Tutorial: Configuring pfSense as VPN client to Private Internet Access

sudomrrogers · Feb 20, 2016, 3:35 PM

Derelict,

I suppose you could NAT translate all DNS requests to a specific IP address with a port forward on LAN with those IPs sourced (you can't use an alias in a NAT rule.

But DHCP static mappings is probably the proper way to get this done.

Could you please explain the NAT process. I understand DHCP would be better but my goal is to have the VPN IP range usable by anyone just by changing their IP client side. It would be nice if I did not have to provide a verbal IP and DNS address for the client to enter.

Thanks for all of your help!

Derelict · Feb 20, 2016, 4:41 PM

Something like this would force all DNS queries from VPN_HOST to PIA_DNS_SERVER instead of whatever is configured as a DNS server.

Note that VPN_HOST and PIA_DNS_SERVER are just placeholders for IP addresses since you can't use aliases in NAT definitions.

You'd have to get creative to use two DNS Servers. Perhaps with both in a pool in the NAT IP or two different definitions.

Firewall > NAT, Port Forward tab

Interface: LAN
Protocol: TCP/UDP
Source Address: VPN_HOST
Source Ports: *
Dest Address: *
Dest Ports: 53
NAT IP: PIA_DNS_SERVER
NAT Ports: 53

sudomrrogers · Feb 21, 2016, 9:34 PM

Derelict,

Thanks! I think this/that is a much better solution than setting it in DHCP Static Mappings. I was able to use the same alias that I use to push the traffic through the VPN in the first place. The only negative is this does limit the VPN to using 1 DNS server whereas using DHCP Static Mappings would allow the use of up to 4.

Just for conversations sake, because I am very happy with the current solution, is there a way to map the VPN traffic to a particular VLAN and set the VLAN to use a different DNS server?

My pfSense setup is almost perfect!
Thanks again.

Derelict · Feb 21, 2016, 9:42 PM

If you know the two DNS servers you can make two port forward rules matching on Destination address. You could even set the clients to use something arbitrary like 10.11.12.1 and 10.11.12.2 and forward them each to different PIA DNS servers. You could keep the catch-all dest any rule below those to catch any other configured DNS servers and send those requests to one of the PIA DNS Servers.

is there a way to map the VPN traffic to a particular VLAN and set the VLAN to use a different DNS server?

Sorry, I don't understand what you're asking.

xRascal · Feb 21, 2016, 11:39 PM

Wonder someone could help me got a error
failed to write

https://gyazo.com/ea1c1fa74b1b47e65e3a29afb9f27ada

i know it just user and password put it there stop people getting my info thanks ! if someone could help me or add me on skype joshhopey to show me and help me !

johnodon · Feb 22, 2016, 5:31 PM

@Derelict:

Yes. Just add the ports to the rule sending traffic to the VPN gateway. The rule won't match if the port is outside the set so the firewall will move on to the next rule.

I want to do the exact opposite and having trouble figuring it out…

I want all traffic from one IP to go thru the VPN except port 32400 (Plex). How can I adapt the current rules (or add another) that will send Plex traffic thru the WAN GW so the server can be reached remotely?

John

Derelict · Feb 22, 2016, 5:57 PM

~~Make the rule match the characteristics. But Plex is weird and requires inbound connections.~~

Just read this again.

Put a rule above the one that sends traffic to the VPN that matches the Plex traffic and has the default gateway set. Or, if you are pulling a default gateway from the VPN provider, the rule should policy route to WAN_GW.

User1503 · Feb 25, 2016, 5:41 PM

OpenVPN/PIA link goes down; clients have no internet access. How do I fail over to the WAN if this happens? Configuration is DLSrouter->Pfsense giving dhcp (opvenvpn w/PIA)->clients Sometimes, believe it or not, PIA drops. What do I do to have pfsense or openvpn fail to the general Wan connection if this happens? Thanks!

Derelict · Feb 25, 2016, 6:33 PM

That is the default behavior.

psykix · Mar 4, 2016, 5:38 PM

I set this all up today and had it working fine.

I'm using route-nopull because I actually only need 1 server to use the VPN.

I then got a message from pfSense to say that dyndns had updated, so must have had a dynamic IP change.

Then I realised that my true public IP was visible.

Restarted the VPN and still the same - although it appeared to be intermittent with some sites reporting my true IP and some reporting the VPN IP address.

I'm not sure what has happened so I've currently removed the route-nopull option and disabled the firewall rule which forces the server to use the PIA interface.

Any ideas?

Derelict · Mar 4, 2016, 5:46 PM

Yeah your rules must be wrong. How about letting us see them?

psykix · Mar 4, 2016, 7:03 PM

It's disabled at the moment, but these are my firewall rules.

I would have preferred to keep it on everything but BBC iPlayer stopped working due to I presume the VPN address being blocked by them, and I couldn't figure a way to allow BBC iPlayer to bypass the VPN, since it seems to use multiple IP addresses I suspect.

psykix · Mar 4, 2016, 7:05 PM

Rule details :-

Derelict · Mar 4, 2016, 7:13 PM

Doesn't show what we need to see. Just post your LAN rules list.

psykix · Mar 4, 2016, 7:14 PM

I did above it…

Derelict · Mar 4, 2016, 7:14 PM

With the rule disabled it's not going to work.

psykix · Mar 4, 2016, 7:16 PM

Yes, I know. I disabled it because I removed the route-nopull since I needed the VPN to be working.

I'll try again with route-nopull and enable the rule again.

psykix · Mar 4, 2016, 7:20 PM

Ok, so I have the rule enabled. I have the route-nopull option.

privateinternetaccess shows my VPN address and says I am protected.

However, 2 other sites for showing IP addresses are showing my ISP public address, not the VPN one :-(

Derelict · Mar 4, 2016, 7:33 PM

You sure your tunnel is staying up?

There's really nothing that can cause what you think you're seeing.

Unless there's something severely wrong with that beta version you're using.

psykix · Mar 4, 2016, 7:34 PM

I'm not sure. It seems to be staying up.

I realised that I also have a free ipVanish account, so I'll give things a whirl with that and see how I get on :-)

Derelict · Mar 4, 2016, 8:51 PM

Which IP test sites are showing the VPN address and which are showing WAN address?

Is it consistent?

psykix · Mar 4, 2016, 8:58 PM

The ipvanish site shows that I am protected, and it is the correct VPN ip address.

The BBC iPlayer site refuses to work because it knows I am behind a VPN - which is expected behaviour.

However, www.whatsmyip.org shows my proper public IP address, and my ISP details.

Also, http://mxtoolbox.com/WhatIsMyIP/ shows my proper details, and not the VPN ip address.

Very odd.

I also deleted the config and reconfigured from scratch - same result.

If I remove the firewall rule and the route-nopull from the config, then I get consistent results that I behind the VPN.

Strange!

Derelict · Mar 4, 2016, 9:23 PM

Don't know what to tell you.

I just ran updates to my betas and tried it and it works just fine.

You'll have to look at states or something to see what's going on. SOMETHING you have is routing traffic out the default gateway. Have you created any floating rules?

Are you positive about the source IP address?

psykix · Mar 4, 2016, 9:27 PM

Unless of course it is going out using IPV6, but it shouldn't be - I have IPV4 as preferred.

I don't know if it makes any difference that the 192.168.1.15 server that I want protected with the VPN a) it's a VM and b) it has teamed NICs

Derelict · Mar 4, 2016, 9:33 PM

If it was going out IPv6 I think both of those sites would be showing you an IPv6 address.

Derelict · Mar 4, 2016, 9:42 PM

I've never messed around with windows NIC teaming. If it utilizes multiple IP addresses there's your problem. Put them all in an alias and use that as your source address list. A packet capture on LAN will show you what's happening.

psykix · Mar 4, 2016, 9:55 PM

They are just teamed into one IP address.

It's very odd..

I've just gone back to having everything protected as that works fine.

Any idea how I can add a rule to get BBC iPlayer to bypass the VPN?

psykix · Mar 4, 2016, 9:59 PM

It does also make me wonder if I have missed something, although I have redone the tutorial from scratch 3 times now.

Just to test, I created a rule for my client PC which is just normal PC single NIC and I get exactly the same results.

PIA website says I am protected and shows the VPN IP address. The others still display my ISP and unprotected public IP :-(

I am just baffled…

psykix · Mar 4, 2016, 10:18 PM

I just had a thought.. wouldn't be anything to do with Squid or Squidguard would it?

Aha..

Disabled Squid and it now all works as expected..

So do I have to change Squid to work on the VPN interface instead of LAN maybe?

Derelict · Mar 4, 2016, 10:54 PM

Of course it's ^$%& squid.

psykix · Mar 5, 2016, 1:05 AM

Since enabling the VPN on my server which runs Plex, I cannot access the Plex server from my LAN via the Plex website.

To get it working previously I had to enable Pure NAT but I don't really understand the reasoning behind this.

Not sure what I need to change to be able to access the server again (I'm basically going out of the firewall, and then back in via my port forward rule to get to it)

Access from the internet to my Plex server is working fine.

psykix · Mar 5, 2016, 10:30 AM

Seems Plex suddenly started to work again today. Think may be issues with Plex, so ignore.

Thanks for all the help!

psykix · Mar 5, 2016, 1:29 PM

@johnodon:

@Derelict:

Yes. Just add the ports to the rule sending traffic to the VPN gateway. The rule won't match if the port is outside the set so the firewall will move on to the next rule.

I want to do the exact opposite and having trouble figuring it out…

I want all traffic from one IP to go thru the VPN except port 32400 (Plex). How can I adapt the current rules (or add another) that will send Plex traffic thru the WAN GW so the server can be reached remotely?

John

Did you figure this out? My Plex server stopped working and when I check it has my VPN address as the public IP.

I've tried creating a LAN FW rule above the VPN one to tell it that all TCP 32400 traffic should go via WAN_PPOE and not PIAVPN but it doesn't make any difference.

psykix · Mar 5, 2016, 2:20 PM

Never mind - it started working again. I'm wondering if because the VPN changes IP address so often, maybe Plex is taking too long to update it?

Oh I dunno.. clutching at straws - it all works great for a while and then will stop working, and then will work again. Hate those types of issues!

Derelict · Mar 5, 2016, 6:13 PM

I think the TCP 32400 traffic is INBOUND from Plex. I refuse to use it since they don't post any source addresses so you have to allow the world in.

I believe Plex requires a port forward in on the IP address it is logging in from. So if you are trying to go OUT PIA, I think they need to forward a port to you.

I don't know. Go to a Plex forum and ask exactly what you need in a FIREWALL INDEPENDENT way (just IP/TCP/UDP/NAT/etc) and bring that info back here and it will be easier to help you with that. And you should start another thread for it.

Scorch95 · Mar 27, 2016, 2:35 AM

I attempted to set openvpn up with PIA however I am unsuccessful at getting it to connect. Under status it says reconnecting; tls-error. When I check system logs it has this:

Mar 26 17:37:48 openvpn[8951]: Re-using SSL/TLS context
Mar 26 17:37:48 openvpn[8951]: LZO compression initialized
Mar 26 17:37:48 openvpn[8951]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
Mar 26 17:37:48 openvpn[8951]: Socket Buffers: R=[42080->65536] S=[57344->65536]
Mar 26 17:37:48 openvpn[8951]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Mar 26 17:37:48 openvpn[8951]: Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mar 26 17:37:48 openvpn[8951]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mar 26 17:37:48 openvpn[8951]: Local Options hash (VER=V4): '41690919'
Mar 26 17:37:48 openvpn[8951]: Expected Remote Options hash (VER=V4): '530fdded'
Mar 26 17:37:48 openvpn[8951]: UDPv4 link local (bound): [AF_INET]192.168.2.122
Mar 26 17:37:48 openvpn[8951]: UDPv4 link remote: [AF_INET]198.8.80.221:1194
Mar 26 17:37:48 openvpn[8951]: TLS: Initial packet from [AF_INET]198.8.80.221:1194, sid=246e6338 47b9e842
Mar 26 17:37:48 openvpn[8951]: VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=US, ST=OH, L=Columbus, O=Private Internet Access, CN=Private Internet Access CA, emailAddress=secure@privateinternetaccess.com
Mar 26 17:37:48 openvpn[8951]: TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Mar 26 17:37:48 openvpn[8951]: TLS Error: TLS object -> incoming plaintext read error
Mar 26 17:37:48 openvpn[8951]: TLS Error: TLS handshake failed
Mar 26 17:37:48 openvpn[8951]: TCP/UDP: Closing socket
Mar 26 17:37:48 openvpn[8951]: SIGUSR1[soft,tls-error] received, process restarting
Mar 26 17:37:48 openvpn[8951]: Restart pause, 2 second(s)

Edit: well I realized the directions here are different than what is offered on PIAs website. I tried these and it seems to be working. Not sure why this does and theirs don't. Any ideas?

Derelict · Mar 27, 2016, 8:56 AM

It looks like whatever you did there didn't get the correct certificate imported and trusted for that OpenVPN client connection.

robertfranz · Apr 25, 2016, 11:33 AM

As much as I appreciate the effort and thoroughness, the advice to simply duplicate all existing outbound nat rules is both overkill, and potentially will degrade a network.

There are often autogenerated rules that are not required.

The isakmp rule specifically cited, for example, is entirely useless on a non ipsec connection.

Nor does the loopback need to be natted in most cases.

And if one blindly duplicates existing nat rules for other vpn connections, you end up double natting those - repeating on the other end gives you quad natting….and things start to not work so much.

I went on a pruning spree the other day and eliminated most of the nat rules.

All you need is one nat rule per subnet/address you are going to route through the vpn.

q54e3w · Apr 26, 2016, 12:40 PM

@robertfranz:

Nor does the loopback need to be natted in most cases.

Could you share some thoughts or examples of when the loopback interface would need natting please?

techy82 · Jun 28, 2016, 8:08 PM

I have a I5 6400 cpu should i leave encryption to BF-CBC (128-bit) or could it be increased i have tried aes-256-cbc but i get alot of dropouts

also would i set cryptographic hardware thanks!