• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Tutorial: Configuring pfSense as VPN client to Private Internet Access

Scheduled Pinned Locked Moved
OpenVPN
99
348
403.4k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    JimPhreak
    last edited by Apr 8, 2015, 6:46 PM

    @Derelict:

    Has anyone gotten this setup to work with Plex Media Server?  From what I've seen, most can't get Plex to publish to the internet once connected to PIA.

    Publish over PIA or over the internet bypassing PIA?

    For the former, PIA has to forward a port to you.  Do they support that?

    For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.

    If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.

    IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.

    PIA does support port forwarding but the port changes every time you get disconnected.

    What do you use in place of Plex or do you just not have a media server you can access remotely?

    1 Reply Last reply Reply Quote 0
    • Q
      q54e3w
      last edited by Apr 8, 2015, 6:46 PM

      I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
      I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

      1 Reply Last reply Reply Quote 0
      • J
        JimPhreak
        last edited by Apr 8, 2015, 6:49 PM

        @irj972:

        I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
        I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

        I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately.  I realize having it open to the public is not ideal.  However given that fact, I'm trying to make it as secure and hidden as I can.

        1 Reply Last reply Reply Quote 0
        • D
          Derelict LAYER 8 Netgate
          last edited by Apr 8, 2015, 7:21 PM

          As far as I know, you have to have the Plex port open to the world just to sign it into plex.  Doesn't have anything to do with who you allow access to it.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • Q
            q54e3w
            last edited by Apr 8, 2015, 8:02 PM

            @JimPhreak:

            @irj972:

            I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
            I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

            I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately.  I realize having it open to the public is not ideal.  However given that fact, I'm trying to make it as secure and hidden as I can.

            Yes, I can see how that would be an added inconvenience.

            1 Reply Last reply Reply Quote 0
            • P
              psxnight
              last edited by Apr 11, 2015, 10:56 PM

              When trying to start the VPN client connection configured for PIA, I receive the following error:

              Cannot load CA certificate file /var/etc/openvpn/client1.ca (no entries were read) (OpenSSL)

              I've gone through the certificate authority setup a few times and there doesn't seem to be much to it.  I did try to search through the forums for this error but didn't turn up anything that helped.  Can someone tell me what I might be missing?

              Thanks

              1 Reply Last reply Reply Quote 0
              • I
                iculookn
                last edited by Apr 14, 2015, 4:12 AM

                Hi All

                I used some of this tutorial and others to get OpenVPN via giganews VyprVPN working on a new SG-4860 and everytyhing is fine (apart from slow)

                I just would like some help to confirm I have not opened up my network unnecessarily, so does this look all ok?

                Not sure about why I had to create rules in the 2 VPN tabs. I have configured it so most traffic will go via WAN, but any devices in the "VPN Systems" alias will go via the VPN.

                Thanks

                LAN.png
                LAN.png_thumb
                NAT.png
                NAT.png_thumb
                VYPr.png
                VYPr.png_thumb
                OPN.png
                OPN.png_thumb

                1 Reply Last reply Reply Quote 0
                • D
                  Derelict LAYER 8 Netgate
                  last edited by Apr 14, 2015, 4:25 AM

                  The rules on the VPN tabs have nothing to do with what traffic goes out which interface.  Those regulate what connections you allow into your router from the outside.  i would delete both of those rules.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • P
                    pfanatic
                    last edited by Apr 18, 2015, 8:15 PM

                    I folowed this guide for connecting to PIA through OpenVPN and the connection seems to be working great.

                    However, I am having some questions/issues:

                    Questions
                    1. I am not able to complete the instructions as mentioned on step “Configure NAT Rules”. I am unable to create the NAT Rule for 127.0.0.0/8; it gives me an error

                    You must supply a valid port for the NAT port entry

                    Issues
                    2. I am unable to see any of my other computers/services when connected through vpn to my network. I have created an OpenVPN connection that allows my to content to my intranet from outside and it works great when I am I disable the PIA VPN but not when it is enabled

                    The number 1 above does not seem to be an issue unless it is realated to number 2.

                    Number 2 is the most important.

                    I appreciate any help with the above.

                    Thank you!

                    1 Reply Last reply Reply Quote 0
                    • D
                      Derelict LAYER 8 Netgate
                      last edited by Apr 19, 2015, 12:19 AM

                      You'll have to tell us what all the firewall rules are and what all the local networks, OpenVPN tunnel networks, etc, are.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfanatic
                        last edited by Apr 19, 2015, 4:22 AM

                        This is my settings for VPNing to my network:

                        I have a Firewall: Rules – WAN
                        ID =
                        Proto = Ipv4 TCP
                        Source = *
                        Port = *
                        Destination = WAN address
                        Port = 1194 OpenVPN
                        Gateway = *
                        Queue = none
                        Schedule = *

                        and a Firewall: Rules - OpenVPN
                        ID =
                        Proto = Ipv4 *
                        Source = *
                        Port = *
                        Destination = *
                        Port = *
                        Gateway = *
                        Queue = none
                        Schedule =

                        also the OpenVPN: Server is
                        Protocol / Port = UDP / 1194
                        Tunnel Network = 172.16.2.0/24

                        1 Reply Last reply Reply Quote 0
                        • D
                          Derelict LAYER 8 Netgate
                          last edited by Apr 19, 2015, 5:14 AM

                          That doesn't give anyone enough information to help you.  There is probably a routing problem between all the networks involved.  You only told us what the tunnel network is.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • P
                            pfanatic
                            last edited by Apr 19, 2015, 5:39 AM

                            could you be more specific as to what information i could provide?
                            I can provide some screenshots if that helps but i am not sure what you are looking for.

                            thanks,

                            1 Reply Last reply Reply Quote 0
                            • D
                              Derelict LAYER 8 Netgate
                              last edited by Apr 19, 2015, 5:43 AM

                              You'll have to tell us what all the firewall rules are and what all the local networks, OpenVPN tunnel networks, etc, are.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • S
                                s3rv3rn3rd
                                last edited by May 21, 2015, 9:16 PM

                                I've been working on an issue for a while now and I made significant progress through a person on reddit but I'm at another hurdle.

                                I have this setup with PIA and PFsense. I have it set to push 2 IPs through the VPN and everything else goes through my WAN. That all works great.

                                The issues I'm having is that I have 5 VLANs and the two IPs that are going through the VPN are not able to communicate with the rest of the devices on the network that are not within the same VLAN. I think this is some sort of firewall rule, but nothing I have tried or found here or on the Google has worked.

                                Each VLAN has a rule at top that allows all traffic from the 2 IPs through the VPN Gateway. Then there is a second rule that is allow all from anywhere through the default gateway. The LAN interface is also including these same rules (although without them it did not have an impact).

                                1 Reply Last reply Reply Quote 0
                                • D
                                  Derelict LAYER 8 Netgate
                                  last edited by May 21, 2015, 9:22 PM

                                  You need to pass traffic to your local networks above that rule.

                                  https://doc.pfsense.org/index.php/Bypassing_Policy_Routing

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    s3rv3rn3rd
                                    last edited by May 21, 2015, 9:28 PM

                                    When I put the rule permitting all traffic first, it no longer passes the traffic through the VPN as intended. It allows the VLANs to communicate, but it won't keep it on the VPN.

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      Derelict LAYER 8 Netgate
                                      last edited by May 21, 2015, 9:30 PM

                                      Read the link again.  That's not what it says to do.  You need to pass only to local destinations.  Or maybe make an alias and pass only to that.  Or maybe make an alias for all private addresses and pass only to those:

                                      10.0.0.0/8
                                      172.16.0.0/12
                                      192.168.0.0/16

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        s3rv3rn3rd
                                        last edited by May 21, 2015, 9:45 PM

                                        Got it.

                                        Set that up on each of the VLANs (I have not added it to the PIA INterface or the OpenVPN interface) and that seems to be working beautifully.

                                        Thank you!

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          Derelict LAYER 8 Netgate
                                          last edited by May 21, 2015, 9:48 PM

                                          Set that up on each of the VLANs

                                          I assume you mean set that up for each of the VLANs.  The rule(s) only need to be on the interface that the hosts being routed to the VPN are on.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            [[user:consent.lead]]
                                            [[user:consent.not_received]]