Tutorial: Configuring pfSense as VPN client to Private Internet Access
-
The trouble is a "website" will load assets from many different domains. Run NoScript for a while. And that'll just show you all the different places the site is trying to pull javascript from. Not images, etc.
You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.
Agreed, found it out the hard way trying to uhhhh time shift some, Netflix breaks a movie into at least 40 pieces or more (or clips) and they all get a different IP designation, and they pull in each segment as needed with your device caching each segment or part of. Your IP would litterally be a moving target…................that's why its more productive to identify the device that needs clear internet set it to use unencrypted WAN, If the NSA want to watch a movie with me (80% is granddaughter and my little pony or pinky..no state secrets) so be it....anything I don't wish to watch with them I use the PC on encrypted.......set everything else encrypted by default and only adjust as required.
Before this last update Pfsense and PIA were up for 59 days uninterrupted (I have UPS)
But the Update DID break my PIA vpn and screwed up my NTP forward for Layer 3 switch (a play toy, still haven't got IT all figured out yet) and references. It (even with a backup reloaded, forgot to backup config.xml file) lost my login and password file and I had reconfigure a firewall bypass for NTP....seems they changed something with the NAT, not clear just yet how that was "readjusted" by the Dev's..............minor tweaks, buuuuttt. I had to make an entire new password file with login and password, then worked fine.
-
I have to disable that top rule to reply.
When all the rules are enabled, on the BJENVY pc, it doesn't seem to have internet for some time, then it comes for a few seconds, I can check the ip and it is my WAN IP and then it stops responding.
Should I be concerned about the Gateway showing offline?
scratching my head… ???
Mine has ALWAYS shown as down on the Dashboard Gateway Panel. But checking on Service status is mean and green…......that's a quirk they have never "fixed".
-
You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.
How do you mke such aliases ?
-
Create the alias.
 -
Thanks
I tried previously to create that kind of aliases in url
Didn't worked :oIn IP it works
I created an aliases for what is my ip adress and changed a rule … Every IP inside my lan show an adress from the vpn when accessing what is my ip adress. With an other service like what is my ip, I have the adress from my ISP.So it works !
But not success with netflix
In the netflix alieses I have thisnetflix.com
lnwd.net
nflximg.com
edgesuite.net
nflximg.net
-
Sorry, but I don't play whack-a-mole.
The URL aliases are for downloading the content of the aliases from a URL, not for creating an alias based on a FQDN.
-
Thank you for your help
I think that is a good start;D
-
THIS IS PFSENSE GOLD!!!!
I am having one issue though. SMTP Notifications seem to not work when PIAVPN/OpenVPN is running.
I stopped the OpenVPN service and notifications worked just fine.
Logs state:"php-fpm[38529]: /system_advanced_notifications.php: Could not send the message to myemailadress@xxxx.com – Error: could not resolve host "smtp.xxxxx.com"
Any ideas on a possible fix?
-
The tutorial states to turn off hardware encryption and to use BL-128. Is there anyway to use AES-256 instead and use hardware encryption?
-
Found out tha PIA blocks smtp servers by default due to spam.
Had to open a ticket with PIA for them to test the smtp server and whitelist it
SMTP notifications are working fine now!!!!!THIS IS PFSENSE GOLD!!!!
I am having one issue though. SMTP Notifications seem to not work when PIAVPN/OpenVPN is running.
I stopped the OpenVPN service and notifications worked just fine.
Logs state:"php-fpm[38529]: /system_advanced_notifications.php: Could not send the message to myemailadress@xxxx.com – Error: could not resolve host "smtp.xxxxx.com"
Any ideas on a possible fix?
-
A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.
That way when PIA or the email server operator makes a change it doesn't break again.
Or move to SSL/STARTTLS and use submit port 587 with authentication.
-
Really!!! I looked but wasn't able to find ROUTE_NOPULL.
Where can I find route-nopull option????A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.
That way when PIA or the email server operator makes a change it doesn't break again.
Or move to SSL/STARTTLS and use submit port 587 with authentication.
-
Really!!! I looked but wasn't able to find ROUTE_NOPULL.
Where can I find route-nopull option????A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.
That way when PIA or the email server operator makes a change it doesn't break again.
Or move to SSL/STARTTLS and use submit port 587 with authentication.
https://forum.pfsense.org/index.php?topic=76015.msg501074;topicseen#msg501074
-
In the tutorial, manual NAT rules are required … is this still required for 2.2.1 and why is this?
1. How come the OpenVPN wizard doesn't automatically add the NAT rules?
2. How come pfSense automatic NAT rules doesn't do this for you?Just wondering why manual rules must be added.
Thanks.
-
1. How come the OpenVPN wizard doesn't automatically add the NAT rules?
2. How come pfSense automatic NAT rules doesn't do this for you?Because people usually do NOT want all their Internet-bound traffic go through some slow VPN tunnel.
-
Because people usually do NOT want all their Internet-bound traffic go through some slow VPN tunnel.
Great thanks, so I got my tunnel up and running… however, my performance is only ~40mbps.
I'm running an Atom D525 CPU, what should be the expected performance?
When I run TOP, my WCPU for OpenVPN hovers around 50% ... however, the other cores/threads are pretty idle.
Here is my TOP output:
last pid: 15026; load averages: 1.02, 0.61, 0.43 up 19+02:05:29 14:33:57
210 processes: 7 running, 177 sleeping, 26 waiting
CPU: % user, % nice, % system, % interrupt, % idle
Mem: 28M Active, 179M Inact, 542M Wired, 465M Buf, 7172M Free
Swap: 16G Total, 16G FreePID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND
11 root 155 ki31 0K 64K CPU2 2 440.2H 79.05% idle{idle: cpu2}
11 root 155 ki31 0K 64K CPU0 0 432.5H 78.66% idle{idle: cpu0}
11 root 155 ki31 0K 64K RUN 3 446.5H 76.56% idle{idle: cpu3}
11 root 155 ki31 0K 64K RUN 1 443.6H 68.16% idle{idle: cpu1}
28854 root 52 0 21728K 5752K select 0 1:06 58.40% openvpn -
Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.
-
Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.
Publish over PIA or over the internet bypassing PIA?
For the former, PIA has to forward a port to you. Do they support that?
For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.
If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.
IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.
-
Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.
Publish over PIA or over the internet bypassing PIA?
For the former, PIA has to forward a port to you. Do they support that?
For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.
If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.
IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.
PIA does support port forwarding but the port changes every time you get disconnected.
What do you use in place of Plex or do you just not have a media server you can access remotely?
-
I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.
