Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    Scheduled Pinned Locked Moved
    OpenVPN
    99
    348
    394.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      You can leave the NAT rules active.  They mean nothing unless that interface is being used for egress.  They just have to be there if you're going from the source IP addresses out that interface.

      Maybe PIA was having a problem?  Who knows.  Glad it's working and you don't have a pass any any rule on WAN.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • W
        White Widow
        last edited by

        One additional question: I can get the OpenVPN/PIA tunnel up and functioning, but when I come back after a while the Interface is down and the OpenVPN service needs to be restarted.  This is from the log:

        Feb 14 23:26:43 openvpn[83612]: TLS: soft reset sec=0 bytes=494118/0 pkts=4201/0
        Feb 14 23:26:43 openvpn[83612]: ERROR: could not read Auth username from stdin
        Feb 14 23:26:43 openvpn[83612]: Exiting due to fatal error
        Feb 14 23:26:43 openvpn[83612]: Closing TUN/TAP interface
        Feb 14 23:26:43 openvpn[83612]: /usr/local/sbin/ovpn-linkdown ovpnc1 1500 1542 10.179.1.6 10.179.1.5 init

        Is this because I specified "auth-nocache"?  If so, shouldn't this option cause the information to be re-read from the file, not stdin?  I'll try and remove the -nocache option since, really, why should I mind having the login credentials saved in memory when it's OK to have them stored plaintext on disk…

        Is it something else entirely?

        Thanks,
        Aaron

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          If you added auth-nocache outside of the tutorial, remove it.

          https://community.openvpn.net/openvpn/ticket/225

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • P
            plainzwalker
            last edited by

            Quick questions since I am still doing my research. If I wanted my VPN service (PIA) to use a different set of DNS servers, to prevent DNS leak, would it be possible? If so how would I go about setting this up? Or would pfsense as a whole have to use only one set of dns servers?

            Sorry, still learning and haven't been able to get any hands on yet.

            Thank you

            1 Reply Last reply Reply Quote 0
            • Z
              zax123
              last edited by

              @kintaroju:

              great tutorial you guys have. I have a more complicated situation that I have been trying to get setup.

              Having TWO openVPN client setup via PIA.

              So the idea is this, based on IP range 192.168.0.2-192.168.0.20 it'll go to PIA USA west

              The based on IP range 192.168.0.21-192.168.0.40 it'll go to PIA Canada

              Then the remaining IP 192.168.0.41-192.168.0.254 will be on the WAN.

              I've tried to follow the instructions before and just add a 2nd VPN client accordingly, but everything just default to the PIA USA West, is there anything I could be missing?

              Hi there,

              Not sure if you solved your problem, but if you haven't passed "route-nopull" as an advanced option to the OpenVPN client, that might be your problem.  I wanted to selectively send some of my LAN clients to VPN and others not, and had to pass this option as it stopped OpenVPN from generating a default (0.0.0.0) route in my routing tables.

              Good luck!

              Rob

              1 Reply Last reply Reply Quote 0
              • T
                t3kka
                last edited by

                First a huge thanks to the OP for providing this.  Exactly what I was looking for.

                Second - and please bear with me as I'm new to pfSense - what is the best way to have ALL communication to the internet shut-off if for whatever reason the VPN becomes disconnected? Or maybe this is already going to occur because of the NAT rules defined?

                Thanks for clarification.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  I have found the best way to do this is to edit the firewall rules that policy route traffic over the VPN.  Configure them to add a mark like VPN_ONLY.

                  Create an interface group for all your WAN interfaces.

                  Create a floating rule on the wan interface group direction out.  Make it a Reject rule, Quick, matching any traffic with mark VPN_ONLY.

                  vpn_block_float.png
                  vpn_block_float_mark.png
                  vpn_block_float.png_thumb
                  vpn_block_float_mark.png_thumb

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • B
                    boowii
                    last edited by

                    Hi Everyone.
                    I have the service up and running but for some reason i am not getting a IP address?
                    what have i missed?

                    cheers

                    1 Reply Last reply Reply Quote 0
                    • G
                      ghanem
                      last edited by

                      Hey friends
                      Can i make a vpn in pfsense firewall between the admin in my LAN to connect 2 dedicated servers with 2 public address x.x.x.x / x.x.x.x
                      its urgent thanks for your answer :)

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Hey friends
                        Can i make a vpn in pfsense firewall between the admin in my LAN to connect 2 dedicated servers with 2 public address x.x.x.x / x.x.x.x
                        its urgent thanks for your answer :)

                        Start another thread.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • U
                          User1503
                          last edited by

                          Hey Derelict thanks for answering my other questiond.  My problem is..uh, I'm not the sharpest at learning; I can follow tutorials (and even wrote some for wireless) and what I need is another tutorial for setting up NAT (or LAN?) rules.  I followed this VPN tutorial and everything is running great!  But like other's have asked, I need to have 1,2 or maybe only 3 IP's (computers) use the VPN, and all other bypass the VPN and go straight to the local internet.  So the answer's I've read of 'create a Lan rule for xxx' are nice and I'm sure easy for some, but I don't know HOW to do that?  I made some LAN rules, but it blocked everything and so I just removed them.  Therefore, if you, or anyone, knows of another tutorial of 'How to create a rule for 1 IP to bypass the VPN' I sure would appreciate a link.  I can follow directions and be successful (driving, making coffee, buying groceries) but I don't know the 'how-to' of pfSense rules.  Thanks!

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Create an IP alias called vpn_hosts or something Firewall > Aliases

                            Add the IP addresses that you want to be forwarded through the VPN

                            Look at the first post in this thread.  Find the section called Routing.

                            The walkthrough changes the LAN IPv4 Rule so it forwards all of LAN Net to PIAVPN_VPN4.  You want to make a rule just like it but ABOVE it with the source network set to the alias instead of LAN net.  Then change the LAN net rule back to Gateway: default

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • U
                              User1503
                              last edited by

                              Thanks for the steps.  I just can't get it to work.  I either have  No outbound connection; Everything thru VPN; or Everything Open, not vpn'd.  The IP's are set in the 'VPN Out IPs' and the gateway is 'default' under the 2nd LAN rule.  Just not getting it I suppose.  Thanks for the help.

                              PIA_VPN_AliasIP_rules.jpg
                              PIA_VPN_AliasIP_rules.jpg_thumb

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                That should work.  You sure PIA is up when you try?  Did you clear states?

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • B
                                  bj24
                                  last edited by

                                  I have very similar set up and same issues.

                                  As I have it set up now, everything goes through the VPN. All I want is 192.168.0.102 to go on the VPN, all other traffic through ISP.

                                  What have I got wrong here?

                                  pfsens.jpg_thumb
                                  pfsens.jpg

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    Probably a default route from the VPN provider.

                                    on 2.2, check Don't pull routes in the OpenVPN client config.  on 2.1.5 add route-nopull; to the advanced section.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      bj24
                                      last edited by

                                      Derelict thanks for the reply,

                                      I seem to of messed something up. :-[ :-[

                                      A few questions:
                                      1. Every time I enable and disable the VPN Client (which I do a lot while trying to set this up) it gives me a new IP which I then have to add to the firewall rules, is there a easier way of doing this?

                                      2. I seem to of lost ability to have traffic go through the VPN (I could once have all or nothing), I can see small amount of traffic on the VPN but when I check my IP I get my ISPs. What did I do?

                                      3. What did checking "Don't add/remove routes" do?

                                      I seem to go one step forward and two steps back every time I make a change on this.

                                      Thanks,

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        What rules are you talking about?  You don't need to care what address they give you.  That's the PIAVPN_V4 address and all pfSense does is NAT to it.  That can change all the time.  You are concerned with your client's LAN address that doesn't change unless you change it (presuming it's static or at least a DHCP Static Mapping which is advisable when you start policy routing based on the source address.

                                        Many VPN providers push a default route to you so all your traffic gets sent through them.  Checking that box adds route-nopull; to your client configuration which tells the client to ignore all the routes pushed to you.  This leaves it up to you to policy route the traffic you want to go to the VPN.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bj24
                                          last edited by

                                          I will attach what I think might be useful, let me know if anything else is needed.

                                          I also noticed when I check the gateway that the VPN shows online but then quickly goes offline after enabling. Any thoughts on that?

                                          2.jpg
                                          2.jpg_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by

                                            Which rule do you think you have to change?  What, exactly, is the problem?

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post