Tutorial: Configuring pfSense as VPN client to Private Internet Access

coolspot

Because people usually do NOT want all their Internet-bound traffic go through some slow VPN tunnel.

Great thanks, so I got my tunnel up and running… however, my performance is only ~40mbps.

I'm running an Atom D525 CPU, what should be the expected performance?

When I run TOP, my WCPU for OpenVPN hovers around 50% ... however, the other cores/threads are pretty idle.

Here is my TOP output:

last pid: 15026; load averages: 1.02, 0.61, 0.43 up 19+02:05:29 14:33:57
210 processes: 7 running, 177 sleeping, 26 waiting
CPU: % user, % nice, % system, % interrupt, % idle
Mem: 28M Active, 179M Inact, 542M Wired, 465M Buf, 7172M Free
Swap: 16G Total, 16G Free

PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND
11 root 155 ki31 0K 64K CPU2 2 440.2H 79.05% idle{idle: cpu2}
11 root 155 ki31 0K 64K CPU0 0 432.5H 78.66% idle{idle: cpu0}
11 root 155 ki31 0K 64K RUN 3 446.5H 76.56% idle{idle: cpu3}
11 root 155 ki31 0K 64K RUN 1 443.6H 68.16% idle{idle: cpu1}
28854 root 52 0 21728K 5752K select 0 1:06 58.40% openvpn

JimPhreak

Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.

Derelict

Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.

Publish over PIA or over the internet bypassing PIA?

For the former, PIA has to forward a port to you. Do they support that?

For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.

If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.

IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.

JimPhreak

@Derelict:

Has anyone gotten this setup to work with Plex Media Server? From what I've seen, most can't get Plex to publish to the internet once connected to PIA.

Publish over PIA or over the internet bypassing PIA?

For the former, PIA has to forward a port to you. Do they support that?

For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.

If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.

IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.

PIA does support port forwarding but the port changes every time you get disconnected.

What do you use in place of Plex or do you just not have a media server you can access remotely?

q54e3w

I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

JimPhreak

@irj972:

I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately. I realize having it open to the public is not ideal. However given that fact, I'm trying to make it as secure and hidden as I can.

Derelict

As far as I know, you have to have the Plex port open to the world just to sign it into plex. Doesn't have anything to do with who you allow access to it.

q54e3w

@JimPhreak:

@irj972:

I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately. I realize having it open to the public is not ideal. However given that fact, I'm trying to make it as secure and hidden as I can.

Yes, I can see how that would be an added inconvenience.

psxnight

When trying to start the VPN client connection configured for PIA, I receive the following error:

Cannot load CA certificate file /var/etc/openvpn/client1.ca (no entries were read) (OpenSSL)

I've gone through the certificate authority setup a few times and there doesn't seem to be much to it. I did try to search through the forums for this error but didn't turn up anything that helped. Can someone tell me what I might be missing?

Thanks

iculookn

Hi All

I used some of this tutorial and others to get OpenVPN via giganews VyprVPN working on a new SG-4860 and everytyhing is fine (apart from slow)

I just would like some help to confirm I have not opened up my network unnecessarily, so does this look all ok?

Not sure about why I had to create rules in the 2 VPN tabs. I have configured it so most traffic will go via WAN, but any devices in the "VPN Systems" alias will go via the VPN.

Thanks

LAN.png_thumb

NAT.png_thumb

VYPr.png_thumb

OPN.png_thumb

Derelict

The rules on the VPN tabs have nothing to do with what traffic goes out which interface. Those regulate what connections you allow into your router from the outside. i would delete both of those rules.

pfanatic

I folowed this guide for connecting to PIA through OpenVPN and the connection seems to be working great.

However, I am having some questions/issues:

Questions
1. I am not able to complete the instructions as mentioned on step “Configure NAT Rules”. I am unable to create the NAT Rule for 127.0.0.0/8; it gives me an error

You must supply a valid port for the NAT port entry

Issues
2. I am unable to see any of my other computers/services when connected through vpn to my network. I have created an OpenVPN connection that allows my to content to my intranet from outside and it works great when I am I disable the PIA VPN but not when it is enabled

The number 1 above does not seem to be an issue unless it is realated to number 2.

Number 2 is the most important.

I appreciate any help with the above.

Thank you!

Derelict

You'll have to tell us what all the firewall rules are and what all the local networks, OpenVPN tunnel networks, etc, are.

pfanatic

This is my settings for VPNing to my network:

I have a Firewall: Rules – WAN
ID =
Proto = Ipv4 TCP
Source = *
Port = *
Destination = WAN address
Port = 1194 OpenVPN
Gateway = *
Queue = none
Schedule = *

and a Firewall: Rules - OpenVPN
ID =
Proto = Ipv4 *
Source = *
Port = *
Destination = *
Port = *
Gateway = *
Queue = none
Schedule =

also the OpenVPN: Server is
Protocol / Port = UDP / 1194
Tunnel Network = 172.16.2.0/24

Derelict

That doesn't give anyone enough information to help you. There is probably a routing problem between all the networks involved. You only told us what the tunnel network is.

pfanatic

could you be more specific as to what information i could provide?
I can provide some screenshots if that helps but i am not sure what you are looking for.

thanks,

Derelict

You'll have to tell us what all the firewall rules are and what all the local networks, OpenVPN tunnel networks, etc, are.

s3rv3rn3rd

I've been working on an issue for a while now and I made significant progress through a person on reddit but I'm at another hurdle.

I have this setup with PIA and PFsense. I have it set to push 2 IPs through the VPN and everything else goes through my WAN. That all works great.

The issues I'm having is that I have 5 VLANs and the two IPs that are going through the VPN are not able to communicate with the rest of the devices on the network that are not within the same VLAN. I think this is some sort of firewall rule, but nothing I have tried or found here or on the Google has worked.

Each VLAN has a rule at top that allows all traffic from the 2 IPs through the VPN Gateway. Then there is a second rule that is allow all from anywhere through the default gateway. The LAN interface is also including these same rules (although without them it did not have an impact).

Derelict

You need to pass traffic to your local networks above that rule.

https://doc.pfsense.org/index.php/Bypassing_Policy_Routing

s3rv3rn3rd

When I put the rule permitting all traffic first, it no longer passes the traffic through the VPN as intended. It allows the VLANs to communicate, but it won't keep it on the VPN.