Openvpn Access server to pfsense
-
Hello
I install openvpn server access in centos vps. I can log in openvpn connect with username and password. I want to connect openvpn server to my local pfsense router. So I separate these file using command "./sacli -o ./separate –cn pfsense get5 " and download all files (ca.cert, client.crt, client.key, client.ovpn, ta.key) my local pc. Now how do I replicate these setting in my pfsese? -
Using that info setup a client connection on pfsense..
Create CA in the cert manager using the ca cert, then create client cert using client and key.. And use the TA key vs letting it create its own when you setup the client.
-
I try to do this but do not achieve any success yet.
1. Certificate Authorities Create from ca.cert
2. Certificates create from client.crt + client.key files
3. Setup openvpn client connection.
-
You have a cipher mismatch for 1, you need to make sure your using the same cipher setting as your server.
2nd looks like you have more than your 2 connections openvpn access server can use. Also not sure why are you using password when you can just auth with the cert? I have the same setup.. I have openvpn access server running on a vps.. Like 4 of them… And just use an autologin profile.. Grab the info from the profile file and bing bang zoom in..
I just ran through this with a clean VM yesterday since someone was having problem running server and client on 2.4.1 and thought it was a bug in pfsense.. I could fire up the VM again and post the info from both the server and the client if will help. But fix your cipher, and make sure you don't have other clients connected. The free version of access server only allows 2.
-
I have another vpn provider connection. I remove username and password from client connection page.
Nov 17 08:17:17 openvpn 60280 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Nov 17 08:17:17 openvpn 60280 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Nov 17 08:17:17 openvpn 60280 UDPv4 link local (bound): [AF_INET]10.10.11.124 Nov 17 08:17:17 openvpn 60280 UDPv4 link remote: [AF_INET].................:1194 Nov 17 08:18:17 openvpn 60280 [UNDEF] Inactivity timeout (--ping-restart), restarting Nov 17 08:18:17 openvpn 60280 SIGUSR1[soft,ping-restart] received, process restarting Nov 17 08:18:19 openvpn 60280 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Nov 17 08:18:19 openvpn 60280 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Nov 17 08:18:19 openvpn 60280 UDPv4 link local (bound): [AF_INET]10.10.11.124 Nov 17 08:18:19 openvpn 60280 UDPv4 link remote: [AF_INET]..................:1194 Nov 17 08:19:08 openvpn 60280 event_wait : Interrupted system call (code=4) Nov 17 08:19:08 openvpn 60280 SIGTERM[hard,] received, process exiting -
"[UNDEF] Inactivity timeout (–ping-restart), restarting"
I would say your not able to get there or the other end is not listening.
-
What do you suggest? Change Openvpn server in VPS centos or some where my config wrong in pfsense?
-
Troubleshoot why you can not get there.. Is your centos running firewall that is blocking do you have a network connectivity issue, etc.. Does the centos server show you attempting a connection.
This really is like 5 minutes to setup, and that is even fire up the openvpn access server package on the remote side.. Grab the autologin and bing bang zoom.. Did you fix your cipher mismatch and or disconnect someone else on your first problem?
-
Take a look at the AS log if the connection attempt from the client shows up.
The client log does not show that because the server will silently reject the connection.And use the TA key vs letting it create its own when you setup the client.
If I understand @johnpoz correctly, one cannot generate ta.key on client side. If he did then connection will time out.
The ta.key, generated on the server has to be imported on the client, one ta.key for server and all clients. -
Yes i solve cipher mismatch and disconnected all third party other vpn service provider. I download ta key from server.
-
So that is working then?
-
Yesterday it was not working. But now Openvpn as connect to my pfsene. I afraid I do not learn how is this work? >:( it is working by miracle. I do not remember what do i change in pfsense?
Thanks everyone. Now try to access my local pc from Outeside home.
Please see the openvpn log in pfsense and another question where do i find (link-mtu : 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1542')?Nov 18 10:07:33 openvpn 38877 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.3.14) Nov 18 10:07:33 openvpn 38877 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.3.14) Nov 18 10:07:33 openvpn 38877 Options error: option 'route-metric' cannot be used in this context ([PUSH-OPTIONS]) Nov 18 10:07:33 openvpn 38877 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS]) Nov 18 10:07:33 openvpn 38877 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS]) Nov 18 10:07:33 openvpn 38877 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS]) Nov 18 10:07:33 openvpn 38877 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS]) Nov 18 10:07:33 openvpn 38877 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS]) Nov 18 10:07:33 openvpn 38877 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:18: register-dns (2.3.14) Nov 18 10:07:33 openvpn 38877 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:19: block-ipv6 (2.3.14) Nov 18 10:07:33 openvpn 38877 TUN/TAP device ovpnc3 exists previously, keep at program end Nov 18 10:07:33 openvpn 38877 TUN/TAP device /dev/tun3 opened Nov 18 10:07:33 openvpn 38877 ioctl(TUNSIFMODE): Device busy: Device busy (errno=16) Nov 18 10:07:33 openvpn 38877 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Nov 18 10:07:33 openvpn 38877 /sbin/ifconfig ovpnc3 10.128.0.3 10.128.0.1 mtu 1500 netmask 255.192.0.0 up Nov 18 10:07:33 openvpn 38877 /usr/local/sbin/ovpn-linkup ovpnc3 1500 1542 10.128.0.3 255.192.0.0 init Nov 18 10:07:38 openvpn 38877 Initialization Sequence Completed
