Tutorial: Configuring pfSense as VPN client to Private Internet Access
-
Thank you for your help
I think that is a good start;D
-
THIS IS PFSENSE GOLD!!!!
I am having one issue though. SMTP Notifications seem to not work when PIAVPN/OpenVPN is running.
I stopped the OpenVPN service and notifications worked just fine.
Logs state:"php-fpm[38529]: /system_advanced_notifications.php: Could not send the message to myemailadress@xxxx.com – Error: could not resolve host "smtp.xxxxx.com"
Any ideas on a possible fix?
-
The tutorial states to turn off hardware encryption and to use BL-128. Is there anyway to use AES-256 instead and use hardware encryption?
-
Found out tha PIA blocks smtp servers by default due to spam.
Had to open a ticket with PIA for them to test the smtp server and whitelist it
SMTP notifications are working fine now!!!!!THIS IS PFSENSE GOLD!!!!
I am having one issue though. SMTP Notifications seem to not work when PIAVPN/OpenVPN is running.
I stopped the OpenVPN service and notifications worked just fine.
Logs state:"php-fpm[38529]: /system_advanced_notifications.php: Could not send the message to myemailadress@xxxx.com – Error: could not resolve host "smtp.xxxxx.com"
Any ideas on a possible fix?
-
A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.
That way when PIA or the email server operator makes a change it doesn't break again.
Or move to SSL/STARTTLS and use submit port 587 with authentication.
-
Really!!! I looked but wasn't able to find ROUTE_NOPULL.
Where can I find route-nopull option????A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.
That way when PIA or the email server operator makes a change it doesn't break again.
Or move to SSL/STARTTLS and use submit port 587 with authentication.
-
Really!!! I looked but wasn't able to find ROUTE_NOPULL.
Where can I find route-nopull option????A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.
That way when PIA or the email server operator makes a change it doesn't break again.
Or move to SSL/STARTTLS and use submit port 587 with authentication.
https://forum.pfsense.org/index.php?topic=76015.msg501074;topicseen#msg501074
-
In the tutorial, manual NAT rules are required … is this still required for 2.2.1 and why is this?
1. How come the OpenVPN wizard doesn't automatically add the NAT rules?
2. How come pfSense automatic NAT rules doesn't do this for you?Just wondering why manual rules must be added.
Thanks.
-
1. How come the OpenVPN wizard doesn't automatically add the NAT rules?
2. How come pfSense automatic NAT rules doesn't do this for you?Because people usually do NOT want all their Internet-bound traffic go through some slow VPN tunnel.
-
Because people usually do NOT want all their Internet-bound traffic go through some slow VPN tunnel.
Great thanks, so I got my tunnel up and running… however, my performance is only ~40mbps.
I'm running an Atom D525 CPU, what should be the expected performance?
When I run TOP, my WCPU for OpenVPN hovers around 50% ... however, the other cores/threads are pretty idle.
Here is my TOP output:
last pid: 15026; load averages: 1.02, 0.61, 0.43 up 19+02:05:29 14:33:57
210 processes: 7 running, 177 sleeping, 26 waiting
CPU: % user, % nice, % system, % interrupt, % idle
Mem: 28M Active, 179M Inact, 542M Wired, 465M Buf, 7172M Free
Swap: 16G Total, 16G FreePID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND
11 root 155 ki31 0K 64K CPU2 2 440.2H 79.05% idle{idle: cpu2}
11 root 155 ki31 0K 64K CPU0 0 432.5H 78.66% idle{idle: cpu0}
11 root 155 ki31 0K 64K RUN 3 446.5H 76.56% idle{idle: cpu3}
11 root 155 ki31 0K 64K RUN 1 443.6H 68.16% idle{idle: cpu1}
28854 root 52 0 21728K 5752K select 0 1:06 58.40% openvpn -
Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.
-
Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.
Publish over PIA or over the internet bypassing PIA?
For the former, PIA has to forward a port to you. Do they support that?
For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.
If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.
IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.
-
Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.
Publish over PIA or over the internet bypassing PIA?
For the former, PIA has to forward a port to you. Do they support that?
For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.
If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.
IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.
PIA does support port forwarding but the port changes every time you get disconnected.
What do you use in place of Plex or do you just not have a media server you can access remotely?
-
I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk. -
@irj972:
I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately. I realize having it open to the public is not ideal. However given that fact, I'm trying to make it as secure and hidden as I can.
-
As far as I know, you have to have the Plex port open to the world just to sign it into plex. Doesn't have anything to do with who you allow access to it.
-
@irj972:
I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately. I realize having it open to the public is not ideal. However given that fact, I'm trying to make it as secure and hidden as I can.
Yes, I can see how that would be an added inconvenience.
-
When trying to start the VPN client connection configured for PIA, I receive the following error:
Cannot load CA certificate file /var/etc/openvpn/client1.ca (no entries were read) (OpenSSL)
I've gone through the certificate authority setup a few times and there doesn't seem to be much to it. I did try to search through the forums for this error but didn't turn up anything that helped. Can someone tell me what I might be missing?
Thanks
-
Hi All
I used some of this tutorial and others to get OpenVPN via giganews VyprVPN working on a new SG-4860 and everytyhing is fine (apart from slow)
I just would like some help to confirm I have not opened up my network unnecessarily, so does this look all ok?
Not sure about why I had to create rules in the 2 VPN tabs. I have configured it so most traffic will go via WAN, but any devices in the "VPN Systems" alias will go via the VPN.
Thanks
-
The rules on the VPN tabs have nothing to do with what traffic goes out which interface. Those regulate what connections you allow into your router from the outside. i would delete both of those rules.
