Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    OpenVPN
    99
    348
    383.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Hey friends
      Can i make a vpn in pfsense firewall between the admin in my LAN to connect 2 dedicated servers with 2 public address x.x.x.x / x.x.x.x
      its urgent thanks for your answer :)

      Start another thread.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • U
        User1503
        last edited by

        Hey Derelict thanks for answering my other questiond.  My problem is..uh, I'm not the sharpest at learning; I can follow tutorials (and even wrote some for wireless) and what I need is another tutorial for setting up NAT (or LAN?) rules.  I followed this VPN tutorial and everything is running great!  But like other's have asked, I need to have 1,2 or maybe only 3 IP's (computers) use the VPN, and all other bypass the VPN and go straight to the local internet.  So the answer's I've read of 'create a Lan rule for xxx' are nice and I'm sure easy for some, but I don't know HOW to do that?  I made some LAN rules, but it blocked everything and so I just removed them.  Therefore, if you, or anyone, knows of another tutorial of 'How to create a rule for 1 IP to bypass the VPN' I sure would appreciate a link.  I can follow directions and be successful (driving, making coffee, buying groceries) but I don't know the 'how-to' of pfSense rules.  Thanks!

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Create an IP alias called vpn_hosts or something Firewall > Aliases

          Add the IP addresses that you want to be forwarded through the VPN

          Look at the first post in this thread.  Find the section called Routing.

          The walkthrough changes the LAN IPv4 Rule so it forwards all of LAN Net to PIAVPN_VPN4.  You want to make a rule just like it but ABOVE it with the source network set to the alias instead of LAN net.  Then change the LAN net rule back to Gateway: default

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • U
            User1503
            last edited by

            Thanks for the steps.  I just can't get it to work.  I either have  No outbound connection; Everything thru VPN; or Everything Open, not vpn'd.  The IP's are set in the 'VPN Out IPs' and the gateway is 'default' under the 2nd LAN rule.  Just not getting it I suppose.  Thanks for the help.

            PIA_VPN_AliasIP_rules.jpg
            PIA_VPN_AliasIP_rules.jpg_thumb

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              That should work.  You sure PIA is up when you try?  Did you clear states?

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • B
                bj24
                last edited by

                I have very similar set up and same issues.

                As I have it set up now, everything goes through the VPN. All I want is 192.168.0.102 to go on the VPN, all other traffic through ISP.

                What have I got wrong here?

                pfsens.jpg_thumb
                pfsens.jpg

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Probably a default route from the VPN provider.

                  on 2.2, check Don't pull routes in the OpenVPN client config.  on 2.1.5 add route-nopull; to the advanced section.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • B
                    bj24
                    last edited by

                    Derelict thanks for the reply,

                    I seem to of messed something up. :-[ :-[

                    A few questions:
                    1. Every time I enable and disable the VPN Client (which I do a lot while trying to set this up) it gives me a new IP which I then have to add to the firewall rules, is there a easier way of doing this?

                    2. I seem to of lost ability to have traffic go through the VPN (I could once have all or nothing), I can see small amount of traffic on the VPN but when I check my IP I get my ISPs. What did I do?

                    3. What did checking "Don't add/remove routes" do?

                    I seem to go one step forward and two steps back every time I make a change on this.

                    Thanks,

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      What rules are you talking about?  You don't need to care what address they give you.  That's the PIAVPN_V4 address and all pfSense does is NAT to it.  That can change all the time.  You are concerned with your client's LAN address that doesn't change unless you change it (presuming it's static or at least a DHCP Static Mapping which is advisable when you start policy routing based on the source address.

                      Many VPN providers push a default route to you so all your traffic gets sent through them.  Checking that box adds route-nopull; to your client configuration which tells the client to ignore all the routes pushed to you.  This leaves it up to you to policy route the traffic you want to go to the VPN.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • B
                        bj24
                        last edited by

                        I will attach what I think might be useful, let me know if anything else is needed.

                        I also noticed when I check the gateway that the VPN shows online but then quickly goes offline after enabling. Any thoughts on that?

                        2.jpg
                        2.jpg_thumb

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Which rule do you think you have to change?  What, exactly, is the problem?

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • B
                            bj24
                            last edited by

                            I have to disable that top rule to reply.

                            When all the rules are enabled, on the BJENVY pc, it doesn't seem to have internet for some time, then it comes for a few seconds, I can check the ip and it is my WAN IP and then it stops responding.

                            Should I be concerned about the Gateway showing offline?

                            scratching my head… ???

                            1 Reply Last reply Reply Quote 0
                            • U
                              User1503
                              last edited by

                              Thanks to Derelict for keeping me at it.  I got the separate IP's working out thru the VPN and all others thru normal gateway/router. 
                              bj24 - Follow the steps in Derlict's post for making an alias.  Add the IP's you want going out thru the VPN to it.  Give it a name like 'IPs_Out_VPN' or something you will recognize. 
                              Then go to Firewall-Rules-Lan
                              Click the plus to create a new rule based on LAN net
                              Action=Pass, Interface=LAN, TCP/IP=IPv4, Protocol=any, Source=Type:Single host or alias, Address: IPs_Out_VPN; Destination=any, Description=LAN PIA_VPN Specific IP address Out
                              Advanced features:  Gateway=PIAVPN_VPN4-some.ip. (this should be in the list if you followed the tutorial)
                              Save, Apply Changes
                              In Firewall: Rules - LAN  Click the rule you just made in the checkbox on the left;  Then point at the Arrow to the right of the LAN net rule, and move your IP out rule above it.  It should now be the first rule.
                              Go to Status-Services, Restart DHCP, Restart OpenVPN.
                              Give your computers 1-2 minutes to get a refreshed IP and see if your computers are running thru the interface you want.
                              **** Mine Didn't*** Because I had to go change this:
                              Firewall-Rules-LAN
                              Choose your IPv4 LAN net (gateway should be '*')  click Edit
                              Advanced features - Gateway:  Choose 'WAN_DHCP - 192.168.x.x' 
                              Save- Apply changes. 
                              Go to Status-Services, Restart DHCP, Restart OpenVPN.
                              Give your computers 1-2 minutes to get a refreshed IP and see if your computers are running thru the interface you want.
                              If all works, save this to your notepad along with the tutorial and you're good to go! 
                              Let me know if you need the individual steps for making the Alias list, it's pretty straightforward but until you do it you can be poking around. 
                              Thanks Derelict and others for getting us going!

                              1 Reply Last reply Reply Quote 0
                              • B
                                bj24
                                last edited by

                                This is very frustrating.

                                I have it as you two have said as far as I can tell and it does not work as expected.

                                Should I be concerned that the Gateway for the VPN shows offline?!

                                What logs should I be looking at or screens? I have found another laptop to use as a tester so I stop losing internet when I test on myself. I have added its IP to the list with a Alias of IPs_Out_VPN.
                                I have made a Lan rule with the Gateway selected to use the VPN.

                                I restarted the 2 services.

                                I test the computer, it still has my ISPs IP address and after a less than 2 minutes internet stops completely on it.

                                Should I start to suspect PIA? Like I've wondered, the Gateway keeps going from online to offline.

                                puzzled….

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Disable gateway monitoring on that gateway.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    bj24
                                    last edited by

                                    Thank you, that has solved the gateway offline issue.

                                    However still no routing of IPs_Out_VPN to go out the VPN.

                                    progress!!…

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      Why are your NAT entries back here: https://forum.pfsense.org/index.php?topic=76015.msg500950#msg500950 for 192.168.1.0 and your policy route is for 192.168.0.102?

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        bj24
                                        last edited by

                                        I hope thats the issue. I corrected that to 192.168.0.0 but still nothing.

                                        Here is my updated NAT list, do I need to keep all 7?

                                        tested it now and still on the ISP IP.

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bj24
                                          last edited by

                                          oops, heres the NAT list

                                          3.JPG
                                          3.JPG_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by

                                            What are the contents of alias BJENVY?

                                            What is the IP address of the host you're testing from?

                                            Is the VPN up?

                                            Please post evidence so we can see everything is as it should be.

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post