Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    OpenVPN
    99
    348
    383.8k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Set that up on each of the VLANs

      I assume you mean set that up for each of the VLANs.  The rule(s) only need to be on the interface that the hosts being routed to the VPN are on.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • S
        s3rv3rn3rd
        last edited by

        Yes - I set it on each of the VLANs. currently I have 2 of the VLANs with VPN traffic and that might expand. It appears to be working great now.

        Thanks!!

        1 Reply Last reply Reply Quote 0
        • T
          Thisisvv
          last edited by

          Hello All,

          I am newbiew here. Just got pfsense working on vmware on my i7 desktop. I am unable to connect to PIA. I have tried multiple times the above mentioned process but nothing happens. You can see from VPN start , seems to be every service is working.

          Now when i go to Status: System logs: Gateways. There is absolutely nothing….

          I have attached most of my screenshots, please let me know where i could use help

          ![VPN Start.PNG](/public/imported_attachments/1/VPN Start.PNG)
          ![VPN Start.PNG_thumb](/public/imported_attachments/1/VPN Start.PNG_thumb)
          ![Services gateway.PNG](/public/imported_attachments/1/Services gateway.PNG)
          ![Services gateway.PNG_thumb](/public/imported_attachments/1/Services gateway.PNG_thumb)
          ![firewall NAT rule.PNG](/public/imported_attachments/1/firewall NAT rule.PNG)
          ![firewall NAT rule.PNG_thumb](/public/imported_attachments/1/firewall NAT rule.PNG_thumb)
          ![openvpn configuration.jpg](/public/imported_attachments/1/openvpn configuration.jpg)
          ![openvpn configuration.jpg_thumb](/public/imported_attachments/1/openvpn configuration.jpg_thumb)
          ![wan rule.PNG](/public/imported_attachments/1/wan rule.PNG)
          ![wan rule.PNG_thumb](/public/imported_attachments/1/wan rule.PNG_thumb)

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            No idea really what's that "free roam" doing on your WAN ??? ??? ??? Regardless, that interface tells nothing regarding the topic here.

            1 Reply Last reply Reply Quote 0
            • T
              Thisisvv
              last edited by

              So am i at wrong place?

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                For configuring policy routing for LAN clients? Yeah, WAN is surely wrong place for that.

                1 Reply Last reply Reply Quote 0
                • T
                  TDJ211
                  last edited by

                  @YoMan:

                  The tutorial states to turn off hardware encryption and to use BL-128.  Is there anyway to use AES-256 instead and use hardware encryption?

                  Bump….I would like to know this as well

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Not if PIA doesn't support it.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • C
                      cableguy
                      last edited by

                      first post so scuse the newbie here….

                      what are the speeds you guys have been getting vs. ddwrt flashed routers? I recently upgraded to gigabit fiber, and was looking at building a machine this weekend since 40mbps through a Nighthawk leaves me a little disappointed.  I looked at the SH4860 as well, but I'd rather built something myself if I can hope for anything atleast 150-200mbps

                      1 Reply Last reply Reply Quote 0
                      • B
                        Bobbob
                        last edited by

                        Hi all, newbie with a query here

                        I've followed this guide to get a vpn setup and working fine for normal use, my issue is that port forwarding just wont work as advertised, I have literally gone through a dozen guides, they all say basically the same thing and I swear I've done it all, but nowt actually gets through…  My VPN provider has forwarded the relevant ports to me and says its all good on their end.

                        Do I need NAT reflection to forward a port through the vpn to a LAN IP?  Are my NAT rules ok? Please help, screenshots are here http://imgur.com/a/iZOwd , I'm losing my mind here…

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          You didn't post your port forward config.  Firewall > NAT > Port Forward Tab.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • B
                            Bobbob
                            last edited by

                            Hiya, thanks for replying!  Its in the album now, at the bottom…

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Destination address on your port forward should not be * it should be the interface address for the appropriate VPN interface.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • B
                                Bobbob
                                last edited by

                                Thanks.  Erm, this might be a stupid question but which address is that? All traffic for that pc goes from the LAN through my Iceland VPN interface so is it the virtual address of that VPN interface or my LAN interface?  And since my VPN interfaces are using "IPv4 Configuration Type: None", wont the virtual address change over time? i dont think I can make them static…

                                I don't know if this will help, probs not ;) but this is a rough idea of my setup

                                r  WAN <<<  Iceland-VPN Gateway <<<< 192.168.1.248
                                Modem<<< WAN <<<  UK-VPN Gateway        <<<< All other LAN IPs
                                                L  WAN xxx                                      xxxx  All LAN traffic

                                OpenVPN.png_thumb
                                OpenVPN.png

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  In the Destination address type you select the OpenVPN interface.  If you haven't assigned an interface you need to look up OpenVPN assigned interfaces.  Port forwards won't work without one.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    Bobbob
                                    last edited by

                                    I assigned an interface to each of the OpenVPN clients in the screenshot above, the TORGUARDICELAND interface is the one the pc @ 192.168.1.248 is using, that OpenVPN client has the virtual address 10.8.0.6, is this what you mean or does its interface have a different address?  Do i need to setup a new interface somewhere?  Sorry to be a pain but I've googled around this and can't find anything about a separate OpenVPN interface….  Thanks for your help with this, you're a lifesaver

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      In your port forward entry, the Destination needs to be your OpenVPN interface address, not '*'  I don't know how to make it more clear.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        Bobbob
                                        last edited by

                                        Ok, I have set the destination to the VPN interface address, see screenshot, but the port is still not open, is there still something I'm missing?  Thanks again

                                        ![Port Forwarding Rule 2.png](/public/imported_attachments/1/Port Forwarding Rule 2.png)
                                        ![Port Forwarding Rule 2.png_thumb](/public/imported_attachments/1/Port Forwarding Rule 2.png_thumb)

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          You need to get proof that the port is properly forwarded to you.  Turn logging on on the pass rule, check the logs.  Attempt a connection, check for states.  Do a packet capture on WAN.  Do you see the inbound packets?  Do a packet capture on LAN. Do you see the outbound packets?  What is returned from 192.168.1.248?

                                          You also need to test from outside.

                                          Do all this.  Don't skip anything:

                                          https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            Bobbob
                                            last edited by

                                            Nice one, I'm on it…

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post