Tutorial: Configuring pfSense as VPN client to Private Internet Access
-
:)
-
Will start fresh and see how it goes… cross your fingers ;)
-
HOLD UP. My last post I noticed my IP address in the lower right corner and it wasn't mine, it was the IP of the VPN!! So something is working.
I go to speedtest.net and it shows my current location and ISP IP.
I go to whatismyip.org and it shows my ISP IP and location.What is going on? Why did my post or this forum recognize the VPN but nothing else seemingly?
steps forward…
-
There is nothing in your config that cares about the destination unless you're not telling us everything. Is your VPN going up and down? Lots of sites report IP addresses. What does www.ipecho.net say? What does www.wimi.com say?
-
Derelict,
What do you imply that I wouldn't be telling?
Every time I check the status of the VPN it is up and well. When I use the PC application the VPN is very stable. The logs for openVPN don't show anything strange.
Both of those site showed my ISP IP.
Any other logs I should be looking at?
-
Status > OpenVPN has a connected since column.
I say there's something else afoot because if there wasn't it would be working.
-
I checked the connection time and it was up for almost a day now.
I tried unchecking the "Don't add/remove routes" box. To my amazement when I checked the IP it was my VPN! How ever when I checked it on a PC that should be on the ISP is was showing the VPN. I changed it back.
I tried checking "Don't pull routes" too but that didn't seem to help.
-
If I use the website ipleak.net I get these results…
Showing my ISP IP 50.*** and also my VPN IP 104.***
what gives?
-
Are you running squid?
-
I do have squid
-
-
I turned off squid and it works as expected now. :o ::) :-[
I had no idea squid would be interfering especially if I am going to uncached never before visited sites like the ones you suggested to try.
Thank you for the suggestion!
So no squid + VPN setup? Or will more configuring will be required if I want both?
Thanks again, I can live without squid I think.
-
Thanks again, I can live without squid I think.
Most people don't need it. it just breaks things.
-
proven ;D
thanks again!
-
Thanks It works for specific IP (static) in the LAN
Is there a way to route the traffic based on IP or URL ? (for netflix for exemple)
Thanks
-
It is very similar to routing static IPs.
Under Firewall rules : LAN you'll want to make a rule for:
Source: being your static IPs being routed, or leave blank if all
Destination: being the IP address of the website you are trying to route
Gateway: being the VPN or default as need requires
-
Thanks
I already have some IP that are routed to openvpn
I wanted to know if all IP coudl be routed based only on url ?
:D
-
Source: *
Destination: being the IP address of the website you are trying to route
Gateway: being the VPN
-
The trouble is a "website" will load assets from many different domains. Run NoScript for a while. And that'll just show you all the different places the site is trying to pull javascript from. Not images, etc.
You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.
-
Thanks for the steps. I just can't get it to work. I either have No outbound connection; Everything thru VPN; or Everything Open, not vpn'd. The IP's are set in the 'VPN Out IPs' and the gateway is 'default' under the 2nd LAN rule. Just not getting it I suppose. Thanks for the help.
A little late to the Party, but…...............
With PIA you have 2 WAN's in effect. Pfsense gives the VPN priority......I tried the NO_PULL route, doesn't work at least I never could get it to.
MY SOLUTION....Set fixed IP's or find the static IP's of the TV,s devices you wish to run outside the vpn. Then You make rules on the LAN interface (NAT will bring them back in, most likely will not need little if any tweaking ) and on your gateway set the gateway in the rule to PIA interface name, THEN click the little box above it to NOT use it….....anything you want out and NOT thru PIA you'll want to do this way. Set mine this way 6-8 months ago and is working perfectly with Netfilx, Ebay, etc as they are also blacklisting PIA IP's.
On your Email with PIA.....click on their help or send an email to them, tell them what email servers (you need the actual numerical IP) you will be using and that you need to get smtp on 25 opened for you on those........their tech will "adjust" the setting for you....they just don't want someone using PIA for spamming. As long as your traffic is average you won't have a problem......You will also need to adjust the email program setting to use the numerical IP's instead of the resolved name. Been working for me for over a year now. I leave my VPN running 24/7 (on the Pfsense box)...you can also run PIA within PIA I have. I have posted a screen shot of the my firewall rules. The ones with the !No PIA.net are the ones bypassing the VPN..
Notice they are at the bottom..........I let default be PIA and EXCEPTED the oddballs, that way anything else I plug in will automatically go to PIA by default.I have my Roku Box and my VIZIO TV set to NOT PIA works fine. I flip my PC when needed or wanted............or use their windows app. I prefer the Pfsense tunnel.
Our cell phones are WIFI SIP phones, using wifi when around wifi and cellular when wifi not available.....................Worked from day one, no special config was needed to get them up and running.Stinking Netflix, Hulu, Ebay and CBS............ >:( >:(
If you WANT to use the VPN, just edit the rule back to * all. Give it a couple of minutes and you'll be on vpn or visa versa.
SEE ATTACHED SCREEN SHOTS
Not sure about the NAT with the 2.2.1 version yet, I had custom NAT rules. It appears that the Default or Hybrid would work.....depends on how intricate or simple your install is.....the more "intricate" the more your NAT or rules will have to be.......
