Cannot connect to server on PfSense
-
Hi,
I have a Protecli firewall with PFSense on it. I use ProtonVPN.
I had my whole setup configured with a book tutorial a few years ago. Works with no problem, excpet sometimes it would be unable to connect to the internet and in my Status, it would say "down".
When I first encountered this, I asked the forum, and eventually found the way to deal with it. I usually needed to reset the credentials, and it would be fine. Other times, I would just need to change the IP address, and it would be back up.
A few days ago the connection went "down" again. I tried the usual tricks and now nothing works. It is just "down" and i have no idea how to troubleshoot.
Any help would be great thank you, I cna provide any kind of screenshot to help troubleshoot this.
-
oh man, where to even begin... ok let's clarify some things first
- what version of pfSense?
- "in my Status it would say down"- you mean in your ProtonVPN status? pfSense gateway status? or something else?
- "reset the credentials, and it would be fine" - you mean your Proton credentials?
- "change the IP address, and it would be back up" - assuming you mean change the IP of the VPN server you're connecting to?
- "I tried the usual tricks and now nothing works" ... what tricks did you try specifically?
Oh and yes please do post some screenshots! System > Routing, VPN interface, Firewall rules, outbound NAT rules, Status > System Log... anything you think might be relevant (black out or pixelate if there's info you don't want to share)
-
@luckman212 said in Cannot connect to server on PfSense:
oh man, where to even begin... ok let's clarify some things first
- what version of pfSense?
- "in my Status it would say down"- you mean in your ProtonVPN status? pfSense gateway status? or something else?
Yes ProtonVPN status
- "reset the credentials, and it would be fine" - you mean your Proton credentials?
Yes exactly.
- "change the IP address, and it would be back up" - assuming you mean change the IP of the VPN server you're connecting to?
Yes.
- "I tried the usual tricks and now nothing works" ... what tricks did you try specifically?
Just meant that i tried changing IP address and resetting credentials.
Oh and yes please do post some screenshots! System > Routing, VPN interface, Firewall rules, outbound NAT rules, Status > System Log... anything you think might be relevant (black out or pixelate if there's info you don't want to share)
Let me get some together but hope that answers a few things
-
@fiyawall Proton is showing the validity of their Credentials on their website, nothing pfSense can do about those.
Here it is working fine, so no general problem with them. -
Do you have to use an IPv4 like :
1.2.3.4
or can you use (does Porton provide) a host name like :
Imagine this :
Proton has several VPN servers all over the globe. A couple of servers per country, every server has a dedicated 'fixed' IP address. The probably have thousands of IP address all over the world.
They also have millions of subscribers.
(edit : Google told me : about 15000).
Now, some math : divide 'millions' (of proton users) by these 'thousands' and you have the number of subscribers using the same server IP (give or take).
What happens when every subscriber on your VPN sever IP uses, let's say 100 Mbit/sec ? With 1000 users online on this server IP, then line (1 Gbit/sec) gets totally saturated.
Your VPN connection stalls ... the Status shows a bad ping, or even "Offline".
Your login credentials didn't change, these are not the issue. Proton would change them on their side without notifying you. On your side (pfSense) : the credentials are there, and they didn't get 'lost' or were changed.
So no need to 'reset' them, whatever that means.Select select another Proton server IP, one that is hopefully less occupied, and you're back online again.
If you could use a host name (see my second image as an example) the Proton could help you : they would remove a saturated server IP (temporarily) from the DNS list for a while, forcing new incoming connections (Proton VPN users) to use another IP.
Let's imagine the connection would fail again.
The VPN client resets == it restarts.
The proton VPN server host name, for example "node-us-234.protonvpn.net" would get resolved, and an IP, or list with IPs, comes back - this is the DNS part.
The VPN client picks one IP, and connect to it.
If an IP (thus server) gets saturated, that IP won't be part of the DNS reply anymore.
Your issue : gone, as it auto-resolves itself. -
@Gertjan said in Cannot connect to server on PfSense:
Your login credentials didn't change, these are not the issue.
Proton makes a key-pair for every tunnel (in sum two for both sides), that is somewhat annoying, and then also limits the validity of them to some months, also annoying.
I have another provider that lets me upload my pub key (only one is needed, I can upload more) and I can use that for all the tunnels to them...
I am talking WireGuard though, OP didn't even clarify that.
-
Thanks for these precision. As you might have guessed, I'm not a proton user.
So its totally normal that the VPN connection 'breaks' after a while (if the admin forgets to do it's job ^^).
Privacy Policy · Cookie Policy