Tutorial: Configuring pfSense as VPN client to Private Internet Access


  • LAYER 8 Netgate

    Status > OpenVPN has a connected since column.

    I say there's something else afoot because if there wasn't it would be working.



  • I checked the connection time and it was up for almost a day now.

    I tried unchecking the "Don't add/remove routes" box. To my amazement when I checked the IP it was my VPN! How ever when I checked it on a PC that should be on the ISP is was showing the VPN. I changed it back.

    I tried checking "Don't pull routes" too but that didn't seem to help.



  • If I use the website ipleak.net I get these results…

    Showing my ISP IP 50.*** and also my VPN IP 104.***

    what gives?



  • LAYER 8 Netgate

    Are you running squid?



  • I do have squid


  • LAYER 8 Netgate

    @bj24:

    I do have squid

    You're on your own then.  Unbelievable.



  • I turned off squid and it works as expected now.  :o ::) :-[

    I had no idea squid would be interfering especially if I am going to uncached never before visited sites like the ones you suggested to try.

    Thank you for the suggestion!

    So no squid + VPN setup? Or will more configuring will be required if I want both?

    Thanks again, I can live without squid I think.


  • LAYER 8 Netgate

    Thanks again, I can live without squid I think.

    Most people don't need it.  it just breaks things.



  • proven  ;D

    thanks again!



  • Thanks It works for specific IP (static) in the LAN

    Is there a way to route the traffic based on IP or URL ? (for netflix for exemple)

    Thanks



  • It is very similar to routing static IPs.

    Under Firewall rules : LAN you'll want to make a rule for:

    Source: being your static IPs being routed, or leave blank if all

    Destination: being the IP address of the website you are trying to route

    Gateway: being the VPN or default as need requires



  • Thanks

    I already have some IP that are routed to openvpn

    I wanted to know if all IP coudl be routed based only on url ?

    :D



  • Source: *

    Destination: being the IP address of the website you are trying to route

    Gateway: being the VPN


  • LAYER 8 Netgate

    The trouble is a "website" will load assets from many different domains.  Run NoScript for a while.  And that'll just show you all the different places the site is trying to pull javascript from.  Not images, etc.

    You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.



  • @User1503:

    Thanks for the steps.  I just can't get it to work.  I either have  No outbound connection; Everything thru VPN; or Everything Open, not vpn'd.  The IP's are set in the 'VPN Out IPs' and the gateway is 'default' under the 2nd LAN rule.  Just not getting it I suppose.  Thanks for the help.

    A little late to the Party, but…...............

    With PIA you have 2 WAN's in effect. Pfsense gives the VPN priority......I tried the NO_PULL route, doesn't work at least I never could get it to.

    MY SOLUTION....Set fixed IP's or find the static IP's of the TV,s devices you wish to run outside the vpn. Then You make rules on the LAN interface (NAT will bring them back in, most likely will not need little if any tweaking ) and on your gateway set the gateway in the rule to PIA interface name, THEN click the little box above it to NOT use it….....anything you want out and NOT thru PIA you'll want to do this way. Set mine this way 6-8 months ago and is working perfectly with Netfilx, Ebay, etc as they are also blacklisting PIA IP's.
    On your Email with PIA.....click on their help or send an email to them, tell them what email servers (you need the actual numerical IP) you will be using and that you need to get smtp on 25 opened for you on those........their tech will "adjust" the setting for you....they just don't want someone using PIA for spamming. As long as your traffic is average you won't have a problem......You will also need to adjust the email program setting to use the numerical IP's instead of the resolved name. Been working for me for over a year now. I leave my VPN running 24/7 (on the Pfsense box)...you can also run PIA within PIA I have. I have posted a screen shot of  the my firewall rules. The ones with the !No PIA.net are the ones bypassing the VPN..
    Notice they are at the bottom..........I let default be PIA and EXCEPTED the oddballs, that way anything else I plug in will automatically go to PIA by default.

    I have my Roku Box and my VIZIO TV set to NOT PIA works fine. I flip my PC when needed or wanted............or use their windows app. I prefer the Pfsense tunnel.
    Our cell phones are WIFI SIP phones, using wifi when around wifi and cellular when wifi not available.....................Worked from day one, no special config was needed to get them up and running.

    Stinking Netflix, Hulu, Ebay and CBS............ >:( >:(

    If you WANT to use the VPN, just edit the rule back to * all. Give it a couple of minutes and you'll be on vpn or visa versa.

    SEE ATTACHED SCREEN SHOTS

    Not sure about the NAT with the 2.2.1 version yet, I had custom NAT rules. It appears that the Default or Hybrid would work.....depends on how intricate or simple your install is.....the more "intricate" the more your NAT or rules will have to be.......




  • @Derelict:

    The trouble is a "website" will load assets from many different domains.  Run NoScript for a while.  And that'll just show you all the different places the site is trying to pull javascript from.  Not images, etc.

    You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.

    Agreed, found it out the hard way trying to uhhhh time shift some, Netflix breaks a movie into at least 40 pieces or more (or clips) and they all get a different IP designation, and they pull in each segment as needed with your device caching each segment or part of. Your IP would litterally be a moving target…................that's why its more productive to identify the device that needs clear internet set it to use unencrypted WAN, If the NSA want to watch a movie with me (80% is granddaughter and my little pony or pinky..no state secrets) so be it....anything I don't wish to watch with them I use the PC on encrypted.......set everything else encrypted by default and only adjust as required.

    Before this last update Pfsense and PIA were up for 59 days uninterrupted (I have UPS)

    But the Update DID break my PIA vpn and screwed up my NTP forward for Layer 3 switch (a play toy, still haven't got IT all figured out yet) and references. It (even with a backup reloaded, forgot to backup config.xml file) lost my login and password file and I had reconfigure  a firewall bypass for NTP....seems they changed something with the NAT, not clear just yet how that was "readjusted" by the Dev's..............minor tweaks, buuuuttt. I had to make an entire new password file with login and password, then worked fine.



  • @bj24:

    I have to disable that top rule to reply.

    When all the rules are enabled, on the BJENVY pc, it doesn't seem to have internet for some time, then it comes for a few seconds, I can check the ip and it is my WAN IP and then it stops responding.

    Should I be concerned about the Gateway showing offline?

    scratching my head… ???

    Mine has ALWAYS shown as down on the Dashboard Gateway Panel. But checking on Service status is mean and green…......that's a quirk they have never "fixed".



  • @Derelict:

    You can make aliases that periodically look up FQDNs and put all the IP addresses in a table.

    How do you mke such aliases ?


  • LAYER 8 Netgate

    Create the alias.

    ![Screen Shot 2015-03-28 at 11.00.01 PM.png](/public/imported_attachments/1/Screen Shot 2015-03-28 at 11.00.01 PM.png)
    ![Screen Shot 2015-03-28 at 11.00.01 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-03-28 at 11.00.01 PM.png_thumb)
    ![Screen Shot 2015-03-28 at 11.00.43 PM.png](/public/imported_attachments/1/Screen Shot 2015-03-28 at 11.00.43 PM.png)
    ![Screen Shot 2015-03-28 at 11.00.43 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-03-28 at 11.00.43 PM.png_thumb)



  • Thanks
    I tried previously to create that kind of aliases in url
    Didn't worked  :o

    In IP it works
    I created an aliases for what is my ip adress and changed a rule … Every IP inside my lan show an adress from the vpn when accessing what is my ip adress. With an other service like what is my ip, I have the adress from my ISP.

    So it works !

    But not success with netflix
    In the netflix alieses I have this

    netflix.com

    lnwd.net

    nflximg.com

    edgesuite.net

    nflximg.net


  • LAYER 8 Netgate

    Sorry, but I don't play whack-a-mole.

    The URL aliases are for downloading the content of the aliases from a URL, not for creating an alias based on a FQDN.



  • Thank you for your help
    I think that is a good start

    ;D



  • THIS IS PFSENSE GOLD!!!!
    I am having one issue though. SMTP Notifications seem to not work when PIAVPN/OpenVPN is running.
    I stopped the OpenVPN service and notifications worked just fine.
    Logs state:

    "php-fpm[38529]: /system_advanced_notifications.php: Could not send the message to myemailadress@xxxx.com – Error: could not resolve host "smtp.xxxxx.com"

    Any ideas on a possible fix?



  • The tutorial states to turn off hardware encryption and to use BL-128.  Is there anyway to use AES-256 instead and use hardware encryption?



  • Found out tha PIA blocks smtp servers by default due to spam.
    Had to open a ticket with PIA for them to test the smtp server and whitelist it
    SMTP notifications are working fine now!!!!!

    @louicruz88:

    THIS IS PFSENSE GOLD!!!!
    I am having one issue though. SMTP Notifications seem to not work when PIAVPN/OpenVPN is running.
    I stopped the OpenVPN service and notifications worked just fine.
    Logs state:

    "php-fpm[38529]: /system_advanced_notifications.php: Could not send the message to myemailadress@xxxx.com – Error: could not resolve host "smtp.xxxxx.com"

    Any ideas on a possible fix?


  • LAYER 8 Netgate

    A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.

    That way when PIA or the email server operator makes a change it doesn't break again.

    Or move to SSL/STARTTLS and use submit port 587 with authentication.



  • Really!!! I looked but wasn't able to find ROUTE_NOPULL.
    Where can I find route-nopull option????

    @Derelict:

    A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.

    That way when PIA or the email server operator makes a change it doesn't break again.

    Or move to SSL/STARTTLS and use submit port 587 with authentication.


  • LAYER 8 Netgate

    @louicruz88:

    Really!!! I looked but wasn't able to find ROUTE_NOPULL.
    Where can I find route-nopull option????

    @Derelict:

    A better solution would probably be to turn on route-nopull, and policy route the port 25 traffic out your WAN.

    That way when PIA or the email server operator makes a change it doesn't break again.

    Or move to SSL/STARTTLS and use submit port 587 with authentication.

    https://forum.pfsense.org/index.php?topic=76015.msg501074;topicseen#msg501074



  • In the tutorial, manual NAT rules are required … is this still required for 2.2.1 and why is this?

    1. How come the OpenVPN wizard doesn't automatically add the NAT rules?
    2. How come pfSense automatic NAT rules doesn't do this for you?

    Just wondering why manual rules must be added.

    Thanks.


  • Banned

    @coolspot:

    1. How come the OpenVPN wizard doesn't automatically add the NAT rules?
    2. How come pfSense automatic NAT rules doesn't do this for you?

    Because people usually do NOT want all their Internet-bound traffic go through some slow VPN tunnel.



  • @doktornotor:

    Because people usually do NOT want all their Internet-bound traffic go through some slow VPN tunnel.

    Great thanks, so I got my tunnel up and running… however, my performance is only ~40mbps.

    I'm running an Atom D525 CPU, what should be the expected performance?

    When I run TOP, my WCPU for OpenVPN hovers around 50% ... however, the other cores/threads are pretty idle.

    Here is my TOP output:

    last pid: 15026;  load averages:  1.02,  0.61,  0.43                                                                                  up 19+02:05:29  14:33:57
    210 processes: 7 running, 177 sleeping, 26 waiting
    CPU:    % user,    % nice,    % system,    % interrupt,    % idle
    Mem: 28M Active, 179M Inact, 542M Wired, 465M Buf, 7172M Free
    Swap: 16G Total, 16G Free

    PID USERNAME      PRI NICE  SIZE    RES STATE  C  TIME    WCPU COMMAND
      11 root          155 ki31    0K    64K CPU2    2 440.2H  79.05% idle{idle: cpu2}
      11 root          155 ki31    0K    64K CPU0    0 432.5H  78.66% idle{idle: cpu0}
      11 root          155 ki31    0K    64K RUN    3 446.5H  76.56% idle{idle: cpu3}
      11 root          155 ki31    0K    64K RUN    1 443.6H  68.16% idle{idle: cpu1}
    28854 root          52    0 21728K  5752K select  0  1:06  58.40% openvpn



  • Has anyone gotten this setup to work with Plex Media Server?  From what I've seen, most can't get Plex to publish to the internet once connected to PIA.


  • LAYER 8 Netgate

    Has anyone gotten this setup to work with Plex Media Server?  From what I've seen, most can't get Plex to publish to the internet once connected to PIA.

    Publish over PIA or over the internet bypassing PIA?

    For the former, PIA has to forward a port to you.  Do they support that?

    For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.

    If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.

    IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.



  • @Derelict:

    Has anyone gotten this setup to work with Plex Media Server?  From what I've seen, most can't get Plex to publish to the internet once connected to PIA.

    Publish over PIA or over the internet bypassing PIA?

    For the former, PIA has to forward a port to you.  Do they support that?

    For the latter, it should be a simple matter of making sure Plex policy routes out your WAN instead of PIA.

    If you want the same IP address to route some things over PIA and some over WAN you have to figure out how to identify the different traffic and policy route accordingly.

    IMHO, Plex requiring a port forward open to any is fail and pretty much makes it a non-starter for me.

    PIA does support port forwarding but the port changes every time you get disconnected.

    What do you use in place of Plex or do you just not have a media server you can access remotely?



  • I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
    I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.



  • @irj972:

    I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
    I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

    I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately.  I realize having it open to the public is not ideal.  However given that fact, I'm trying to make it as secure and hidden as I can.


  • LAYER 8 Netgate

    As far as I know, you have to have the Plex port open to the world just to sign it into plex.  Doesn't have anything to do with who you allow access to it.



  • @JimPhreak:

    @irj972:

    I use AirVPN but you should be able to port forward a secure OpenVPN session into your LAN and then connect to Plex over the OpenVPN connection with usual subnet routing….thats how I do it anyway. Seems secure and was simple enough to do.
    I agree with Derelict though - opening a media player to to the outside world directly feels like a unnecessary risk.

    I have a bunch of family and friends that connect to it and it's just not possible for me to set them all up as VPN clients unfortunately.  I realize having it open to the public is not ideal.  However given that fact, I'm trying to make it as secure and hidden as I can.

    Yes, I can see how that would be an added inconvenience.



  • When trying to start the VPN client connection configured for PIA, I receive the following error:

    Cannot load CA certificate file /var/etc/openvpn/client1.ca (no entries were read) (OpenSSL)

    I've gone through the certificate authority setup a few times and there doesn't seem to be much to it.  I did try to search through the forums for this error but didn't turn up anything that helped.  Can someone tell me what I might be missing?

    Thanks



  • Hi All

    I used some of this tutorial and others to get OpenVPN via giganews VyprVPN working on a new SG-4860 and everytyhing is fine (apart from slow)

    I just would like some help to confirm I have not opened up my network unnecessarily, so does this look all ok?

    Not sure about why I had to create rules in the 2 VPN tabs. I have configured it so most traffic will go via WAN, but any devices in the "VPN Systems" alias will go via the VPN.

    Thanks









Log in to reply