Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial: Configuring pfSense as VPN client to Private Internet Access

    OpenVPN
    99
    348
    384.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Don't know what to tell you.

      I just ran updates to my betas and tried it and it works just fine.

      You'll have to look at states or something to see what's going on.  SOMETHING you have is routing traffic out the default gateway. Have you created any floating rules?

      Are you positive about the source IP address?

      LAN-rules.png
      LAN-rules.png_thumb

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • P
        psykix
        last edited by

        Unless of course it is going out using IPV6, but it shouldn't be - I have IPV4 as preferred.

        I don't know if it makes any difference that the 192.168.1.15 server that I want protected with the VPN a) it's a VM and b) it has teamed NICs

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          If it was going out IPv6 I think both of those sites would be showing you an IPv6 address.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            I've never messed around with windows NIC teaming. If it utilizes multiple IP addresses there's your problem. Put them all in an alias and use that as your source address list. A packet capture on LAN will show you what's happening.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • P
              psykix
              last edited by

              They are just teamed into one IP address.

              It's very odd..

              I've just gone back to having everything protected as that works fine.

              Any idea how I can add a rule to get BBC iPlayer to bypass the VPN?

              1 Reply Last reply Reply Quote 0
              • P
                psykix
                last edited by

                It does also make me wonder if I have missed something, although I have redone the tutorial from scratch 3 times now.

                Just to test, I created a rule for my client PC which is just normal PC single NIC and I get exactly the same results.

                PIA website says I am protected and shows the VPN IP address. The others still display my ISP and unprotected public IP :-(

                I am just baffled…

                1 Reply Last reply Reply Quote 0
                • P
                  psykix
                  last edited by

                  I just had a thought.. wouldn't be anything to do with Squid or Squidguard would it?

                  Aha..

                  Disabled Squid and it now all works as expected..

                  So do I have to change Squid to work on the VPN interface instead of LAN maybe?

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Of course it's ^$%&  squid.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • P
                      psykix
                      last edited by

                      Since enabling the VPN on my server which runs Plex, I cannot access the Plex server from my LAN via the Plex website.

                      To get it working previously I had to enable Pure NAT but I don't really understand the reasoning behind this.

                      Not sure what I need to change to be able to access the server again (I'm basically going out of the firewall, and then back in via my port forward rule to get to it)

                      Access from the internet to my Plex server is working fine.

                      1 Reply Last reply Reply Quote 0
                      • P
                        psykix
                        last edited by

                        Seems Plex suddenly started to work again today. Think may be issues with Plex, so ignore.

                        Thanks for all the help!

                        1 Reply Last reply Reply Quote 0
                        • P
                          psykix
                          last edited by

                          @johnodon:

                          @Derelict:

                          Yes.  Just add the ports to the rule sending traffic to the VPN gateway.  The rule won't match if the port is outside the set so the firewall will move on to the next rule.

                          I want to do the exact opposite and having trouble figuring it out…

                          I want all traffic from one IP to go thru the VPN except port 32400 (Plex).  How can I adapt the current rules (or add another) that will send Plex traffic thru the WAN GW so the server can be reached remotely?

                          John

                          Did you figure this out? My Plex server stopped working and when I check it has my VPN address as the public IP.

                          I've tried creating a LAN FW rule above the VPN one to tell it that all TCP 32400 traffic should go via WAN_PPOE and not PIAVPN but it doesn't make any difference.

                          1 Reply Last reply Reply Quote 0
                          • P
                            psykix
                            last edited by

                            Never mind - it started working again. I'm wondering if because the VPN changes IP address so often, maybe Plex is taking too long to update it?

                            Oh I dunno.. clutching at straws - it all works great for a while and then will stop working, and then will work again. Hate those types of issues!

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              I think the TCP 32400 traffic is INBOUND from Plex. I refuse to use it since they don't post any source addresses so you have to allow the world in.

                              I believe Plex requires a port forward in on the IP address it is logging in from. So if you are trying to go OUT PIA, I think they need to forward a port to you.

                              I don't know. Go to a Plex forum and ask exactly what you need in a FIREWALL INDEPENDENT way (just IP/TCP/UDP/NAT/etc) and bring that info back here and it will be easier to help you with that. And you should start another thread for it.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • S
                                Scorch95
                                last edited by

                                I attempted to set openvpn up with PIA however I am unsuccessful at getting it to connect. Under status it says reconnecting; tls-error. When I check system logs it has this:

                                Mar 26 17:37:48 openvpn[8951]: Re-using SSL/TLS context
                                Mar 26 17:37:48 openvpn[8951]: LZO compression initialized
                                Mar 26 17:37:48 openvpn[8951]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
                                Mar 26 17:37:48 openvpn[8951]: Socket Buffers: R=[42080->65536] S=[57344->65536]
                                Mar 26 17:37:48 openvpn[8951]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
                                Mar 26 17:37:48 openvpn[8951]: Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
                                Mar 26 17:37:48 openvpn[8951]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
                                Mar 26 17:37:48 openvpn[8951]: Local Options hash (VER=V4): '41690919'
                                Mar 26 17:37:48 openvpn[8951]: Expected Remote Options hash (VER=V4): '530fdded'
                                Mar 26 17:37:48 openvpn[8951]: UDPv4 link local (bound): [AF_INET]192.168.2.122
                                Mar 26 17:37:48 openvpn[8951]: UDPv4 link remote: [AF_INET]198.8.80.221:1194
                                Mar 26 17:37:48 openvpn[8951]: TLS: Initial packet from [AF_INET]198.8.80.221:1194, sid=246e6338 47b9e842
                                Mar 26 17:37:48 openvpn[8951]: VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=US, ST=OH, L=Columbus, O=Private Internet Access, CN=Private Internet Access CA, emailAddress=secure@privateinternetaccess.com
                                Mar 26 17:37:48 openvpn[8951]: TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
                                Mar 26 17:37:48 openvpn[8951]: TLS Error: TLS object -> incoming plaintext read error
                                Mar 26 17:37:48 openvpn[8951]: TLS Error: TLS handshake failed
                                Mar 26 17:37:48 openvpn[8951]: TCP/UDP: Closing socket
                                Mar 26 17:37:48 openvpn[8951]: SIGUSR1[soft,tls-error] received, process restarting
                                Mar 26 17:37:48 openvpn[8951]: Restart pause, 2 second(s)

                                Edit: well I realized the directions here are different than what is offered on PIAs website. I tried these and it seems to be working. Not sure why this does and theirs don't. Any ideas?

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  It looks like whatever you did there didn't get the correct certificate imported and trusted for that OpenVPN client connection.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    robertfranz
                                    last edited by

                                    As much as I appreciate the effort and thoroughness, the advice to simply duplicate all existing outbound nat rules is both overkill, and potentially will degrade a network.

                                    There are often autogenerated rules that are not required.

                                    The isakmp rule specifically cited, for example, is entirely useless on a non ipsec connection.

                                    Nor does the loopback need to be natted in most cases.

                                    And if one blindly duplicates existing nat rules for other vpn connections, you end up double natting those - repeating on the other end gives you quad natting….and things start to not work so much.

                                    I went on a pruning spree the other day and eliminated most of the nat rules.

                                    All you need is one nat rule per subnet/address you are going to route through the vpn.

                                    1 Reply Last reply Reply Quote 0
                                    • Q
                                      q54e3w
                                      last edited by

                                      @robertfranz:

                                      Nor does the loopback need to be natted in most cases.

                                      Could you share some thoughts or examples of when the loopback interface would need natting please?

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        techy82
                                        last edited by

                                        I have a I5 6400 cpu should i leave encryption to BF-CBC (128-bit) or could it be increased i have tried aes-256-cbc but i get alot of dropouts

                                        also would i set cryptographic hardware thanks!

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          reubenb87
                                          last edited by

                                          Thanks for the awesome guide. I'm having some trouble getting a static IP to get routed through the VPN (all the rest I want to get through the normal WAN). I've made an alias "PIA_VPN_IPs" (IP 192.168.1.230) and made a new LAN firewall rule at the top of the list passing source "PIA_VPN_IPs" to gateway PIAVPN_GW. I can see the traffic getting passed in the log below (I was pinging www.google.com) but I don't get any replies. If I ping 8.8.8.8 it works so I must be getting to the outside world? Could there be some inbound rule that's blocking the pings coming back?

                                          Is there any other way to see what the issue might be? I can ping from within pfsense selecting "PIAVPN" as source address and www.google.com works fine so I'm guessing my VPN connection is ok.

                                          Here are some passed firewall entries:
                                          Jul 5 19:33:56 LAN   192.168.1.230:49388   208.115.201.203:25915 TCP:S
                                          Jul 5 19:33:54 LAN   192.168.1.230   8.8.8.8 ICMP
                                          Jul 5 19:33:54 LAN   192.168.1.230:49387   208.115.201.203:25915 TCP:S
                                          Jul 5 19:33:52 LAN   192.168.1.230:49386   150.101.60.234:443 TCP:S
                                          Jul 5 19:33:48 LAN   192.168.1.230:49385   150.101.60.208:443 TCP:S
                                          Jul 5 19:33:48 LAN   192.168.1.230:49384   150.101.60.208:443 TCP:S
                                          Jul 5 19:33:44 LAN   192.168.1.230:49383   128.121.22.145:443 TCP:S
                                          Jul 5 19:33:44 LAN   192.168.1.230   150.101.60.230 ICMP
                                          Jul 5 19:33:44 LAN   192.168.1.230:53406   8.8.8.8:53 UDP
                                          Jul 5 19:33:41 LAN   192.168.1.230:49382   208.115.201.203:25915 TCP:S
                                          Jul 5 19:33:35 LAN   192.168.1.230:49381   208.115.201.203:25915 TCP:S

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            dambulti
                                            last edited by

                                            Albeit all data are here is adequate yet it you will Create OpenVPN interface then you have to run with this.

                                            • Click "Interfaces"

                                            • Click "(allocate)"

                                            • "Accessible system ports:" select "ovpnc1(PIA OpenVPN)"

                                            • Click "include chose interface" (symbol is a "+" image on a little lined sheet of paper)

                                            However for more vpn Configuring you may likewise investigate toptenvpnreviews

                                            www.toptenvpnreviews.com

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post