Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Vpn para principiantes

    Scheduled Pinned Locked Moved Español
    5 Posts 3 Posters 4.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      leoalfa09
      last edited by

      Hola a todos he intentado configurar una vpn con openvpn y me surgieron las siguientes dudas-

      1- En el ambiente de servidor quien seria el servidor de vpn el pfsense o la maquina que configuro por dentro como servidor por que veo que en uno de los tutoriales se muestra como configurar xp como servidor y cliente-

      2- A la hora de que a la interfaz TAP se le asigne ip quein es el encargado de asignar estas ips y deberia ser en el mismo rango que la LAN?

      3- que ventajas me da sobre un acceso remoto tipo Terminal Services?

      Muchas Gracias

      1 Reply Last reply Reply Quote 0
      • L
        leoalfa09
        last edited by

        Encontre esto en el foro en ingles se ve muy bueno aqui lo dejo si funciona lo comento en este post muchas gracias

        Having spend most of my day to get OpenVPN running from a Windows Vista machine to a network on a pfSense box, i feel that a guide is needed for my kind; Windows-users not familiar with OpenVPN and alike

        A guide of how to connect a PC on the internet, to LAN behind a pfSense firewall using OpenVPN also known as a Road-Warrior setup

        This guide is NOT detailed regarding different configurations, and may not be the best security practices - so use it at your own risk…


        First of all you need to have keys and certificates generated in order to configure the pfSense OpenVPN service;

        1. Download and install the most recent software from http://openvpn.net/download.html
          If you plan to connect from a PC with Windows Vista you should get version 2.1 or newer (as of this moment its 2.1RC7).

        Use the default options

        1. Start a command prompt with administrator-rights!
          This is done in Vista by clicking on START and then type CMD -> CMD.EXE should appear, and you RIGHT-Click on it and select 'Run as Administrator'

        2. Change directory to c:\programfiles\openvpn\easy-rsa

        3. run the "init-config.bat" file

        4. Edit 'vars.bat' file.
          I suggest using 'Wordpad' and to be able to save the file again, you need to start Wordpad in the same manner as the command-prompt (see #2)
          The following things need to be edited:

        "set KEY_COUNTRY=DK"
        2 Letters country ID - I use DK for Denmark

        "set KEY_PROVINCE=na"
        2 Letters Province ID - I use na as in 'Not Applicable'

        "set KEY_CITY=Copenhagen"
        Name of city

        set KEY_ORG=Frewald
        Name of your company

        set KEY_EMAIL=youremail@address.com
        Put an email-address here. Dont use you private address, since this is the common address for the Certificate Authority (or something...)

        Save the file

        1. Run "vars.bat"

        2. Run "clean-all.bat"

        Run "build-ca.bat"
        Then you are prompted for some different things; Leave them at default, except "Common Name" - put something like "pfSense-CA"

        1. Run "build-key-server.bat server"
          Again you are prompted; leave them on default except "Common Name" - use "server"

        2. Run build-dh.bat


        Now its time to generate keys and certificates for the client(s)

        1. Run "build-key.bat ovpn_client1"
          Again you are prompted; leave them on default except "Common Name" - here you should put in "ovpn_client1" (or whatever you have called it)
          The ovpn_client1 will be the name of the keys, certificate and the name you identify the connection on later. You can use whatever name you like, and generate as many as you want (with different names).

        2. The following files should now be copied from c:\programfiles\openvpn
          easy-rsa\keys to c:\programfiles\openvpn\config
          ca.crt
          ovpn_client1.key
          ovpn_client1.crt (if you dont see a .crt file but only a .csr file, chances are that you dont have admin priviligies. Worst case generate the keys and certificates on a NON-Vista machine)

        3. Make a file in the c:\programfiles\openvpn\config
          called "ovpn_client1.ovpn" and the file should contain (leave out the hashes):

        client
        dev tun
        proto udp
        remote 64.233.167.99 1194
        ping 10
        resolv-retry infinite
        nobind
        persist-key
        persist-tun
        ca ca.crt
        cert ovpn_client1.crt
        key ovpn_client1.key
        ns-cert-type server
        comp-lzo
        pull
        verb 3

        Please put in your own public IP address of you pfSense-box in the 'remote' line
        If you have chosen another name than 'ovpn_client1' then change it in the lines beginning with 'cert' and 'key'
        If you have more than one VPN client, you make one .ovpn-file per client (with the corresponding .key and .crt name)


        Now its time to configure pfSense

        1. Log into the web-gui of pfSense

        2. Select VPN/OpenVPN and ad an entry in the 'server' page
          Use the following settings:
          Protocol: UDP
          Local port: 1194
          Address pool: 192.168.200.0/24 (it should be a network that you DONT currently use)
          Local Network: 192.168.1.0/24 or whatever the network is that you want the VPN client to connect to
          Remote Network: blank
          Cryptography: BF-CBC (128 bit) - or use what you want
          Authentication Method: PKI

        Now you need to have access to some of the files created in c:\programfiles\openvpn
        easy-rsa\keys (mentioned in #12)
        23) Copy the WHOLE content of ca.crt into the "CA certificate" window
        24) Copy the WHOLE content of server.crt into the "Server Certificate" window
        25) Copy the WHOLE content of server.key into the "Server Key" window
        26) Copy the WHOLE content of dh1024.pem into the "DH parameters" window

        1. Tick DHCP-Opt: Disable NetBIOS (I dont use it anyway)

        2. Tick LZO Compression


        Now we need a few simple rules in the firewall

        1. On the WAN interface you should make a rule that;
          PASS
          WAN
          Protocol: UDP
          source: any
          OS type: any
          Destination: any
          Destination port range from: OpenVPN
          Destination port range to: OpenVPN
          Tick in the LOG
          Leave the rest at default.

        2. and another rule on the interface called LAN (or whatever the name of the net defined in #22 'address pool' is);

        PASS
        Any protocol
        Source: LAN (or whatever the name of the net defined in #22 'address pool' is)
        Any destination

        Remember to apply the new rules.

        Now you should be able to connect from OpenVPN (rightlick on the icon in the try and select Connect).
        But remember to start OpenVPN with ADMIN RIGHTS!

        A small trick; If you want a specific client to be able to access more than one subnet, you can add a 'Client Specific Configuration' in pfSense;
        Find it in the "WebGui/VPN/OpenVPN/Client-Specific configuration", use the Common Name given in #11 (ovpn_client1) and in custom options add the following line
        push "route 192.168.2.0 255.255.255.0"
        if thats the subnet that you want to have connection to.

        Hope this small guide provides some help to those of us who isn't much into *nix and OpenVPN.

        There is problably a bunch of typ'O's - please write a comment when you see one that needs to be corrected...

        This setup is working on my current setup:
        pfSense 1.2 RC4 now running on 1.2 RELASE
        OpenVPN 2.1 RC7

        Please visit http://openvpn.net/howto.htm for much more indepth info

        Best regards,
        Frewald

        Small update:
        If you later would like to add new clients, run point 2,3,6, and continue from point 11! - dont run point 7-8-9-10!!!!
        Also note you need to do this on the machine that was orignally used to issue the certificates.

        1 Reply Last reply Reply Quote 0
        • F
          federicoha
          last edited by

          leo, nose si te servirá aún, pero te paso el link a un excelente tutorial que hizo bellera (veraz quien es el en el foro) sobre como montar openvpn con pfsense

          http://www.bellera.cat/josep/pfsense/openvpn_cs.html

          a mi me servio y mucho…

          la única diferencia que hice con respecto a lo que menciona el tutorial es que en lugar de build-key client utilice build-key-pkcs12,
          pero por lo demás, tengo una vpn funcionando hace 6,7 meses sin ningun tipo de problemas y con uso intensivo también.

          salu2

          1 Reply Last reply Reply Quote 0
          • L
            leoalfa09
            last edited by

            Funciono perfecto espero que este post le funcione a futuras personas que quieran implementar openvpn

            1 Reply Last reply Reply Quote 0
            • R
              rojocesar
              last edited by

              Una buena opcion para VPN para principiantes es hacer un VPN PPTP es sencilla y hay un tutorial en el wiki de pfsense..

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.