Tutorial: Configuring pfSense as VPN client to Private Internet Access

[q54e3w]

I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

[JimPhreak]

@irj972:

I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately.  I realize having it open to the public is not ideal.  However given that fact, I'm trying to make it as secure and hidden as I can.

[Derelict]

As far as I know, you have to have the Plex port open to the world just to sign it into plex.  Doesn't have anything to do with who you allow access to it.

[q54e3w]

@JimPhreak:

@irj972:

I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately.  I realize having it open to the public is not ideal.  However given that fact, I'm trying to make it as secure and hidden as I can.

Yes, I can see how that would be an added inconvenience.

[psxnight]

When trying to start the VPN client connection configured for PIA, I receive the following error:

Cannot load CA certificate file /var/etc/openvpn/client1.ca (no entries were read) (OpenSSL)

I've gone through the certificate authority setup a few times and there doesn't seem to be much to it.  I did try to search through the forums for this error but didn't turn up anything that helped.  Can someone tell me what I might be missing?

Thanks

[iculookn]

Hi All

I used some of this tutorial and others to get OpenVPN via giganews VyprVPN working on a new SG-4860 and everytyhing is fine (apart from slow)

I just would like some help to confirm I have not opened up my network unnecessarily, so does this look all ok?

Not sure about why I had to create rules in the 2 VPN tabs. I have configured it so most traffic will go via WAN, but any devices in the "VPN Systems" alias will go via the VPN.

Thanks

[Derelict]

The rules on the VPN tabs have nothing to do with what traffic goes out which interface.  Those regulate what connections you allow into your router from the outside.  i would delete both of those rules.

[pfanatic]

I folowed this guide for connecting to PIA through OpenVPN and the connection seems to be working great.

However, I am having some questions/issues:

Questions
1. I am not able to complete the instructions as mentioned on step “Configure NAT Rules”. I am unable to create the NAT Rule for 127.0.0.0/8; it gives me an error

You must supply a valid port for the NAT port entry

Issues
2. I am unable to see any of my other computers/services when connected through vpn to my network. I have created an OpenVPN connection that allows my to content to my intranet from outside and it works great when I am I disable the PIA VPN but not when it is enabled

The number 1 above does not seem to be an issue unless it is realated to number 2.

Number 2 is the most important.

I appreciate any help with the above.

Thank you!

[Derelict]

You'll have to tell us what all the firewall rules are and what all the local networks, OpenVPN tunnel networks, etc, are.

[pfanatic]

This is my settings for VPNing to my network:

I have a Firewall: Rules – WAN
ID =
Proto = Ipv4 TCP
Source = *
Port = *
Destination = WAN address
Port = 1194 OpenVPN
Gateway = *
Queue = none
Schedule = *

and a Firewall: Rules - OpenVPN
ID =
Proto = Ipv4 *
Source = *
Port = *
Destination = *
Port = *
Gateway = *
Queue = none
Schedule =

also the OpenVPN: Server is
Protocol / Port = UDP / 1194
Tunnel Network = 172.16.2.0/24

[Derelict]

That doesn't give anyone enough information to help you.  There is probably a routing problem between all the networks involved.  You only told us what the tunnel network is.

[pfanatic]

could you be more specific as to what information i could provide?
I can provide some screenshots if that helps but i am not sure what you are looking for.

thanks,

[Derelict]

You'll have to tell us what all the firewall rules are and what all the local networks, OpenVPN tunnel networks, etc, are.

[s3rv3rn3rd]

I've been working on an issue for a while now and I made significant progress through a person on reddit but I'm at another hurdle.

I have this setup with PIA and PFsense. I have it set to push 2 IPs through the VPN and everything else goes through my WAN. That all works great.

The issues I'm having is that I have 5 VLANs and the two IPs that are going through the VPN are not able to communicate with the rest of the devices on the network that are not within the same VLAN. I think this is some sort of firewall rule, but nothing I have tried or found here or on the Google has worked.

Each VLAN has a rule at top that allows all traffic from the 2 IPs through the VPN Gateway. Then there is a second rule that is allow all from anywhere through the default gateway. The LAN interface is also including these same rules (although without them it did not have an impact).

[Derelict]

You need to pass traffic to your local networks above that rule.

https://doc.pfsense.org/index.php/Bypassing_Policy_Routing

[s3rv3rn3rd]

When I put the rule permitting all traffic first, it no longer passes the traffic through the VPN as intended. It allows the VLANs to communicate, but it won't keep it on the VPN.

[Derelict]

Read the link again.  That's not what it says to do.  You need to pass only to local destinations.  Or maybe make an alias and pass only to that.  Or maybe make an alias for all private addresses and pass only to those:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

[s3rv3rn3rd]

Got it.

Set that up on each of the VLANs (I have not added it to the PIA INterface or the OpenVPN interface) and that seems to be working beautifully.

Thank you!

[Derelict]

Set that up on each of the VLANs

I assume you mean set that up for each of the VLANs.  The rule(s) only need to be on the interface that the hosts being routed to the VPN are on.

[s3rv3rn3rd]

Yes - I set it on each of the VLANs. currently I have 2 of the VLANs with VPN traffic and that might expand. It appears to be working great now.

Thanks!!

[Thisisvv]

Hello All,

I am newbiew here. Just got pfsense working on vmware on my i7 desktop. I am unable to connect to PIA. I have tried multiple times the above mentioned process but nothing happens. You can see from VPN start , seems to be every service is working.

Now when i go to Status: System logs: Gateways. There is absolutely nothing….

I have attached most of my screenshots, please let me know where i could use help


[doktornotor]

No idea really what's that "free roam" doing on your WAN ??? ??? ??? Regardless, that interface tells nothing regarding the topic here.

[Thisisvv]

So am i at wrong place?

[doktornotor]

For configuring policy routing for LAN clients? Yeah, WAN is surely wrong place for that.

[TDJ211]

@YoMan:

The tutorial states to turn off hardware encryption and to use BL-128.  Is there anyway to use AES-256 instead and use hardware encryption?

Bump….I would like to know this as well

[Derelict]

Not if PIA doesn't support it.

[cableguy]

first post so scuse the newbie here….

what are the speeds you guys have been getting vs. ddwrt flashed routers? I recently upgraded to gigabit fiber, and was looking at building a machine this weekend since 40mbps through a Nighthawk leaves me a little disappointed.  I looked at the SH4860 as well, but I'd rather built something myself if I can hope for anything atleast 150-200mbps

[Bobbob]

Hi all, newbie with a query here

I've followed this guide to get a vpn setup and working fine for normal use, my issue is that port forwarding just wont work as advertised, I have literally gone through a dozen guides, they all say basically the same thing and I swear I've done it all, but nowt actually gets through…  My VPN provider has forwarded the relevant ports to me and says its all good on their end.

Do I need NAT reflection to forward a port through the vpn to a LAN IP?  Are my NAT rules ok? Please help, screenshots are here http://imgur.com/a/iZOwd , I'm losing my mind here…

[Derelict]

You didn't post your port forward config.  Firewall > NAT > Port Forward Tab.

[Bobbob]

Hiya, thanks for replying!  Its in the album now, at the bottom…

[Derelict]

Destination address on your port forward should not be * it should be the interface address for the appropriate VPN interface.

[Bobbob]

Thanks.  Erm, this might be a stupid question but which address is that? All traffic for that pc goes from the LAN through my Iceland VPN interface so is it the virtual address of that VPN interface or my LAN interface?  And since my VPN interfaces are using "IPv4 Configuration Type: None", wont the virtual address change over time? i dont think I can make them static…

I don't know if this will help, probs not ;) but this is a rough idea of my setup

r  WAN <<<  Iceland-VPN Gateway <<<< 192.168.1.248
Modem<<< WAN <<<  UK-VPN Gateway        <<<< All other LAN IPs
                L  WAN xxx                                      xxxx  All LAN traffic

[Derelict]

In the Destination address type you select the OpenVPN interface.  If you haven't assigned an interface you need to look up OpenVPN assigned interfaces.  Port forwards won't work without one.

[Bobbob]

I assigned an interface to each of the OpenVPN clients in the screenshot above, the TORGUARDICELAND interface is the one the pc @ 192.168.1.248 is using, that OpenVPN client has the virtual address 10.8.0.6, is this what you mean or does its interface have a different address?  Do i need to setup a new interface somewhere?  Sorry to be a pain but I've googled around this and can't find anything about a separate OpenVPN interface….  Thanks for your help with this, you're a lifesaver

[Derelict]

In your port forward entry, the Destination needs to be your OpenVPN interface address, not '*'  I don't know how to make it more clear.

[Bobbob]

Ok, I have set the destination to the VPN interface address, see screenshot, but the port is still not open, is there still something I'm missing?  Thanks again


[Derelict]

You need to get proof that the port is properly forwarded to you.  Turn logging on on the pass rule, check the logs.  Attempt a connection, check for states.  Do a packet capture on WAN.  Do you see the inbound packets?  Do a packet capture on LAN. Do you see the outbound packets?  What is returned from 192.168.1.248?

You also need to test from outside.

Do all this.  Don't skip anything:

https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

[Bobbob]

Nice one, I'm on it…

[Bobbob]

Ok, we have some results,

Firewall checks, with logging on the forwarding rule and utorrent running on 62465, I'm also repeatedly trying to connect externally using a 4g connection (timedout everytime i tried a connection):

I can find loads of outgoing LAN entries on 62465, see first screenshot, nothing at all on TORGUARDICELAND or WAN for 62465.
I cant see any logged entries with a destination port 62465 on any interface, I also cant see anything with a destination 192.168.1.248.  As far as i can tell nothing is triggering the forwarding rule.  See screenshot 2

States:

There are plenty of entries in the states table for port 62465, see screenshot 3.  I can't find my external connection in the table but since it keeps timing out that doesn't surprise me…

Packet capture:

On WAN i get only a tiny handful of packets coming in to 62465 from outside to my WAN IP, i.e. the IP assigned to my modem. I assume this is just random non-requested traffic.  See screenshot 4.  There is plenty of 443 activity between my VPN IP and my WAN IP, i assume this is the vpn tunnel.

I can see plenty of LAN activity on 62465, both inbound and outbound, see screenshot 5.  The incoming packets and the returns have different lengths, incoming are short, are these errors of some kind?

On TORGUARDICELAND I can see some packets coming from 10.8.0.6 (the VPN interface virtual address) to my VPN IP and the other way, this seems hopeful!  See Sh 6.

I went through the common problems on the list, I think I can tick off all of them, the fact that the forwarding works when using my regular connection instead of the vpn connection dealt with most of them.

Phew, never even seen a states table before this, this is a proper learning experience ;)  Hope I've done the correct testing, interpreting these results is killing me though, anything obvious catch your eye?  Thanks


[Derelict]

If they are supposed to be forwarding a port to you and you have logging on the pass rule for the NAT entry on TORGUARDICELAND and you never see any log entries when you try to connect to it from the outside, their forward isn't working and there is no reason to look at anything else.