Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    Scheduled Pinned Locked Moved
    OpenVPN
    99
    348
    394.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • gtjG
      gtj
      last edited by

      This is an excellent tutorial and in great detail.
      I have set the PIA client successfully however I have also set an OpenVPN sewrver for remote access and these 2 don't seem to work together. I have to disable the server to have the PIA Client encrypting traffic while if I want to connect to my LAN from a remote location, I have to disable the PIA client.

      Can anyone please advise what rules should anyone use in order to have both OpenVPN instances running at the same time?

      Any help woul;d be much appreciated.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        They are completely separate. Just use a separate tunnel network for the Remote Access OpenVPN.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • gtjG
          gtj
          last edited by

          @Derelict:

          They are completely separate. Just use a separate tunnel network for the Remote Access OpenVPN.

          Does this mean I have to choose under Firewall - Rules - OpenVPN Server a different gateway for the server? (''clean'' WAN instead of the PIA gateway)

          Thanks!

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            You need to select the interface you expect the connections from the client to arrive on. That is probably WAN and not PIA.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • gtjG
              gtj
              last edited by

              @Derelict:

              You need to select the interface you expect the connections from the client to arrive on. That is probably WAN and not PIA.

              Still can't set it right. When a client is connected to the OpenVPN server, my PIA connection is either slow or down. I have to disable the server to get my connection back.

              Do I have to create a rule for both OpenVPN and PIA interfaces or just for OpenVPN? Currently under Firewall –-> Rules ---> PIA there aren't any rules set at all.

              I have created a rule for the OpenVPN interface to look like the one below:

              Interface: LAN (''Bridge'' in my case as I have bridged 2 NICs to act as one)
              Address Family: IPv4
              Protocol: TCP/UDP
              Source:Any
              Destination: Any
              Destination Port Range: 1194

              Advanced Options -->  "Gateway"---> WAN

              I apply the above but still don't see any difference.

              1 Reply Last reply Reply Quote 0
              • gtjG
                gtj
                last edited by

                Anyone that can actually help with the problem above? It will be much appreciated.

                I did the following:

                -I have created separate interfaces for both my PIAVPN and OpenVPN Server.

                -Under NAT, I generated the default WAN ''Outbound'' values for both PIAVPN (client) & OpenVPN Server

                -Created a WAN rule which allows TCP/UDP traffic to port 1194 and have selected under ''Advanced Settings'' –--> ''Gateway'' the WAN_DHCP instead of the ''Default'' I then duplicated that rule to be present under ''LAN'' as well as under ''Bridge'' tab as I have bridged the 2 NICs of my APU2C4 to act as one LAN.

                -There are no rules at all under the tabs ''OpenVPN'', ''LAN2'', ''OPENVPN'', ''BR0''.
                At the moment, rules are set only for ''WAN'', ''LAN'' and ''Bridge''.

                On the pfSense dashboard the available interfaces are all being shown as active:

                WAN        ---- up        (ip assigned)
                LAN          ---- n/a
                LAN2        ---- n/a
                PIAVPN    ---- up        (ip assigned)
                OpenVPN  ---- up        (ip assigned)
                BR0          ---- up        (ip assigned)

                What am I missing?

                1 Reply Last reply Reply Quote 0
                • H
                  Haze028
                  last edited by

                  I've followed a few different guides, and googled for quite a while and can't seem to get my connection to work properly. 
                  My mappings are set:

                  pfSense shows openVPN as connected, and my VPN interface has an IP assigned to it.  Everything looks like it should be good

                  I have two LAN firewall rules to specify which computers use the vpn and which don't:

                  I am unable to access the internet when OpenVPN is connected from a VPN_Users aliased computer.
                  I am able to ping fine from this computer ex. www.google.ca, but when I try to load a page Firefox just sits saying "Preforming TLS Handshake with.." and never loads. As soon as I shut down OpenVPN service, internet works as normal

                  I've tried looking at the log, but see no mention of an error.

                  I'm assuming this is related to my firewall not being configured properly and blocking the access.  I just don't know what I'm missing.

                  Any Suggestions?

                  1 Reply Last reply Reply Quote 0
                  • F
                    Finger79
                    last edited by

                    @Haze028, I noticed your LAN network is 150.160.170.0/24, which is a public IP range.  If you haven't purchased or otherwise own this block of IPs, you should stick with private IP ranges.

                    1 Reply Last reply Reply Quote 0
                    • B
                      bcruze
                      last edited by

                      these are the updated instructions just provided to me:

                      https://helpdesk.privateinternetaccess.com/hc/en-us/articles/115005760606-Setting-up-a-Router-running-pfSense-Firmware

                      1 Reply Last reply Reply Quote 0
                      • B
                        bcruze
                        last edited by

                        i've followed the instructions above and now i am getting several events in the logs

                        WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1542'

                        WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
                        WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a –cipher with a larger block size (e.g. AES-256-CBC).
                        WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.

                        seems like several red flags.  what is everyone's opinion on this?

                        1 Reply Last reply Reply Quote 0
                        • F
                          Finger79
                          last edited by

                          @bcruze:

                          i've followed the instructions above and now i am getting several events in the logs

                          WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1542'

                          WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
                          WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a –cipher with a larger block size (e.g. AES-256-CBC).
                          WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.

                          seems like several red flags.  what is everyone's opinion on this?

                          I get the 'link-mtu' warnings as well.  The Blowfish/SWEET32 warning is because PIA can't competently maintain their systems (and I'm a customer!) and still defaults to BF-CBC instead of at least AES-128-CBC.  They really should be using the latest OpenVPN 2.4.4 with NCP support.  As much as I like PIA, they can be a real frustrating PI[T]A….

                          As long as you (the client endpoint) have your config set to use AES-128-CBC or AES-256-CBC, it'll override the server settings, so don't worry about that warning.

                          1 Reply Last reply Reply Quote 0
                          • D
                            Dave R
                            last edited by

                            Thanks for the guide. I was able to get this configured in about an hour or so. There are a couple of things to note:

                            1. OpenVPN server port numbers are different for PIA depending if you use a sha256 or sha128 cert: https://www.privateinternetaccess.com/forum/discussion/21213/sha256-with-openvpn

                            2. I didn't want my Steam gaming traffic going over the VPN (ports 27000-27015,…) so I used a NAT Alias to create a list of ports to apply to the outbound NAT rule.

                            ports.png
                            ports.png_thumb

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              That's great but outbound NAT rules have nothing to do with what traffic goes out which interface. They only dictate what NAT occurs when traffic is already routed out that interface by policy routing or the routing table.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • D
                                Dave R
                                last edited by

                                Hrm, makes sense I guess. Got a link to something explaining how to route 80/443/53 over the VPN interface while leaving all other traffic egressing the WAN ?

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Just check don't pull routes in the OpenVPN Client configuration then policy route those destination ports to the VPN Gateway followed by pass any without setting a gateway.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    Dave R
                                    last edited by

                                    Ah, I think that works but only if I specify the VPN gateway in the LAN pass rule (under Advanced).  You mention "pass any without setting a gateway." but where else would I specify the VPN gateway for those ports?

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      You policy route using firewall rules as you already stated. So you make a rule specifying those destination ports and the desired gateway/gateway group.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        Dave R
                                        last edited by

                                        Thanks. Netflix won't work going over the vpn interface so I've created a hosts Alias containing the IP ranges for AS2906 (netflix) and created a second rule on the LAN to route the Netflix alias destinations over the WAN interface instead of the VPN interface. It doesn't seem to pick up the change though. I've reset under 'diagnostics > states > reset states' but the rule doesn't seem to be working. Tcpdump on the vpn interface shows the Aliased IP addresses still going over that interface.

                                        The docs say "first match wins" so if I have the Netflix rule at the top, and the VPN rule after that this should be working, correct? I'm assuming I'm missing some IP addresses Netflix is using but want to make sure I understand the rule ordering.

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          Post your rules then. I guarantee if the alias contains the required destinations and the rules are done correctly, it works.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            Dave R
                                            last edited by

                                            The rules are working, I think I'm just missing IP ranges. I'm using tcpdump on the PFsense box to see what's egressing the vpn interface. Even after adding a new range, I'll reload Netflix in my web browser and tcpdump shows it still hitting that IP on the vpn. If I wait a minute or so, then it seems to pick it up. Are rule changes only applied to new connections?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post