Tutorial: Configuring pfSense as VPN client to Private Internet Access

[bj24]

I do have squid

[Derelict]

@bj24:

I do have squid

You're on your own then.  Unbelievable.

[bj24]

I turned off squid and it works as expected now.  :o ::) :-[

I had no idea squid would be interfering especially if I am going to uncached never before visited sites like the ones you suggested to try.

Thank you for the suggestion!

So no squid + VPN setup? Or will more configuring will be required if I want both?

Thanks again, I can live without squid I think.

[Derelict]

Thanks again, I can live without squid I think.

Most people don't need it.  it just breaks things.

[bj24]

proven  ;D

thanks again!

[stanthewizard]

Thanks It works for specific IP (static) in the LAN

Is there a way to route the traffic based on IP or URL ? (for netflix for exemple)

Thanks

[bj24]

It is very similar to routing static IPs.

Under Firewall rules : LAN you'll want to make a rule for:

Source: being your static IPs being routed, or leave blank if all

Destination: being the IP address of the website you are trying to route

Gateway: being the VPN or default as need requires

[stanthewizard]

Thanks

I already have some IP that are routed to openvpn

I wanted to know if all IP coudl be routed based only on url ?

:D

[bj24]

Source: *

Destination: being the IP address of the website you are trying to route

Gateway: being the VPN

[Derelict]

The trouble is a "website" will load assets from many different domains.  Run NoScript for a while.  And that'll just show you all the different places the site is trying to pull javascript from.  Not images, etc.

You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.

[saytar]

@User1503:

Thanks for the steps.  I just can't get it to work.  I either have  No outbound connection; Everything thru VPN; or Everything Open, not vpn'd.  The IP's are set in the 'VPN Out IPs' and the gateway is 'default' under the 2nd LAN rule.  Just not getting it I suppose.  Thanks for the help.

A little late to the Party, but…...............

With PIA you have 2 WAN's in effect. Pfsense gives the VPN priority......I tried the NO_PULL route, doesn't work at least I never could get it to.

MY SOLUTION....Set fixed IP's or find the static IP's of the TV,s devices you wish to run outside the vpn. Then You make rules on the LAN interface (NAT will bring them back in, most likely will not need little if any tweaking ) and on your gateway set the gateway in the rule to PIA interface name, THEN click the little box above it to NOT use it….....anything you want out and NOT thru PIA you'll want to do this way. Set mine this way 6-8 months ago and is working perfectly with Netfilx, Ebay, etc as they are also blacklisting PIA IP's.
On your Email with PIA.....click on their help or send an email to them, tell them what email servers (you need the actual numerical IP) you will be using and that you need to get smtp on 25 opened for you on those........their tech will "adjust" the setting for you....they just don't want someone using PIA for spamming. As long as your traffic is average you won't have a problem......You will also need to adjust the email program setting to use the numerical IP's instead of the resolved name. Been working for me for over a year now. I leave my VPN running 24/7 (on the Pfsense box)...you can also run PIA within PIA I have. I have posted a screen shot of  the my firewall rules. The ones with the !No PIA.net are the ones bypassing the VPN..
Notice they are at the bottom..........I let default be PIA and EXCEPTED the oddballs, that way anything else I plug in will automatically go to PIA by default.

I have my Roku Box and my VIZIO TV set to NOT PIA works fine. I flip my PC when needed or wanted............or use their windows app. I prefer the Pfsense tunnel.
Our cell phones are WIFI SIP phones, using wifi when around wifi and cellular when wifi not available.....................Worked from day one, no special config was needed to get them up and running.

Stinking Netflix, Hulu, Ebay and CBS............ >:( >:(

If you WANT to use the VPN, just edit the rule back to * all. Give it a couple of minutes and you'll be on vpn or visa versa.

SEE ATTACHED SCREEN SHOTS

Not sure about the NAT with the 2.2.1 version yet, I had custom NAT rules. It appears that the Default or Hybrid would work.....depends on how intricate or simple your install is.....the more "intricate" the more your NAT or rules will have to be.......

[saytar]

@Derelict:

The trouble is a "website" will load assets from many different domains.  Run NoScript for a while.  And that'll just show you all the different places the site is trying to pull javascript from.  Not images, etc.

You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.

Agreed, found it out the hard way trying to uhhhh time shift some, Netflix breaks a movie into at least 40 pieces or more (or clips) and they all get a different IP designation, and they pull in each segment as needed with your device caching each segment or part of. Your IP would litterally be a moving target…................that's why its more productive to identify the device that needs clear internet set it to use unencrypted WAN, If the NSA want to watch a movie with me (80% is granddaughter and my little pony or pinky..no state secrets) so be it....anything I don't wish to watch with them I use the PC on encrypted.......set everything else encrypted by default and only adjust as required.

Before this last update Pfsense and PIA were up for 59 days uninterrupted (I have UPS)

But the Update DID break my PIA vpn and screwed up my NTP forward for Layer 3 switch (a play toy, still haven't got IT all figured out yet) and references. It (even with a backup reloaded, forgot to backup config.xml file) lost my login and password file and I had reconfigure  a firewall bypass for NTP....seems they changed something with the NAT, not clear just yet how that was "readjusted" by the Dev's..............minor tweaks, buuuuttt. I had to make an entire new password file with login and password, then worked fine.

[saytar]

@bj24:

I have to disable that top rule to reply.

When all the rules are enabled, on the BJENVY pc, it doesn't seem to have internet for some time, then it comes for a few seconds, I can check the ip and it is my WAN IP and then it stops responding.

Should I be concerned about the Gateway showing offline?

scratching my head… ???

Mine has ALWAYS shown as down on the Dashboard Gateway Panel. But checking on Service status is mean and green…......that's a quirk they have never "fixed".

[stanthewizard]

@Derelict:

You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.

How do you mke such aliases ?

[Derelict]

Create the alias.


[stanthewizard]

Thanks
I tried previously to create that kind of aliases in url
Didn't worked  :o

In IP it works
I created an aliases for what is my ip adress and changed a rule … Every IP inside my lan show an adress from the vpn when accessing what is my ip adress. With an other service like what is my ip, I have the adress from my ISP.

So it works !

But not success with netflix
In the netflix alieses I have this

netflix.com

lnwd.net

nflximg.com

edgesuite.net

nflximg.net

[Derelict]

Sorry, but I don't play whack-a-mole.

The URL aliases are for downloading the content of the aliases from a URL, not for creating an alias based on a FQDN.

[stanthewizard]

Thank you for your help
I think that is a good start

;D

[louicruz88]

THIS IS PFSENSE GOLD!!!!
I am having one issue though. SMTP Notifications seem to not work when PIAVPN/OpenVPN is running.
I stopped the OpenVPN service and notifications worked just fine.
Logs state:

"php-fpm[38529]: /system_advanced_notifications.php: Could not send the message to myemailadress@xxxx.com – Error: could not resolve host "smtp.xxxxx.com"

Any ideas on a possible fix?

[YoMan]

The tutorial states to turn off hardware encryption and to use BL-128.  Is there anyway to use AES-256 instead and use hardware encryption?