Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    Scheduled Pinned Locked Moved OpenVPN
    348 Posts 99 Posters 461.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      peehoo
      last edited by

      @Derelict:

      @peehoo:

      Awesome tutorial… Is it anyhow possible to expand it in situations when somebody wants force only one - two - or certain amount of Lan IP:s to the VPN tunnel and all the others stay outside of that VPN...

      That would be exactly what I needed!!

      That's easy.  It's the opposite of this:

      I would define an alias, say vpn_hosts, that contained the source IPs of the hosts you want to go through the VPN.  Put a rule with that alias as the source, with the gateway set to the VPN (PIAVPN_VPNV4 in this example).  Next, place one after that with a source of LAN net with a WAN group, default, or specific gateway set.

      Like this:

      Hi!

      I think I managed this  ::)

      Basicly I needed only one internal IP-address go to the PIAVPN so I created two firewall rules.

      One which is telling that 192.168.1.60 goes to PIAVPN and one which is reverse for that -> all the other LAN addressess are going to WAN-interface. Is this kind of configuration any sense?

      Now my pc is showing me my ISP address and XBMC is showing PIA address.

      Ok, I changed that single host to the aliases list because it might be possible every now and then and some other pc:s to use PIAVPN also.

      One thing came to my mind… What comes to the security and hidden my network traffic - is there any kind of problem to use same PIA server every day? Manually when using pc-client I've changed it different countries every now and then... Ok, it is manually also possible with pfsense but is it any benefit to change it and if yes -> could it be possible to automaticly use several PIA servers different days?

      And at the end couple of stupid questions:

      • At this point it seems that PIAVPN is working (THX for a great tutorial)
      • Dashboard is showing in interfaces PIAVPN address BUT
      • for reason I do not know OpenVPN status shos that PIA client instance status is down??

      Should I be worried?

      Screencaps below:

      Dec 11 13:06:42	openvpn[68212]: Exiting due to fatal error
      Dec 11 13:06:42	openvpn[68212]: Cannot open TUN/TAP dev /dev/tun2: Device busy (errno=16)
      Dec 11 13:06:42	openvpn[68212]: TUN/TAP device ovpnc2 exists previously, keep at program end
      Dec 11 13:06:42	openvpn[68212]: ROUTE_GATEWAY xx.x.x.1
      

      Could this be a reason why I still have DNS Leak? How I manually (and to where) I configure PIA DNS-servers?

      Also one minor thing… How I can configure to those piavpn hosts traffic limiter especially upload limiter. I tried to do this with http://www.squidworks.net/2012/08/pfsense-2-0-limiting-users-upload-and-download-speeds-by-limiting-bandwidth/ this instructions but did not succeed.

      1 Reply Last reply Reply Quote 0
      • A
        achaian
        last edited by

        I just wanted to say thank you!! This tutorial is the only tutorial that actually worked. All others seemed to not show enough info around certificates. This clearly advised how to create and apply.

        Again, thank you!!

        1 Reply Last reply Reply Quote 0
        • F
          flowrider
          last edited by

          Hi,
          I've just registered here but have been lurking for quite a while.

          Thanks for the guide it was much easier than a lot of other guides out there and it's appreciated greatly.

          I have a question about DNSleak protection. With this default configuration when I check https://www.dnsleaktest.com/ it's showing that pfSense is leaking. Has anyone configured using PIA's DNS? I'm a little worried to just give it a try because it's taken everything I got to get this far!!

          Anyhow if anyone has a tutorial for this it would be great.

          Thanks
          Steve

          1 Reply Last reply Reply Quote 0
          • W
            wbennett77
            last edited by

            Hey Steve,

            The ONLY way I have found to prevent leaks is to use PIA's DNS servers. If anyone has found another way I would really like to hear about it as well.

            Dell Optiplex 390 Pfsense 2.2 / Asus AC56U Wireless AP / Asus Switch

            1 Reply Last reply Reply Quote 0
            • F
              flowrider
              last edited by

              Thanks wbennett77 I ended up using PIA's DNS servers as well and no leaks! It was quite easy which is nice for a change! I'm pretty happy to have found this guide as it's the most comprehensive and simple to use one on the net. I'm pairing it with a Netgear R7000 right now and it seems to be working well especially in the 5gHz range.

              1 Reply Last reply Reply Quote 0
              • S
                sogseal
                last edited by

                have anyone figure out DNS settings yet? I stumbled across a topic https://forum.pfsense.org/index.php?topic=29944.0 Step 4, i cannot test this at the moment im waiting for my new mobo. I talked to a PIA rep and he recommended to manually configure DNS and provided me with ip's 208.67.222.222 and 208.67.220.220. i should get my mobo tomorrow and will start playing with my new hardware and installing pfsense.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Those are OpenDNS servers.

                  Copyright enforcement bots are not going to have access to DNS server records.  I think all you PIA, etc. users might be overthinking things a bit.  Yes, I'm making a generalization that is probably wrong.  :P

                  Just about anything is possible with pfSense.  If you want to make sure NOTHING from a particular internal host is transmitted out the normal WAN, set firewall rules on LAN that sets the gateway to PIA and marks the traffic with something like NO_WAN_EGRESS.

                  Then make a floating rule that blocks any traffic on WAN out marked with NO_WAN_EGRESS.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • S
                    sogseal
                    last edited by

                    @Derelict:

                    Those are OpenDNS servers.

                    Copyright enforcement bots are not going to have access to DNS server records.  I think all you PIA, etc. users might be overthinking things a bit.  Yes, I'm making a generalization that is probably wrong.  :P

                    Just about anything is possible with pfSense.  If you want to make sure NOTHING from a particular internal host is transmitted out the normal WAN, set firewall rules on LAN that sets the gateway to PIA and marks the traffic with something like NO_WAN_EGRESS.

                    Then make a floating rule that blocks any traffic on WAN out marked with NO_WAN_EGRESS.

                    im lost :) , want to show us step by step?  ::)

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Post the rule that forwards your traffic to PIA.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • S
                        sogseal
                        last edited by

                        @Derelict:

                        Post the rule that forwards your traffic to PIA.

                        I got my new mobo coming today, ill se teverything up and post it, thank you for the help

                        EDIT

                        so i got my mobo MSI Z87I AC(waiting on AR9380). Pretty much i followed this guide to the end and added opendns ips( im on 2.2-RC (amd64)  built on Mon Dec 29 07:41:21 CST 2014 FreeBSD 10.1 RELEASE-p3) to System>General Setup DNS servers and i dont have nay DNS leaks

                        1 Reply Last reply Reply Quote 0
                        • J
                          jptech
                          last edited by

                          After testing a bit, I see issues when using DHCP (LAN) and the DNS Forwarder.  Clients on the LAN are given the pfSense LAN IP as a DNS server and the DNS lookups done by the DNS Forwarder don't seem to be very sophisticated.  My firewall rules route a couple machines over the VPN and everything else goes over the WAN:

                          However, I still see geo-optimized IPs when I do DNS lookups (ex: google.com).  I changed my DNS a bit to see if I could figure out what was going on.  I set two DNS servers:

                          Note that one is set to use the WAN gateway and the other is set to use the TGNEWYORK gateway (I'm using TorGuard, not PIA).  After doing this, the behavior of one of my 'vpnclients' gives a good indication of what's happening.

                          When I do a DNS leak test I can see that both DNS servers are being used and the route depends on which DNS server is picked by the DNS Forwarder.  I can tell this because it appears that TorGuard forces all DNS requests through OpenDNS, so half the servers found are Google, half are OpenDNS.

                          There are two things to be careful of in my opinion.  1) Make sure all vpnclients bypass the DNS Forwarder.  2) Make sure normal connections don't use the VPN for DNS lookups.  I use a port forward rule to get the vpnclients to bypass the DNS Forwarder.  Note the rule uses the LAN interface.  Also note the firewall rule I have above to intentionally block all traffic from vpnclients to pfsense.

                          Another option would be to make sure the DHCP server passes non-local DNS to clients, but keeping the vpnclients and normal clients separated is a pain.  To ensure normal connections don't use the VPN for DNS, I explicitly specify the WAN gateway for DNS and don't allow the settings to be overridden by DHCP.

                          From the testing I did, leaving a gateway of 'none' doesn't work.  I still saw DNS lookups going over the VPN gateway.  To me this is incorrect behavior since my default gateway is the WAN gateway (only tested on 2.1.4).

                          Does anyone know if it's possible to get the DNS Forwarder to use a specific gateway for lookups?

                          1 Reply Last reply Reply Quote 0
                          • C
                            cybernet
                            last edited by

                            Has anyone successfully gotten PIA to work with SHA256? Works flawlessly with SHA1. Also if you receive MTU or HMAC authentication errors, try another server. Some servers are acting really wonky right now.

                            Cheers!

                            1 Reply Last reply Reply Quote 0
                            • K
                              kintaroju
                              last edited by

                              great tutorial you guys have. I have a more complicated situation that I have been trying to get setup.

                              Having TWO openVPN client setup via PIA.

                              So the idea is this, based on IP range 192.168.0.2-192.168.0.20 it'll go to PIA USA west

                              The based on IP range 192.168.0.21-192.168.0.40 it'll go to PIA Canada

                              Then the remaining IP 192.168.0.41-192.168.0.254 will be on the WAN.

                              I've tried to follow the instructions before and just add a 2nd VPN client accordingly, but everything just default to the PIA USA West, is there anything I could be missing?

                              1 Reply Last reply Reply Quote 0
                              • T
                                terryd
                                last edited by

                                very good guide but mine seems to restart if put under any stress like a download

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kintaroju
                                  last edited by

                                  TerryD, did you upgrade to the latest pfSense 2.2 that was released yesterday?

                                  As for my issue, upgrading to 2.2 totally fixed the issues

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    Robs
                                    last edited by

                                    @ryan29:

                                    Does anyone know if it's possible to get the DNS Forwarder to use a specific gateway for lookups?

                                    I did set it up like this, using no special rules:
                                    check in the dns forwarder: Query DNS servers sequentially

                                    209.222.18.218 -> pia gateway
                                    209.222.18.222 -> pia gateway
                                    8.8.8.8 ->  wan gateway

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      Robs
                                      last edited by

                                      @kintaroju:

                                      great tutorial you guys have. I have a more complicated situation that I have been trying to get setup.

                                      Having TWO openVPN client setup via PIA.

                                      So the idea is this, based on IP range 192.168.0.2-192.168.0.20 it'll go to PIA USA west

                                      The based on IP range 192.168.0.21-192.168.0.40 it'll go to PIA Canada

                                      Then the remaining IP 192.168.0.41-192.168.0.254 will be on the WAN.

                                      I've tried to follow the instructions before and just add a 2nd VPN client accordingly, but everything just default to the PIA USA West, is there anything I could be missing?

                                      Once you have one vpn gateway there isn't anything different setting up an other one and select the gateway based on lan ip.
                                      However, there can be a situation where the vpn clients both have the same local interface ip. (the 10.x.x.x ip address)
                                      I don't know what caused it but restarting one vpn client did solve it for me.

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        Save yourself some headaches and set your IPs on subnet boundaries instead.  That'll make your rules a lot easier.

                                        Like instead of assigning hosts IP addresses from 192.168.0.21 through 192.168.0.40, assign them 192.168.0.33 through 192.168.0.62.  You can then cover them in one rule with source IP 192.168.0.32/29 (255.255.255.248)

                                        You could:

                                        pass ip any source 192.168.0.32/29 dest any gateway PIA_USA_WEST # (hosts .33 through .62 - in this case you could actually use .32 and .63 too but I wouldn't)
                                        pass ip any source 192.168.0.64/29 dest any gateway PIA_CANADA # (hosts .65 through .94)
                                        pass ip any source LAN network dest any gateway default # everything else.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          phatty
                                          last edited by

                                          Since the upgrade to 2.2 I have had PIA randomly disconnect and remain disconnected for me until I manually click connect again. Anyone else experience this problem? Seems to be every couple of days, on 2.1. 5 the only time I had connectivity issues when an internet issue caused a bad route to the server I had been connecting to. Other than that previously it has been very solid for me up until the upgrade.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            Moatilliata
                                            last edited by

                                            Thanks for this guide, I got PIA up and running for just my FireTV and the rest of my devices go through the normal WAN.

                                            The problem I'm having now is I'm trying to access content on hulu and watch Disney Junior with my FireTV, but it says I'm outside of the US (I'm not, and I'm using the PIA California server, I know that Hulu has blocked a lot of VPNs). I don't care if the traffic for Hulu and Disney aren't over PIA, I want to make a rule to bypass the VPN for Hulu, Disney, and potentially a couple of other streaming services. I've tried creating an alias for hulu.com and then I made a firewall rule (placed before my VPN hosts rule) that said if the destination was the hulu alias it would use the WAN gateway instead of the PIA gateway, but I still got the same outside of the US or private network error. I've also added an ipcheck to the alias to make sure it was working and it returned the IP address I wanted when the rule was applied, so it worked for that site at least.

                                            Any ideas how to get this to work? I don't really want to have to turn the VPN off each time I want to turn on Disney Junior for the kids.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.