no joy yet :(

I'm still getting the same error. Just a little more info I am on the latest release of pfsense.

And I guess it would be pertinent to tell everyone that I'm using Vista with all the latest patches and SP1

Thanks in advance,
lifethetech

EDIT: I've noticed in the openvpn pfsense logs errors related to the client specific openvpn settings:

laptopxxxx/n.n.n.n:49393 Options error: option 'route-delay' cannot be used in this context
laptopxxxx/n.n.n.n:49393 Options error: option 'ns-cert-type' cannot be used in this context
laptopxxxx/n.n.n.n:49393 Options error: option 'route-method' cannot be used in this context

with the n's being the client's IP address

Not sure if that helps or not :)

edit:

A little more info, I've tried tearing down the whole setup and redoing it all then installing the client on XP here is the error from the XP box (still the same error on vista):

The route addition failed: The specified mask parameter is invalid. (Destination & Mask) != Destination

chpalmer

Fix to the link on the original post…

http://openvpn.net/index.php/documentation/howto.html

:)

tacfit

Just for the record, I've posted a slightly modified version for my own personal records on my blog. Big thanks for the work you did here mate!

http://www.jpuddy.net/2008/11/25/setting-up-a-road-warrior-style-vpn-connection-with-pfsense-and-openvpn/

fastcon68

I just got this configuration setup and getting the following errors in the logs.
RC

Dec 27 15:44:09 openvpn[11789]: Use –help for more information.
Dec 27 15:44:09 openvpn[11789]: Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn_server0.conf:14: lport (2.0.6)
Dec 27 12:59:14 openvpn[356]: Use –help for more information.
Dec 27 12:59:14 openvpn[356]: Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn_client0.conf:14: remote (2.0.6)
Dec 27 12:59:12 openvpn[354]: Use –help for more information.
Dec 27 12:59:12 openvpn[354]: Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn_server0.conf:14: lport (2.0.6)

kangbobon

Great Tutorial,Thanks :)

newmember

Tried openvpn version OpenVPN 2.1_rc15 i686-pc-mingw32 and all worked fine as expected.

Hugovsky

GReat tutorial! Thankx! ;)

Hugovsky

Just one quick question: what encryption whould you use?

fastcon68

This is a awesome overview of OpenVPN. I got it up and running in a few hours. Once up it is now working. I just need to make sure that I can connect to more tunnels that are avaiable.

RC

bnasty

Awesome guide! I got this working over TCP port 443 since we have a blanket port block here at work. If anyone else is trying to do this using TCP, remember to change the guide/defaults:

1. On the OpenVPN Add tab in pfSense.
2. On the WAN-LAN rule.
3. In the config file for the OVPN client install.
4. Change the pfSense web port from 443 to something else (4443) if using HTTPS.

I forgot to change the proto line in #3 from UDP to TCP, and I forgot about #4 – that wasted 20 minutes of my life.

gladizxx

Creating certificates manually on Windows (by Hernan Maslowski)
You can also create the keys with a Win32 program called “My Certificate
Wizard”: http://www.openvpn.se/mycert/

and tutorial easy to run

http://www.enterprisenetworkingplanet.com/linux_unix/article.php/3802221/Run-OpenVPN-on-Windows-Mac-and-LinuxUnix.htm…............ :o

XZed

A big thank you to Frewald and tacfit for their howto !

Even i hadn't compare the 2 howto to notice differences ;D

Just 2 questions (i admit, i've not searched before posting these two questions) :

Is it possible to protect the CA created locally ? i remember have read a tutorial explaining how to protect with a password (requested at each certificate creation)
Is it possible to implement the TLS-Auth ? i think have seen a package for this…

Well, as i've tested, i feedback ;D

nambi

I would have NEVER figured this out without this tutorial.

Working on a winxp machine to a PFSENSE box / network.

I do have one concern in the logs on OPENVPN I see

Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6080 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6080 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6078 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6077 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6077 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

I don't notice anything in particular strange in performance but this log is running continuously reporting errors.

Thank You!