Openvpn Access server to pfsense

shetu

Hello
I install openvpn server access in centos vps. I can log in openvpn connect with username and password. I want to connect openvpn server to my local pfsense router. So I separate these file using command "./sacli -o ./separate –cn pfsense get5 " and download all files (ca.cert, client.crt, client.key, client.ovpn, ta.key) my local pc. Now how do I replicate these setting in my pfsese?

johnpoz

Using that info setup a client connection on pfsense..

Create CA in the cert manager using the ca cert, then create client cert using client and key.. And use the TA key vs letting it create its own when you setup the client.

shetu

I try to do this but do not achieve any success yet.
1. Certificate Authorities Create from ca.cert
2. Certificates create from client.crt + client.key files
3. Setup openvpn client connection.

Cart.jpg_thumb

cas.jpg_thumb

rulles.jpg_thumb

log.jpg_thumb

johnpoz

You have a cipher mismatch for 1, you need to make sure your using the same cipher setting as your server.

2nd looks like you have more than your 2 connections openvpn access server can use. Also not sure why are you using password when you can just auth with the cert? I have the same setup.. I have openvpn access server running on a vps.. Like 4 of them… And just use an autologin profile.. Grab the info from the profile file and bing bang zoom in..

I just ran through this with a clean VM yesterday since someone was having problem running server and client on 2.4.1 and thought it was a bug in pfsense.. I could fire up the VM again and post the info from both the server and the client if will help. But fix your cipher, and make sure you don't have other clients connected. The free version of access server only allows 2.

shetu

I have another vpn provider connection. I remove username and password from client connection page.


Nov 17 08:17:17 	openvpn 	60280 	WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Nov 17 08:17:17 	openvpn 	60280 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 17 08:17:17 	openvpn 	60280 	UDPv4 link local (bound): [AF_INET]10.10.11.124
Nov 17 08:17:17 	openvpn 	60280 	UDPv4 link remote: [AF_INET].................:1194
Nov 17 08:18:17 	openvpn 	60280 	[UNDEF] Inactivity timeout (--ping-restart), restarting
Nov 17 08:18:17 	openvpn 	60280 	SIGUSR1[soft,ping-restart] received, process restarting
Nov 17 08:18:19 	openvpn 	60280 	WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Nov 17 08:18:19 	openvpn 	60280 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 17 08:18:19 	openvpn 	60280 	UDPv4 link local (bound): [AF_INET]10.10.11.124
Nov 17 08:18:19 	openvpn 	60280 	UDPv4 link remote: [AF_INET]..................:1194
Nov 17 08:19:08 	openvpn 	60280 	event_wait : Interrupted system call (code=4)
Nov 17 08:19:08 	openvpn 	60280 	SIGTERM[hard,] received, process exiting

johnpoz

"[UNDEF] Inactivity timeout (–ping-restart), restarting"

I would say your not able to get there or the other end is not listening.

shetu

What do you suggest? Change Openvpn server in VPS centos or some where my config wrong in pfsense?

johnpoz

Troubleshoot why you can not get there.. Is your centos running firewall that is blocking do you have a network connectivity issue, etc.. Does the centos server show you attempting a connection.

This really is like 5 minutes to setup, and that is even fire up the openvpn access server package on the remote side.. Grab the autologin and bing bang zoom.. Did you fix your cipher mismatch and or disconnect someone else on your first problem?

Pippin

Take a look at the AS log if the connection attempt from the client shows up.
The client log does not show that because the server will silently reject the connection.

And use the TA key vs letting it create its own when you setup the client.

If I understand @johnpoz correctly, one cannot generate ta.key on client side. If he did then connection will time out.
The ta.key, generated on the server has to be imported on the client, one ta.key for server and all clients.

shetu

Yes i solve cipher mismatch and disconnected all third party other vpn service provider. I download ta key from server.

johnpoz

So that is working then?

shetu

Yesterday it was not working. But now Openvpn as connect to my pfsene. I afraid I do not learn how is this work? >:( it is working by miracle. I do not remember what do i change in pfsense?
Thanks everyone. Now try to access my local pc from Outeside home.
Please see the openvpn log in pfsense and another question where do i find (link-mtu : 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1542')?


Nov 18 10:07:33 	openvpn 	38877 	Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.3.14)
Nov 18 10:07:33 	openvpn 	38877 	Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.3.14)
Nov 18 10:07:33 	openvpn 	38877 	Options error: option 'route-metric' cannot be used in this context ([PUSH-OPTIONS])
Nov 18 10:07:33 	openvpn 	38877 	Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Nov 18 10:07:33 	openvpn 	38877 	Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Nov 18 10:07:33 	openvpn 	38877 	Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Nov 18 10:07:33 	openvpn 	38877 	Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Nov 18 10:07:33 	openvpn 	38877 	Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Nov 18 10:07:33 	openvpn 	38877 	Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:18: register-dns (2.3.14)
Nov 18 10:07:33 	openvpn 	38877 	Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:19: block-ipv6 (2.3.14)
Nov 18 10:07:33 	openvpn 	38877 	TUN/TAP device ovpnc3 exists previously, keep at program end
Nov 18 10:07:33 	openvpn 	38877 	TUN/TAP device /dev/tun3 opened
Nov 18 10:07:33 	openvpn 	38877 	ioctl(TUNSIFMODE): Device busy: Device busy (errno=16)
Nov 18 10:07:33 	openvpn 	38877 	do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Nov 18 10:07:33 	openvpn 	38877 	/sbin/ifconfig ovpnc3 10.128.0.3 10.128.0.1 mtu 1500 netmask 255.192.0.0 up
Nov 18 10:07:33 	openvpn 	38877 	/usr/local/sbin/ovpn-linkup ovpnc3 1500 1542 10.128.0.3 255.192.0.0 init
Nov 18 10:07:38 	openvpn 	38877 	Initialization Sequence Completed