HowTo: Route part of your LAN via TorGuard or PIA.

pfsensory

In step 3, for outgoing network interfaces, your have selected only WAN. When I try to replicate that step on my system, I receive the following error message: "This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces."

How were you able to avoid getting that error?

Edit: I was able to fix this by choosing localhost for "network interfaces" and de-selcting localhost for "outgoing network interfaces"

tigs

This is an excellent guide! and @kesawi , your comment is also an excellent addition.

edit:

Hi @kesawi

I was able to follow your instruction to get this to work using "Custom Options" under squid. However, it seems that I can only access https:// websites, not http:// sites. Any idea to fix this?

Thanks

Untitled.jpg_thumb

duren

Thanks for this.. I use TorGuard and had to figure this out before you posted your guide. I have a few differences I'd like to discuss..

1. Your guide mentions how to configure the connection using the main UI but you show the actual advanced settings some of which map to what's in the UI. For consistency, I recommend ensuring options are either in the UI or in advanced settings to avoid forgetting an advanced setting that's set and wondering why a UI setting is not working. My preference is to keep as many settings in the advanced section as possible so that if I create more VPN connections, I can just cut and paste the block.

2. From the original TorGuard ovpn files, there are a few parameters I don't see you mention..
a. persist-tun
b. persist-key
c. float
d. mute-replay-warnings

What are your thoughts on including these?

3. You have different settings for
a. resolve-retry
b. route-delay

4. You include auth-user-pass and although so does the original config, I think this should be taken out as it requires credential input somewhere, either in a file or in the GUI. Since we use GUI, i'm pretty sure this is automatically sent by pfSense.

What are your thoughts on the original values?

5. I further minimized logging by setting
a. mute-replay-warnings
b. verb 1 - because the UI doesn't seem to have that option available in the dropdown.

6. I minimized warnings by setting
a. remote-cert-tls server as you suggested
b. route-noexec instead of route-nopull as it generated more warnings that way and I think has the same ultimate effect.
c. adding auth-nocache

7. Stabilized connectivity by
a. not specifying a ping-restart and thus defaulting to 120s. This is in case traffic stops flowing but the vpn stays connected.
b. adding auth-retry nointeract because sometimes during a reconnection a BAD AUTH appeared at which point retries stopped. This solved that problem.
c. When you configure more than one connection to TorGuard to different regions, ie 1 connection to US, 1 to Canada, the internal IPs they assign on each server can actually match! at which point pfSense gets confused and traffic stops flowing on one. Virtual IP will show ie 10.9.0.25 for both connections. To solve this I wrote a script that looks for vpn connections and their Virtual IPs and if duplicates are detected, it asks all but the first connection to cycle. This check happens on say a 1 minute interval. https://forum.pfsense.org/index.php?topic=79900.msg439018#msg439018

jptech

@kesawi

I've never tried to set up a proxy that routes via the VPN, so I don't have an opinion on anything proxy related.

As for DNS, the way I did it is simple and fails closed if you forget to set external DNS servers.

I don't think the packet matching floating rule would catch a mishandled DNS lookup. Wouldn't mishandled DNS requests appear to be new connections originating from localhost? When I say mishandled I mean as a result of misconfiguration, not pfSense misbehaving.

@duren

1. I don't see any duplicate advanced settings. I only have 4 settings in the advanced config. I noted all 4 in section 6. Cutting and pasting most of a config into the advanced section would probably work ok.

2. Only the mute-replay-warnings option is in the original config I show. IMO, it's better for someone to see a bit of spam in their logs and be forced to research how to squelch it than it is for them to not realized information that could be important is already squelched.

Glancing at the man page (I haven't tested these, so there's a bit of assumption), I wouldn't use any of them:

persist-tun sounds like it lets the process restart without re-configuring the interface. If I restart the process, it usually means I want a new tunnel.
persist-key shouldn't matter since the openvpn client process runs as root (ps -aux | grep openvpn).
float likely doesn't matter with something like TorGuard. I doubt they're using dynamic IPs. Even if they are, I don't care if my connection breaks and has to reconnect as long as no traffic leaks.

3. I explained resolve-retry in the bullet point list in section 6. The OpenVPN manual only notes route-delay as being useful for tap interfaces. AFAIK most (all?) VPN providers are using tun interfaces.

4. I let the GUI handle user-auth-pass. Where do you see it duplicated?

5. I like verbose logs.

6. I don't think route-noexec and route-nopull are the same. I haven't tested it, but, reading the man page, to me it sounds like route-noexec affects how routes pushed by the server are set and route-nopull affects if routes pushed by the server are set (or ignored). Put another way, if you set route-nopull then route-noexec has no effect. I mention setting route-nopull by using the Don't pull routes in section 6.

7. I don't include ping-restart in the config. Using auth-retry nointeract sounds useful. I only use 1 VPN connection.

chebyshev

I used this tutorial and everything worked great, except dnsleaktest.com still shows my ISP instead of Choopa.com (which is PIA's DNS).

Where should I start to diagnose this?

pfsensory

The key might be in section (above) - "Add a rule to block vpnclients from making DNS queries to the LAN IP. This prevents vpnclients from using the DNS Resolver and prevents DNS leaks if you forget to override DNS settings when adding static DHCP mappings for vpnclients."

Has this rule been set up?

chebyshev

Yes, I set up that rule.

Pippin

Is your client Windows 8 or up?
Then it could be this:
https://forum.pfsense.org/index.php?topic=110910.msg617899#msg617899

chebyshev

I just tried that, but got the following in my OpenVPN log:

May 6 20:54:13	openvpn	84233	SIGTERM[hard,] received, process exiting
May 6 20:54:13	openvpn	30195	Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn/client2.conf:31: block-outside-dns (2.3.9)
May 6 20:54:13	openvpn	30195	Use --help for more information.

This seems weird to me because the documentation for OpenVPN 2.3.9 seems to indicate that the –block-outside-dns option is available.

morreale

@chebyshev:

I just tried that, but got the following in my OpenVPN log:
May 6 20:54:13	openvpn	84233	SIGTERM[hard,] received, process exiting
May 6 20:54:13	openvpn	30195	Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn/client2.conf:31: block-outside-dns (2.3.9)
May 6 20:54:13	openvpn	30195	Use --help for more information.
This seems weird to me because the documentation for OpenVPN 2.3.9 seems to indicate that the –block-outside-dns option is available.

I had to use "push block-outside-dns" which someone recommended. not sure if that is actually working or not. don't see anything in the log.

I am still having the issue where any of the leaktest sites are showing my DNS server as my IP from the ISP (not my ISPs DNS servers)

I have done all the different rules for blocking DNS and forcing certain servers. It just seems like it was working at first and now it always displays the ISP IP even when connected to VPN

I am using DNS Resolver (no forwarding and no DNS servers configured on general setup…using 127.0.0.1)

chebyshev

The "push block-outside-dns" seems to allow the client to start at least, but it didn't change anything in terms of the leak tests. You're right - they are showing my IP, not my ISP's DNS server. Strange and pretty much the opposite of what I'm looking for out of a VPN.

Derelict

@chebyshev On the host you are performing DNS leak tests what are the configured name servers? Precisely what firewall rules did you create (screen shot would be best).

chebyshev

The host doing the leak tests gets a static IP assigned via DHCP from the pfSense box - it is assigned the Google DNS servers (8.8.8.8 and 8.8.4.4). Those are the ones that show up if I do 'ipconfig /all'. It is running Windows 10.

Screenshots of my firewall rules are attached.

lan_rules.PNG_thumb

floating_rules.PNG_thumb

Derelict

Do you have name servers set up in System > General Setup?? What are they?

morreale

@morreale:

@chebyshev:
I just tried that, but got the following in my OpenVPN log:
May 6 20:54:13	openvpn	84233	SIGTERM[hard,] received, process exiting
May 6 20:54:13	openvpn	30195	Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn/client2.conf:31: block-outside-dns (2.3.9)
May 6 20:54:13	openvpn	30195	Use --help for more information.
This seems weird to me because the documentation for OpenVPN 2.3.9 seems to indicate that the –block-outside-dns option is available.
I had to use "push block-outside-dns" which someone recommended. not sure if that is actually working or not. don't see anything in the log.

I am still having the issue where any of the leaktest sites are showing my DNS server as my IP from the ISP (not my ISPs DNS servers)

I have done all the different rules for blocking DNS and forcing certain servers. It just seems like it was working at first and now it always displays the ISP IP even when connected to VPN

I am using DNS Resolver (no forwarding and no DNS servers configured on general setup…using 127.0.0.1)

Here is my config at the moment…I have the DNS related rules disabled until I figure out the situation

0.JPG_thumb

1.JPG_thumb

2.JPG_thumb

3.JPG_thumb

4.JPG_thumb

5.JPG_thumb

6.JPG_thumb

Derelict

Don't know why you have all those rules duplicated. Only the first match is going to have any effect.

morreale

@Derelict:

Don't know why you have all those rules duplicated. Only the first match is going to have any effect.

some of those are due to it being 2 separate images that i should have done a better job of editing before posting :)
the others are due to being autocreated and manually created. duplicates remain disabled and were left in place only for testing

chebyshev

@Derelict:

Do you have name servers set up in System > General Setup?? What are they?

I have the Google DNS servers in there: 8.8.8.8 and 8.8.4.4.

dns.png_thumb

Derelict

I think that might be the problem. Manually set your DNS server on that host to just 4.2.2.2 and run your DNS leak test again.

chebyshev

Tried that - same result.

host_dns.PNG_thumb