Tutorial: Configuring pfSense as VPN client to Private Internet Access

bj24 · Mar 16, 2015, 6:06 PM

Derelict thanks for the reply,

I seem to of messed something up. :-[ :-[

A few questions:
1. Every time I enable and disable the VPN Client (which I do a lot while trying to set this up) it gives me a new IP which I then have to add to the firewall rules, is there a easier way of doing this?

2. I seem to of lost ability to have traffic go through the VPN (I could once have all or nothing), I can see small amount of traffic on the VPN but when I check my IP I get my ISPs. What did I do?

3. What did checking "Don't add/remove routes" do?

I seem to go one step forward and two steps back every time I make a change on this.

Thanks,

Derelict · Mar 16, 2015, 6:57 PM

What rules are you talking about? You don't need to care what address they give you. That's the PIAVPN_V4 address and all pfSense does is NAT to it. That can change all the time. You are concerned with your client's LAN address that doesn't change unless you change it (presuming it's static or at least a DHCP Static Mapping which is advisable when you start policy routing based on the source address.

Many VPN providers push a default route to you so all your traffic gets sent through them. Checking that box adds route-nopull; to your client configuration which tells the client to ignore all the routes pushed to you. This leaves it up to you to policy route the traffic you want to go to the VPN.

bj24 · Mar 16, 2015, 7:20 PM

I will attach what I think might be useful, let me know if anything else is needed.

I also noticed when I check the gateway that the VPN shows online but then quickly goes offline after enabling. Any thoughts on that?

Derelict · Mar 16, 2015, 7:37 PM

Which rule do you think you have to change? What, exactly, is the problem?

bj24 · Mar 16, 2015, 7:47 PM

I have to disable that top rule to reply.

When all the rules are enabled, on the BJENVY pc, it doesn't seem to have internet for some time, then it comes for a few seconds, I can check the ip and it is my WAN IP and then it stops responding.

Should I be concerned about the Gateway showing offline?

scratching my head… ???

User1503 · Mar 16, 2015, 9:11 PM

Thanks to Derelict for keeping me at it. I got the separate IP's working out thru the VPN and all others thru normal gateway/router.
bj24 - Follow the steps in Derlict's post for making an alias. Add the IP's you want going out thru the VPN to it. Give it a name like 'IPs_Out_VPN' or something you will recognize.
Then go to Firewall-Rules-Lan
Click the plus to create a new rule based on LAN net
Action=Pass, Interface=LAN, TCP/IP=IPv4, Protocol=any, Source=Type:Single host or alias, Address: IPs_Out_VPN; Destination=any, Description=LAN PIA_VPN Specific IP address Out
Advanced features: Gateway=PIAVPN_VPN4-some.ip. (this should be in the list if you followed the tutorial)
Save, Apply Changes
In Firewall: Rules - LAN Click the rule you just made in the checkbox on the left; Then point at the Arrow to the right of the LAN net rule, and move your IP out rule above it. It should now be the first rule.
Go to Status-Services, Restart DHCP, Restart OpenVPN.
Give your computers 1-2 minutes to get a refreshed IP and see if your computers are running thru the interface you want.
**** Mine Didn't*** Because I had to go change this:
Firewall-Rules-LAN
Choose your IPv4 LAN net (gateway should be '*') click Edit
Advanced features - Gateway: Choose 'WAN_DHCP - 192.168.x.x'
Save- Apply changes.
Go to Status-Services, Restart DHCP, Restart OpenVPN.
Give your computers 1-2 minutes to get a refreshed IP and see if your computers are running thru the interface you want.
If all works, save this to your notepad along with the tutorial and you're good to go!
Let me know if you need the individual steps for making the Alias list, it's pretty straightforward but until you do it you can be poking around.
Thanks Derelict and others for getting us going!

bj24 · Mar 16, 2015, 11:15 PM

This is very frustrating.

I have it as you two have said as far as I can tell and it does not work as expected.

Should I be concerned that the Gateway for the VPN shows offline?!

What logs should I be looking at or screens? I have found another laptop to use as a tester so I stop losing internet when I test on myself. I have added its IP to the list with a Alias of IPs_Out_VPN.
I have made a Lan rule with the Gateway selected to use the VPN.

I restarted the 2 services.

I test the computer, it still has my ISPs IP address and after a less than 2 minutes internet stops completely on it.

Should I start to suspect PIA? Like I've wondered, the Gateway keeps going from online to offline.

puzzled….

Derelict · Mar 16, 2015, 11:27 PM

Disable gateway monitoring on that gateway.

bj24 · Mar 17, 2015, 12:03 AM

Thank you, that has solved the gateway offline issue.

However still no routing of IPs_Out_VPN to go out the VPN.

progress!!…

Derelict · Mar 17, 2015, 12:10 AM

Why are your NAT entries back here: https://forum.pfsense.org/index.php?topic=76015.msg500950#msg500950 for 192.168.1.0 and your policy route is for 192.168.0.102?

bj24 · Mar 17, 2015, 12:27 AM

I hope thats the issue. I corrected that to 192.168.0.0 but still nothing.

Here is my updated NAT list, do I need to keep all 7?

tested it now and still on the ISP IP.

bj24 · Mar 17, 2015, 12:28 AM

oops, heres the NAT list

Derelict · Mar 17, 2015, 12:45 AM

What are the contents of alias BJENVY?

What is the IP address of the host you're testing from?

Is the VPN up?

Please post evidence so we can see everything is as it should be.

bj24 · Mar 17, 2015, 2:16 AM

I have changed the alias name to IP_out_VPN, it has 2 ips in it 192.168.0.102 and .115

I am testing from both of those 2 IPs, 192.168.0.102 and .115

What is the best evidence that the VPN is up? I believe it is as far as I can see.

Derelict · Mar 17, 2015, 2:19 AM

I guess I don't know. You've got something wrong somewhere. Delete it all and start over maybe.

bj24 · Mar 17, 2015, 2:21 AM

:)

bj24 · Mar 17, 2015, 7:33 PM

Will start fresh and see how it goes… cross your fingers ;)

bj24 · Mar 17, 2015, 7:37 PM

HOLD UP. My last post I noticed my IP address in the lower right corner and it wasn't mine, it was the IP of the VPN!! So something is working.

I go to speedtest.net and it shows my current location and ISP IP.
I go to whatismyip.org and it shows my ISP IP and location.

What is going on? Why did my post or this forum recognize the VPN but nothing else seemingly?

steps forward…

Derelict · Mar 17, 2015, 10:17 PM

There is nothing in your config that cares about the destination unless you're not telling us everything. Is your VPN going up and down? Lots of sites report IP addresses. What does www.ipecho.net say? What does www.wimi.com say?

bj24 · Mar 18, 2015, 3:10 AM

Derelict,

What do you imply that I wouldn't be telling?

Every time I check the status of the VPN it is up and well. When I use the PC application the VPN is very stable. The logs for openVPN don't show anything strange.

Both of those site showed my ISP IP.

Any other logs I should be looking at?