Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    OpenVPN
    99
    348
    384.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      psykix
      last edited by

      I did above it…

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        With the rule disabled it's not going to work.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • P
          psykix
          last edited by

          Yes, I know. I disabled it because I removed the route-nopull since I needed the VPN to be working.

          I'll try again with route-nopull and enable the rule again.

          1 Reply Last reply Reply Quote 0
          • P
            psykix
            last edited by

            Ok, so I have the rule enabled. I have the route-nopull option.

            privateinternetaccess shows my VPN address and says I am protected.

            However, 2 other sites for showing IP addresses are showing my ISP public address, not the VPN one :-(

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              You sure your tunnel is staying up?

              There's really nothing that can cause what you think you're seeing.

              Unless there's something severely wrong with that beta version you're using.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • P
                psykix
                last edited by

                I'm not sure. It seems to be staying up.

                I realised that I also have a free ipVanish account, so I'll give things a whirl with that and see how I get on :-)

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Which IP test sites are showing the VPN address and which are showing WAN address?

                  Is it consistent?

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • P
                    psykix
                    last edited by

                    The ipvanish site shows that I am protected, and it is the correct VPN ip address.

                    The BBC iPlayer site refuses to work because it knows I am behind a VPN - which is expected behaviour.

                    However, www.whatsmyip.org shows my proper public IP address, and my ISP details.

                    Also, http://mxtoolbox.com/WhatIsMyIP/ shows my proper details, and not the VPN ip address.

                    Very odd.

                    I also deleted the config and reconfigured from scratch - same result.

                    If I remove the firewall rule and the route-nopull from the config, then I get consistent results that I behind the VPN.

                    Strange!

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Don't know what to tell you.

                      I just ran updates to my betas and tried it and it works just fine.

                      You'll have to look at states or something to see what's going on.  SOMETHING you have is routing traffic out the default gateway. Have you created any floating rules?

                      Are you positive about the source IP address?

                      LAN-rules.png
                      LAN-rules.png_thumb

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • P
                        psykix
                        last edited by

                        Unless of course it is going out using IPV6, but it shouldn't be - I have IPV4 as preferred.

                        I don't know if it makes any difference that the 192.168.1.15 server that I want protected with the VPN a) it's a VM and b) it has teamed NICs

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          If it was going out IPv6 I think both of those sites would be showing you an IPv6 address.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            I've never messed around with windows NIC teaming. If it utilizes multiple IP addresses there's your problem. Put them all in an alias and use that as your source address list. A packet capture on LAN will show you what's happening.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • P
                              psykix
                              last edited by

                              They are just teamed into one IP address.

                              It's very odd..

                              I've just gone back to having everything protected as that works fine.

                              Any idea how I can add a rule to get BBC iPlayer to bypass the VPN?

                              1 Reply Last reply Reply Quote 0
                              • P
                                psykix
                                last edited by

                                It does also make me wonder if I have missed something, although I have redone the tutorial from scratch 3 times now.

                                Just to test, I created a rule for my client PC which is just normal PC single NIC and I get exactly the same results.

                                PIA website says I am protected and shows the VPN IP address. The others still display my ISP and unprotected public IP :-(

                                I am just baffled…

                                1 Reply Last reply Reply Quote 0
                                • P
                                  psykix
                                  last edited by

                                  I just had a thought.. wouldn't be anything to do with Squid or Squidguard would it?

                                  Aha..

                                  Disabled Squid and it now all works as expected..

                                  So do I have to change Squid to work on the VPN interface instead of LAN maybe?

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    Of course it's ^$%&  squid.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      psykix
                                      last edited by

                                      Since enabling the VPN on my server which runs Plex, I cannot access the Plex server from my LAN via the Plex website.

                                      To get it working previously I had to enable Pure NAT but I don't really understand the reasoning behind this.

                                      Not sure what I need to change to be able to access the server again (I'm basically going out of the firewall, and then back in via my port forward rule to get to it)

                                      Access from the internet to my Plex server is working fine.

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        psykix
                                        last edited by

                                        Seems Plex suddenly started to work again today. Think may be issues with Plex, so ignore.

                                        Thanks for all the help!

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          psykix
                                          last edited by

                                          @johnodon:

                                          @Derelict:

                                          Yes.  Just add the ports to the rule sending traffic to the VPN gateway.  The rule won't match if the port is outside the set so the firewall will move on to the next rule.

                                          I want to do the exact opposite and having trouble figuring it out…

                                          I want all traffic from one IP to go thru the VPN except port 32400 (Plex).  How can I adapt the current rules (or add another) that will send Plex traffic thru the WAN GW so the server can be reached remotely?

                                          John

                                          Did you figure this out? My Plex server stopped working and when I check it has my VPN address as the public IP.

                                          I've tried creating a LAN FW rule above the VPN one to tell it that all TCP 32400 traffic should go via WAN_PPOE and not PIAVPN but it doesn't make any difference.

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            psykix
                                            last edited by

                                            Never mind - it started working again. I'm wondering if because the VPN changes IP address so often, maybe Plex is taking too long to update it?

                                            Oh I dunno.. clutching at straws - it all works great for a while and then will stop working, and then will work again. Hate those types of issues!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post