OpenVPN TAP Bridging with LAN
This topic is locked, but good:
However, I tried it, but it doesn't work.
I've gone through the setup twice, making sure I followed all of the steps. I'll edit this when we find the solution.
I contacted NetGate with a trouble ticket, and they advised that OpenVPN TAP bridging is a security risk. In any event, here are the steps I followed:
First Install the OpenVPN Client Export Utility Package
Goto System –-> Packages
Choose "Available Packages Tab"
Locate the OpenVPN Client Export Utlity Package and install it by pressing the "+" on the right
Setup your Certs
Goto System ---> Cert Manager
Goto CA Tab and create a CA by pressing the "+" button
Fill in the boxes with the appropriate information, making sure to change method to "Create Internal Certificate Authority". Alternatively you can also import your own. (outside the scope of this guide)
Create the server certificate by clicking the "Certificates" tab and pressing the "+" button
Change "Method" to "Create an internal Certificate", and "Certificate Type" to "Server Certificate" Fill in the appropriate information and make sure to change the Certificate Authority to that of the CA you just created in step 3.
Create User Certificates in the same way but instead of choosing "Server Certificate" for Certificate type, make sure to choose "User Certificate"
*It is recommended that each individual PC that connects to the VPN have their own certificates created.
**It is also not necessary, but recommened to create a revocation list. Click the Client Revocation tab, then the "+" to add one. Choose the CA you made in step 3.
Setup the OpenVPN server
- Goto VPN ---> OpenVPN
- On the Server tab press the "+" button to create an OpenVPN server
- Fill in the following settings
Disabled - Unchecked (Obviously!)
Server Mode - Remote Access (SSL/TLS)
Protocol - UDP
Device Mode - tap
Interface - WAN
Port - 1194
Description - description of your server
TLS Authentication - Check both boxes... this also creates your authentication key
Peer Certificate Authority - choose the CA you created earlier
Peer Certificate Revocation List - if you made one while setting up the certs specify it here
Server Certificate - choose the server certificate you created earlier
DH Parameters - 1024
Encryption algorithm: AES-128-CBC (128-bit)
Hardware Crypto - options here may differ, but choose a hardware crypto engine if you have one
Certificate Depth - One (Client+Server)
Ipv4 Tunnel Network - Leave blank, not used in tap/bridge mode
Ipv6 Tunnel Network - Leave blank, not used in tap/bridge mode
Bridge DHCP - check
Bridge Interface - LAN
Server Bridge DHCP Start - start of your ip address range for remote clients
Server Bridge DHCP End - end of your ip address range for remote clients
*DHCP address range should be a range of IP addresses that are within the ip address range of your LAN network.
Redirect Gateway - uncheck
IPv4 Local Network - this is the address of your LAN network expressed as a CIDR range, most likely 192.168.1.0/24
IPv6 Local Network - Leave blank
Concurrent connections - 2
Compression - for bandwidth reduction check this box
Type-of-Service - uncheck
Inter-client communication - check this box if you want remote clients to be able to access each other
Duplicate Connections - allows multiple connections from the same client, not recommended but may possibly be needed
Dynamid IP - if your router's WAN IP changes you should check this
Address Pool - check
DNS Default Domain - fill this in if you have one
DNS Servers - set to your local DNS server
Press save and your OpenVPN server is created
Create your Interface and Bridge:
- Interfaces ---> (assign)
- add an interface by pressing the "+" button
- in the drop down box next to the OPT1 interface that was created choose the open vpn server instance we just created
- goto Interfaces ---> OPT1
- Enable the interface and give it a Description
- goto Interfaces ---> (assign)
- choose the Bridges tab and then click the "+" button to add a bridge
- Hold the CTRL button and highlight both your LAN interface and the renamed OPT1 interface we just created.
Create a firewall rule allowing traffic on your OpenVPN port for the WAN interface.
- Goto Firewall ---> Rules
- Choose the WAN tab
- Press the "+" on near the top right to add a rule and enter the following information:
TCP/IP Vesion: IPv4
Protocol: The protocol you chose in the OpenVPN server settings, probably UDP
Address: leave blank
type: WAN address
Destination port range: Port your OpenVPN server runs on, probably 1194
Log: up to you
Description: optional, give the rule a description
You're done. The last thing to do is export the client configs. Luckily with v2.1 pfsense has made this stupid easy to do.
- VPN ---> OpenVPN
- Choose the client Export Tab
- You should see an option to export a config for each certificate you created earlier. Hopefully you named your certs something easily identifiable.
- Its recommended that for Windows you choose the Windows Installer. This will download and install OpenVPN and the config files.
Current status (will update once we get it working).
I can connect, but nothing routes to the remote office.
Remote LAN: (IP's sanitized)
pfSense box: 192.168.10.254
My IP (via OpenVPN) 192.168.10.32
My local LAN is 192.168.0.1 (I'm testing as if I'm a typical home user).
If I ping 192.168.10.254 the route goes out my default gateway. (Note that redirect gateway setting was set off, per instructions).
IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.111 10 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.0.0 255.255.255.0 On-link 192.168.0.111 266 192.168.0.111 255.255.255.255 On-link 192.168.0.111 266 192.168.0.255 255.255.255.255 On-link 192.168.0.111 266 192.168.10.0 255.255.255.0 On-link 192.168.10.32 276 192.168.10.0 255.255.255.0 192.168.10.254 192.168.10.32 20 192.168.10.32 255.255.255.255 On-link 192.168.10.32 276 192.168.10.255 255.255.255.255 On-link 192.168.10.32 276 126.96.36.199 240.0.0.0 On-link 127.0.0.1 306 188.8.131.52 240.0.0.0 On-link 192.168.0.111 293 184.108.40.206 240.0.0.0 On-link 192.168.10.32 276 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.0.111 266 255.255.255.255 255.255.255.255 On-link 192.168.10.32 276 ===========================================================================
Id guess you have to bridge the tap interface to the lan. I think that was a change in 2.3 so the old guide doesn't work