Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    OpenVPN
    99
    348
    386.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sudomrrogers
      last edited by

      Derelict,

      Thanks! I think this/that is a much better solution than setting it in DHCP Static Mappings. I was able to use the same alias that I use to push the traffic through the VPN in the first place. The only negative is this does limit  the VPN to using 1 DNS server whereas using DHCP Static Mappings would allow the use of up to 4.

      Just for conversations sake, because I am very happy with the current solution, is there a way to map the VPN traffic to a particular VLAN and set the VLAN to use a different DNS server?

      My pfSense setup is almost perfect!
      Thanks again.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        If you know the two DNS servers you can make two port forward rules matching on Destination address.  You could even set the clients to use something arbitrary like 10.11.12.1 and 10.11.12.2 and forward them each to different PIA DNS servers. You could keep the catch-all dest any rule below those to catch any other configured DNS servers and send those requests to one of the PIA DNS Servers.

        is there a way to map the VPN traffic to a particular VLAN and set the VLAN to use a different DNS server?

        Sorry, I don't understand what you're asking.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • X
          xRascal
          last edited by

          Wonder someone could help me got a error
          failed to write

          https://gyazo.com/ea1c1fa74b1b47e65e3a29afb9f27ada

          i know it just user and password put it there stop people getting my info thanks ! if someone could help me or add me on skype joshhopey to show me and help me !

          1 Reply Last reply Reply Quote 0
          • J
            johnodon
            last edited by

            @Derelict:

            Yes.  Just add the ports to the rule sending traffic to the VPN gateway.  The rule won't match if the port is outside the set so the firewall will move on to the next rule.

            I want to do the exact opposite and having trouble figuring it out…

            I want all traffic from one IP to go thru the VPN except port 32400 (Plex).  How can I adapt the current rules (or add another) that will send Plex traffic thru the WAN GW so the server can be reached remotely?

            John

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Make the rule match the characteristics.  But Plex is weird and requires inbound connections.

              Just read this again.

              Put a rule above the one that sends traffic to the VPN that matches the Plex traffic and has the default gateway set. Or, if you are pulling a default gateway from the VPN provider, the rule should policy route to WAN_GW.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • U
                User1503
                last edited by

                OpenVPN/PIA link goes down; clients have no internet access.  How do I fail over to the WAN if this happens?  Configuration is DLSrouter->Pfsense giving dhcp (opvenvpn w/PIA)->clients    Sometimes, believe it or not, PIA drops.  What do I do to have pfsense or openvpn fail to the general Wan connection if this happens?  Thanks!

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  That is the default behavior.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • P
                    psykix
                    last edited by

                    I set this all up today and had it working fine.

                    I'm using route-nopull because I actually only need 1 server to use the VPN.

                    I then got a message from pfSense to say that dyndns had updated, so must have had a dynamic IP change.

                    Then I realised that my true public IP was visible.

                    Restarted the VPN and still the same - although it appeared to be intermittent with some sites reporting my true IP and some reporting the VPN IP address.

                    I'm not sure what has happened so I've currently removed the route-nopull option and disabled the firewall rule which forces the server to use the PIA interface.

                    Any ideas?

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Yeah your rules must be wrong. How about letting us see them?

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • P
                        psykix
                        last edited by

                        It's disabled at the moment, but these are my firewall rules.

                        I would have preferred to keep it on everything but BBC iPlayer stopped working due to I presume the VPN address being blocked by them, and I couldn't figure a way to allow BBC iPlayer to bypass the VPN, since it seems to use multiple IP addresses I suspect.

                        rules.PNG
                        rules.PNG_thumb

                        1 Reply Last reply Reply Quote 0
                        • P
                          psykix
                          last edited by

                          Rule details :-

                          rule2.PNG
                          rule2.PNG_thumb

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Doesn't show what we need to see. Just post your LAN rules list.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • P
                              psykix
                              last edited by

                              I did above it…

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                With the rule disabled it's not going to work.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • P
                                  psykix
                                  last edited by

                                  Yes, I know. I disabled it because I removed the route-nopull since I needed the VPN to be working.

                                  I'll try again with route-nopull and enable the rule again.

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    psykix
                                    last edited by

                                    Ok, so I have the rule enabled. I have the route-nopull option.

                                    privateinternetaccess shows my VPN address and says I am protected.

                                    However, 2 other sites for showing IP addresses are showing my ISP public address, not the VPN one :-(

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      You sure your tunnel is staying up?

                                      There's really nothing that can cause what you think you're seeing.

                                      Unless there's something severely wrong with that beta version you're using.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        psykix
                                        last edited by

                                        I'm not sure. It seems to be staying up.

                                        I realised that I also have a free ipVanish account, so I'll give things a whirl with that and see how I get on :-)

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          Which IP test sites are showing the VPN address and which are showing WAN address?

                                          Is it consistent?

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            psykix
                                            last edited by

                                            The ipvanish site shows that I am protected, and it is the correct VPN ip address.

                                            The BBC iPlayer site refuses to work because it knows I am behind a VPN - which is expected behaviour.

                                            However, www.whatsmyip.org shows my proper public IP address, and my ISP details.

                                            Also, http://mxtoolbox.com/WhatIsMyIP/ shows my proper details, and not the VPN ip address.

                                            Very odd.

                                            I also deleted the config and reconfigured from scratch - same result.

                                            If I remove the firewall rule and the route-nopull from the config, then I get consistent results that I behind the VPN.

                                            Strange!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post