Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    Scheduled Pinned Locked Moved OpenVPN
    348 Posts 99 Posters 446.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfanatic
      last edited by

      could you be more specific as to what information i could provide?
      I can provide some screenshots if that helps but i am not sure what you are looking for.

      thanks,

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        You'll have to tell us what all the firewall rules are and what all the local networks, OpenVPN tunnel networks, etc, are.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • S
          s3rv3rn3rd
          last edited by

          I've been working on an issue for a while now and I made significant progress through a person on reddit but I'm at another hurdle.

          I have this setup with PIA and PFsense. I have it set to push 2 IPs through the VPN and everything else goes through my WAN. That all works great.

          The issues I'm having is that I have 5 VLANs and the two IPs that are going through the VPN are not able to communicate with the rest of the devices on the network that are not within the same VLAN. I think this is some sort of firewall rule, but nothing I have tried or found here or on the Google has worked.

          Each VLAN has a rule at top that allows all traffic from the 2 IPs through the VPN Gateway. Then there is a second rule that is allow all from anywhere through the default gateway. The LAN interface is also including these same rules (although without them it did not have an impact).

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            You need to pass traffic to your local networks above that rule.

            https://doc.pfsense.org/index.php/Bypassing_Policy_Routing

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • S
              s3rv3rn3rd
              last edited by

              When I put the rule permitting all traffic first, it no longer passes the traffic through the VPN as intended. It allows the VLANs to communicate, but it won't keep it on the VPN.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Read the link again.  That's not what it says to do.  You need to pass only to local destinations.  Or maybe make an alias and pass only to that.  Or maybe make an alias for all private addresses and pass only to those:

                10.0.0.0/8
                172.16.0.0/12
                192.168.0.0/16

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • S
                  s3rv3rn3rd
                  last edited by

                  Got it.

                  Set that up on each of the VLANs (I have not added it to the PIA INterface or the OpenVPN interface) and that seems to be working beautifully.

                  Thank you!

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Set that up on each of the VLANs

                    I assume you mean set that up for each of the VLANs.  The rule(s) only need to be on the interface that the hosts being routed to the VPN are on.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • S
                      s3rv3rn3rd
                      last edited by

                      Yes - I set it on each of the VLANs. currently I have 2 of the VLANs with VPN traffic and that might expand. It appears to be working great now.

                      Thanks!!

                      1 Reply Last reply Reply Quote 0
                      • T
                        Thisisvv
                        last edited by

                        Hello All,

                        I am newbiew here. Just got pfsense working on vmware on my i7 desktop. I am unable to connect to PIA. I have tried multiple times the above mentioned process but nothing happens. You can see from VPN start , seems to be every service is working.

                        Now when i go to Status: System logs: Gateways. There is absolutely nothing….

                        I have attached most of my screenshots, please let me know where i could use help

                        ![VPN Start.PNG](/public/imported_attachments/1/VPN Start.PNG)
                        ![VPN Start.PNG_thumb](/public/imported_attachments/1/VPN Start.PNG_thumb)
                        ![Services gateway.PNG](/public/imported_attachments/1/Services gateway.PNG)
                        ![Services gateway.PNG_thumb](/public/imported_attachments/1/Services gateway.PNG_thumb)
                        ![firewall NAT rule.PNG](/public/imported_attachments/1/firewall NAT rule.PNG)
                        ![firewall NAT rule.PNG_thumb](/public/imported_attachments/1/firewall NAT rule.PNG_thumb)
                        ![openvpn configuration.jpg](/public/imported_attachments/1/openvpn configuration.jpg)
                        ![openvpn configuration.jpg_thumb](/public/imported_attachments/1/openvpn configuration.jpg_thumb)
                        ![wan rule.PNG](/public/imported_attachments/1/wan rule.PNG)
                        ![wan rule.PNG_thumb](/public/imported_attachments/1/wan rule.PNG_thumb)

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          No idea really what's that "free roam" doing on your WAN ??? ??? ??? Regardless, that interface tells nothing regarding the topic here.

                          1 Reply Last reply Reply Quote 0
                          • T
                            Thisisvv
                            last edited by

                            So am i at wrong place?

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              For configuring policy routing for LAN clients? Yeah, WAN is surely wrong place for that.

                              1 Reply Last reply Reply Quote 0
                              • T
                                TDJ211
                                last edited by

                                @YoMan:

                                The tutorial states to turn off hardware encryption and to use BL-128.  Is there anyway to use AES-256 instead and use hardware encryption?

                                Bump….I would like to know this as well

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Not if PIA doesn't support it.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    cableguy
                                    last edited by

                                    first post so scuse the newbie here….

                                    what are the speeds you guys have been getting vs. ddwrt flashed routers? I recently upgraded to gigabit fiber, and was looking at building a machine this weekend since 40mbps through a Nighthawk leaves me a little disappointed.  I looked at the SH4860 as well, but I'd rather built something myself if I can hope for anything atleast 150-200mbps

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      Bobbob
                                      last edited by

                                      Hi all, newbie with a query here

                                      I've followed this guide to get a vpn setup and working fine for normal use, my issue is that port forwarding just wont work as advertised, I have literally gone through a dozen guides, they all say basically the same thing and I swear I've done it all, but nowt actually gets through…  My VPN provider has forwarded the relevant ports to me and says its all good on their end.

                                      Do I need NAT reflection to forward a port through the vpn to a LAN IP?  Are my NAT rules ok? Please help, screenshots are here http://imgur.com/a/iZOwd , I'm losing my mind here…

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        You didn't post your port forward config.  Firewall > NAT > Port Forward Tab.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          Bobbob
                                          last edited by

                                          Hiya, thanks for replying!  Its in the album now, at the bottom…

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by

                                            Destination address on your port forward should not be * it should be the interface address for the appropriate VPN interface.

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.