OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warrior)

gladizxx

Creating certificates manually on Windows (by Hernan Maslowski)
You can also create the keys with a Win32 program called “My Certificate
Wizard”: http://www.openvpn.se/mycert/

and tutorial easy to run

http://www.enterprisenetworkingplanet.com/linux_unix/article.php/3802221/Run-OpenVPN-on-Windows-Mac-and-LinuxUnix.htm…............ :o

XZed

A big thank you to Frewald and tacfit for their howto !

Even i hadn't compare the 2 howto to notice differences ;D

Just 2 questions (i admit, i've not searched before posting these two questions) :

Is it possible to protect the CA created locally ? i remember have read a tutorial explaining how to protect with a password (requested at each certificate creation)
Is it possible to implement the TLS-Auth ? i think have seen a package for this…

Well, as i've tested, i feedback ;D

nambi

I would have NEVER figured this out without this tutorial.

Working on a winxp machine to a PFSENSE box / network.

I do have one concern in the logs on OPENVPN I see

Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6080 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6080 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6078 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6077 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6077 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

I don't notice anything in particular strange in performance but this log is running continuously reporting errors.

Thank You!

Xefan

This is a great manual. It worked well for me. Thanks a lot!

kjurkic

Sorry, but this tutorial did NOT work for me :-[

after 3 tries, I printed it out and checked off the steps as I performed them (now 4th try), and even disabled the f/w on my winXP client, and still no joy.

pfsense 1.2.2 which is LAN f/w, DHCP server, and openvpn gate.
Winxp, SP3, latest openvpn client, firewall disabled….

On the client log, this is all i get:
Thu Sep 10 17:14:17 2009 OpenVPN 2.1_rc19 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Jul 16 2009
Thu Sep 10 17:14:17 2009 NOTE: OpenVPN 2.1 requires '–script-security 2' or higher to call user-defined scripts or executables
Thu Sep 10 17:14:17 2009 LZO compression initialized
Thu Sep 10 17:14:17 2009 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Sep 10 17:14:17 2009 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Sep 10 17:14:17 2009 Local Options hash (VER=V4): '41690919'
Thu Sep 10 17:14:17 2009 Expected Remote Options hash (VER=V4): '530fdded'
Thu Sep 10 17:14:17 2009 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Sep 10 17:14:17 2009 UDPv4 link local: [undef]
Thu Sep 10 17:14:17 2009 UDPv4 link remote: 142.25.56.3:1194
Thu Sep 10 17:14:17 2009 TLS: Initial packet from 142.25.56.3:1194, sid=8cfa3413 d6470101
Thu Sep 10 17:14:17 2009 VERIFY OK: depth=1, /C=CA/ST=BC/L=Bamfield/O=BMSC/CN=openvpnbmsc/emailAddress=admin@bms.bc.ca
Thu Sep 10 17:14:17 2009 VERIFY OK: nsCertType=SERVER
Thu Sep 10 17:14:17 2009 VERIFY OK: depth=0, /C=CA/ST=BC/O=BMSC/CN=server/emailAddress=admin@bms.bc.ca

On this same firewall, as a test I was able to copy the certs from an older openvpn install at another org, and the client keys for same, and it DID connect, but any NEW clients created even using the older certgen, refused to work. Its all very puzzling… ???

regards
Ken

charneval

how can I copy the file certificate.crt (the file in my openvpn/easy-rsa/keys) in the format x.509 insite the windows?
In your guide you sayd:

Now you need to have access to some of the files created in c:\programfiles\openvpn
easy-rsa\keys (mentioned in #12)
23) Copy the WHOLE content of ca.crt into the "CA certificate" window
24) Copy the WHOLE content of server.crt into the "Server Certificate" window
25) Copy the WHOLE content of server.key into the "Server Key" window
26) Copy the WHOLE content of dh1024.pem into the "DH parameters" window

Can you help me?

mnovotny

Right-click on file, Open With, Notepad or something similar.

the_true_way

Thank you very mutch!!

Unlogic

Great guide, got OpenVPN up and running in 30 minutes!

Together with OpenVPN GUI this is a really slick solution, compared to using port forwards in spaghetti like soup which is inevitable if you have many machines behind a NAT router.

Unlogic

A little hint to those following this guide and then proceeding to setup their own WINS server in order to access machines by computer name instead of IP.

By default the Windows XP firewalls limits printer and file sharing access to the local subnet which causes trouble when you have a road warrior style setup with two subnets.

To allow file and printer sharing from other subnets follow the steps in this guide: http://www.dharwadkar.com/weblog/firewall_block

eihcet

Going to read some more docs, but if anyone feels like answering…

If I put the 'extra option' for password in the cert when generating does that require the client to also use a password when connecting,or can I set that somewhere else?
How do I add (what is the starting point, I don't need a step by step...): additional clients now that the server part is all setup and I can connect with the first client. I think I can figure it out... just asking in case it's a quick reply someone can share.

Frewald

@eihcet:

If I put the 'extra option' for password in the cert when generating does that require the client to also use a password when connecting,or can I set that somewhere else?

I would like to know how to prompt the users for a password before connecting, as well :)

@eihcet:

How do I add (what is the starting point, I don't need a step by step…): additional clients now that the server part is all setup and I can connect with the first client. I think I can figure it out... just asking in case it's a quick reply someone can share.

Look in the very bottom of the guide - it says "small update" and describes exactly what you are looking for :)

trentdk

NOTE: Local Network: There is a note saying you have to save the settings before you can edit the local network text field; in pfSense 1.2.3, that field becomes editable after changing Authentication Method to PKI.

torontob

Hi,

Thanks for the guide. I am trying to create the server.crt with command "build-key-server.bat server" and everything seems to be fine except for /keys/server.crt is empty (0 bytes). How can this be? I am using cmd.exe with Administrative privileges.

Any input please?

Thanks

torontob

Anything guys?

Thanks

Coldaddy

I will add my thanks to the many you have helped…Thank you for the very helpful guide!!

I am confused about one point...On my client PC I install OpenVPN and walk through the steps (cert creation, etc.). After I have pasted the certs into the pfSense interface do I still need the full OpenVPN software installed on the PC? Can I uninstall it and only install the OpenVPN Client software (pointing to the configuration file created during the steps)?

Thanks for any/all feedback.

Steve

torontob

Wanted to add that the instruction worked for me using CentOS and not Windows 7 as server.crt was coming out as an empty file.

Thanks for the post.

keeper 0

@torontob:

Hi,

Thanks for the guide. I am trying to create the server.crt with command "build-key-server.bat server" and everything seems to be fine except for /keys/server.crt is empty (0 bytes). How can this be? I am using cmd.exe with Administrative privileges.

Any input please?

Thanks

Delete first the old generated files. And try to run again the build-key-server.bat server.

Hope this help

torontob

Nah. That doesn't help. I did the key generation on a CentOS server and it worked fine.

soricel_z

@torontob:

Nah. That doesn't help. I did the key generation on a CentOS server and it worked fine.

Dear all I am new in PfSense and openVPN.
First thank you a lot for the openVPN guide. Maybe is not the right place here to discuss this but here is the problem:
I installed PfSense with the embedded openVPN server.
I previously generated the certificates un an Ubuntu machine with a compiled openVPN server and I "copy - paste" them into the PfSense interface.
The only problem is that the server works fine but with only one client. (the acces in the network is granted, everything works fine, tunnel is stable)
When the second client try to connect the same IP address will be provided by the server and the first client is kiked off (with "connection was lost").
I tryed to generate more certificates for diferent clients, but the certifiates seems not to have any relation to the IPs.
IP pool for the VPN is 172.16.0.0/24 and the address 172.16.0.6 is the only address given to the clients.
Thanks, Robert