Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [HOW-TO] Use OpenVPN to connect to vpntunnel.se (or similar)

    2.0-RC Snapshot Feedback and Problems - RETIRED
    4
    9
    17.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Z
      Zappza
      last edited by

      Hello!

      After having some problems routing all my traffic over my VPN provider (vpntunnel.se), I thought it might be useful for others to learn from my mistakes, and just use this guide instead. It could very well spare the world for a couple of thousand cursewords. ;)

      The reasons as to why I chose to use vpntunnel.se is simple. They are cheap (14€ for three months), there is no limit on bandwidth or speed, the encryption is solid, and without a doubt the most important reason, they allow filesharing and all ports are open.

      Here is the guide. I have used the "How to create an OpenVPN client to a public OpenVPN provider" thread as a baseline, and edited where it was needed. Thanks a lot to MrHorizontal!

      Here goes:

      Introduction:
      This How-To is designed for use with vpntunnel.se, but should also apply to any public VPN provider that uses a combination of certificate and username/password. If that is the case, change the fields to match your configuration file.

      Prerequisites:
      The ca certificate and the OpenVPN configuration file. Logon to the dashboard and download them from the Software tab.

      Step 1: Import Certificates

      1. Navigate to System -> Cert Manager. You should be in the 'CAs' tab
      2. Click the '+' to add a new CA.
      3. Provide a descriptive name like 'ProviderName / ServerLocation / CA', leave 'Import an existing Certification Authority' selected.
      4. Paste the contents of the ca.crt from your provider in the 'Certificate data' box.
      5. Press Save.

      Step 2: Configure your username/password

      1. Navigate to Diagnostics -> Edit file
      2. Write /conf/openvpn-auth.conf in the “Save/Load from path” field
      3. Add your username to the first line, and your password on the second, and press save. It should look like this:
      USERNAME
PASSWORD

      Step 3: Configure the OpenVPN Client

      1. Navigate to VPN -> OpenVPN -> Clients tab
      2. Click the '+' button to add a new connection.
      3. Make sure that Server Mode is set to “Peer to Peer (SSL/TLS)”
      4. Set protocol to UDP
      5. Change the device mode to “tap”
      6. Leave the “Interface” as WAN
      7. (Optional) Under 'Local port', enter some arbitrary port you don't use like '50011'. This allows the management interface to keep tabs on the connection and for it to appear under Status -> OpenVPN
      8. In “Server host or address” enter the domain name supplied in the configuration file, for me it was “melissa.vpntunell.se”
      9. In “Server port” choose from one of the ports in your config file. The choices I had was 1194, 10010, 10020.
      10. Write a description
      11. Uncheck “TLS Authentication”
      12. Under 'Peer Certificate Authority' select the name you entered for the 'CA' certificate you entered for this provider.
      13. Under 'Client Certificate' leave the default certificate enabled. It doesn’t matter which is marked.
      14. Under 'Encryption algorithm', choose BF-CBC
      15. Leave 'Tunnel Network' empty
      16. Leave 'Remote Network' empty
      17. Leave 'Limit outgoing bandwidth' unchecked
      18. Check 'Compress tunnel packets using the LZO algorithm'
      19. Here comes the fun part. In the advanced field we need to enter several options, all separated by a ';':
        float
        auth-user-pass /conf/openvpn-auth.conf
        keepalive 10 60
        verb 5

      Just copy-paste this if you're lazy.

      float;auth-user-pass /conf/openvpn-auth.conf;keepalive 10 60;verb 5

      Now we need to check what happens and look at the logs.

      1. First navigate to Status -> System Logs -> OpenVPN tab
      2. Because we entered 'verb 5' in the advanced field, you'll see a lot more information than normal being logged. This can be removed afterwards, but is useful to find errors if you’re having problems.
      3. You need to look for is the line that says:
      openvpn[15921]: PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 80.67.0.2,dhcp-option DNS 91.213.246.2,redirect-gateway def1,route-gateway 188.126.68.1,ping 10,ping-restart 30,ifconfig 188.126.68.99 255.255.255.0'
      1. If that line says 'redirect-gateway def1', then your pfSense should be routing all traffic over the VPN connection.
        You should now be connected to the VPN tunnel. To make computers on your LAN use the VPN tunnel to connect to the internet, we need to enable Outbound NAT, so that it appears that the traffic is originating from the OpenVPN client, and not a client computer connected to the LAN.
        To do this, navigate to Firewall – NAT and select the “Outbound” tab. Change from “Automatic outbound NAT rule generation” to “Manual outbound NAT rule generation” and press “Save” followed by apply.
        Two listings should appear in the table below. Press the plus sign next to the one that says “Auto created rule for LAN to WAN”. In the edit window, just change the interface from “WAN” to “OpenVPN” and press “Save”. Press “Apply” at the top, and you should be good to go.

      Test if your config works by running tracert on a Windows computer or traceroute on a linux computer. If everything is jolly allright, you should see something similar to this:

      $ traceroute www.google.com
 1  v1-link.vpntunnel.se (188.126.68.1)  16.678 ms  16.517 ms  16.324 ms
 2  80.67.12.169 (80.67.12.169)  16.550 ms  16.706 ms  16.545 ms
 3  kn1-2.sth.portlane.net (80.67.4.128)  17.675 ms  17.403 ms  18.533 ms
 4  sol-ix.net.google.com (193.110.13.102)  16.785 ms  16.832 ms  16.840 ms
 5  209.85.250.192 (209.85.250.192)  17.389 ms  17.444 ms
    209.85.252.186 (209.85.252.186)  16.927 ms
 6  209.85.242.188 (209.85.242.188)  38.399 ms  38.408 ms  38.641 ms
 7  66.249.95.132 (66.249.95.132)  34.031 ms
    216.239.43.127 (216.239.43.127)  44.088 ms  43.844 ms
 8  209.85.255.166 (209.85.255.166)  39.410 ms  39.059 ms
    72.14.239.197 (72.14.239.197)  34.677 ms
 9  209.85.255.118 (209.85.255.118)  44.509 ms *  48.447 ms
10  ey-in-f147.1e100.net (74.125.79.147)  35.181 ms  39.899 ms  39.699 ms

      The main thing is that a vpntunnel.se address is the second part of the trace.

      Part II: Port forwarding
      Now that you've got your OpenVPN connection up and running, you might want to forward ports. To make port forwarding work, you need to make a few changes to the default NAT config.

      On interface, choose OpenVPN.

      To make portforwarding work over changes in your IP address, you need to create a dynamic DNS. I use DynDNS.com, but any provider supported by pfSense will work.
      When you are configuring the dynamic DNS updater in pfSense (Services -> Dynamic DNS), make sure that you use the LAN interface (Note: If you have bridged two interfaces, you need to select the bridge). Otherwise you won't get your OpenVPN IP address. After you have configured it, wait a couple of minutes, and see if the IP address detected is the same as the one you get in the OpenVPN log. Look for the line that says:

      openvpn[55325]: /sbin/ifconfig ovpnc1 188.126.70.86 netmask 255.255.255.0 mtu 1500 up

      After you have done this, we need to create an Alias for the hostname, to enable pfSense to use it.
      1. Go to Firewall -> Aliases
      2. Press the plus sign to add a new alias
      3. Type a name for your alias
      4. Select Type: Network
      5. Enter your dynamic DNS hostname
      6. Save and apply.

      On destination, choose Single host or alias, then write your alias.

      Configure the rest of the settings as needed.

      That should be it. Hope you get this up and running!

      If you use this how-to for another VPN provider, please send me a PM, and I'll add it here.

      Hope this helps!

      1 Reply Last reply Reply Quote 0
      • J
        jlepthien
        last edited by

        Great stuff! I also want to check out vpntunnel.se and hope that I can max out my VDSL 50/10 line with it. The DynDNS part is not working for me. When I change the interface to LAN then the address doesn't get recognised (0.0.0.0). Any other things you changed in order for this to work?

        | apple fanboy | music lover | network and security specialist | in love with cisco systems |

        1 Reply Last reply Reply Quote 0
        • J
          jlepthien
          last edited by

          Okay. Now it works! I have my WLAN and LAN interfaces bridged so I needed to choose the bridge as an interface! Thanks for the great tutorial m8!

          | apple fanboy | music lover | network and security specialist | in love with cisco systems |

          1 Reply Last reply Reply Quote 0
          • Z
            Zappza
            last edited by

            Glad things worked out for you ;)

            1 Reply Last reply Reply Quote 0
            • J
              jlepthien
              last edited by

              Hmm. But I am not really satisfied! :(
              I have got a VDSL 50/10 connection which I max out at 6Mbyte/s without vpntunnel.se. With the VPN enabled I get around 500Kbyte/s, that is more than lame…

              Also pinging german websites I have around 20ms reply time, with the VPN enabled it is around 180ms....

              Bummer :(

              | apple fanboy | music lover | network and security specialist | in love with cisco systems |

              1 Reply Last reply Reply Quote 0
              • Z
                Zappza
                last edited by

                That's pretty lame yes.

                I have a 10/10 connection, and I have no problems with maxing my bandwidth. I have sustained around 1 MB/s down, and similary up, depending on the server I connect to.

                Where are you located? Their servers are located in Sweden, so if you are in Germany and try to ping german sites the traffic first have to travel to Sweden, and then back to Germany.

                edit: Which computer are you running pfSense on? The OpenVPN en-/decryption requires a fair amount of CPU power.

                1 Reply Last reply Reply Quote 0
                • J
                  jlepthien
                  last edited by

                  Yes I know. I am located in north Germany. Well probably that service isn't supposed to be used by me. I will drop them a line…

                  | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                  1 Reply Last reply Reply Quote 0
                  • M
                    MedianN
                    last edited by

                    Hello,

                    I am a Linux noob, using Ubuntu 10.10 – I use openvpn with vpntunnel.se in windows -- I followed their instruction guide for linux and I get assigned an IP but when I use mozilla it doesn't connect to any web page, and when I disable openvpn it works again.

                    Any ideas?

                    I also don't find the paths you speak about in your first post -- my openvpn is terminal based.

                    Hope you can assist me as vpntunnel.se have not replied to my support ticket in 7 days.

                    Kind regards!

                    EDIT Oh crap, I just saw this forum is for a firewall application! No wonder I can't find the tabs and stuff you talk about sigh :-(

                    1 Reply Last reply Reply Quote 0
                    • J
                      jw99
                      last edited by

                      This is great! Browsing works fine. 
                      Three additional questions are remaining for me:
                      1)  within the firewall logs the vpntunnel seems trying to acess bogon networks:

                      
Last 50 firewall log entries. Max(50)
Act 	Time 	If 	Source 	Destination 	Proto
block
	Jul 15 12:44:07 	ovpnc1 	178.73.217.134:60704 	224.0.0.252:5355 	UDP
block
	Jul 15 12:44:07 	ovpnc1 	178.73.217.164:63766 	239.255.255.250:3702 	UDP
block
	Jul 15 12:44:07 	ovpnc1 	178.73.217.174:6771 	239.192.152.143:6771 	UDP
block
	Jul 15 12:44:07 	ovpnc1 	178.73.217.174:6771 	239.192.152.143:6771 	UDP
block
	Jul 15 12:44:07 	ovpnc1 	178.73.217.174:52375 	239.192.152.143:6771 	UDP
block
	Jul 15 12:44:07 	ovpnc1 	178.73.217.164:63766 	239.255.255.250:3702 	UDP
block
	Jul 15 12:44:06 	ovpnc1 	178.73.217.113:51097 	224.0.0.252:5355 	UDP

                      Why does the ovpnc do so? Would it be a good idea to allow ovpnc1 to talk to bogons?

                      1. Within Rules -> OpenVPN I allowed the following:
                      
ID 	Proto 	Source 	Port 	Destination 	Port 	Gateway 	Queue 	Schedule 	Description 	
  UDP 	178.73.216.0/20 	* 	178.73.216.0/20 	* 	* 	none 	  	Schwedenserver 

                      Otherwise there are lots of firewall logs blocking transfer between two different IP's both within the vpntunnel network.

                      1. Is it possible to connect some special IP's, i.e. my SIP-Phone directly to the Internet, not using the VPN-tunnel to avoid latency? How could I do that?

                      Thank You in advance.

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post