VPN service on a PC
-
Thank you for your help guys, but this is a bit beyond the scope of my currnet knowledge. Let me clarify how things are set here and what I'd like to achieve. Thank you for bearing with me!
This is how things are set in my house and sadly I can not change it. It would be ideal to remove the router and replace it with the pfSense machine but it's impossible. So the pfSense machine is in the LAN. It has 2 NICs, a wired one and a wireless one. I have also installed pfSense on my PC (in VMware), so whatever will be easier to do.
What I'd like to achieve (just to learn stuff, not to have the VPN server running 24/7) is: 1. Be able to safely surf the web from a public unsecure WiFi connection, tunneled into my house, throught the DSL interface and router, into the pfSense and then securely to the internet - as if i was home. 2. Make the pfSense also act as a wireless point - using the 2nd (wireless) NIC, alongside it being the VPN server.
I was thinking OpenVPN or IPSec (since for IPSec there's no additional softare needed on the Windows clients). What would you recommend, I'm guessing OpenVPN?
So, how would achieve what I want in the easiest way, without modifying/compromising the current network setup (the Cheap router being the firewall protection as everything goes through it and pfSense is just an experiment for me right now - just for the VPN, not to act a firewall).
Thank you!
-
I think, an IPSec server is more difficult to set up and to route. However, I've never set up one at pfSense, but openVPN.
If you add the "Open VPN client export utility" you can export a OpenVPN client and the required settings and install it on Windows with a single stroke.
I don't want to discuss your hardware set-up any more. You may have your reasons.
However, you can achieve your intention also this way. As said above, you have to forward the VPN port to pfSense. If your DSL modem is not in bridged mode you have to forward it here and a second time at the router.
For routing the VPN traffic right in your LAN, you should have nothing further to do. The necessary rules should be automatically created if you have just WAN and WLAN interface. To check that go to Firewall > NAT > Outbound and look for a rule where interface is WAN, source is your VPN tunnel network, source port, destination and destination port are any (*) and NAT address is WAN address.
If you can't find such a rule, select "Hybrid Outbound NAT rule generation" and click save and than add it by clicking +. -
I just realised that I could in fact connect from pfSense to the DSL modem. I can't believe I haven't tought of it before. My ISP is supposed to provide me two IP addresses, not one. So I'll disconnect the cable that's connecting my dumb swithc to the router and connect it directly to the DSL modem. I'll try it tomorrow or when I'll have some time and hopefully it will work with the 2nd IP leased.
Can I have 3 NICs in the old PC box? I think I'll need another wired NIC to make it all work properly. Thank you for all the tips, I can't wait to try and make it work.
PS: Another question - I've read that pfSense supports WOL so that it can wake up computers on the LAN. But what about pfSense itself, is it possible to turn on the pfSense box itself with WOL? The PC supports WOL (in checked the BIOS), does pfSense support it too?
-
But what about pfSense itself, is it possible to turn on the pfSense box itself with WOL?
If pfSense is installed on the PC and you wake up the PC with WoL then the PC boots and also the on the
PC installed OS, that means also pfSense will starting if it is the installed OS on the PC. -
Yep, that was a stupid question from me. It was a while since I last dealed with WOL - one has to set the things in the OS of the computer that will be waking the other one up (regarding NIC's settings for WOL). My pfSense box has WOL functionality in the BIOS so that should work.
More importantly, will an old Lenovo box work with three NICs? The integrated one (in the MOBO), an additional wireless one and an additional wired one? If yes, I'll buy another wired one for cheap so that I can do more stuff with it.
Another thing: the pfSense installation in my VMware just keeps on rebooting when I start it up. It won't stop, it's just rebooting on and on, do you know what might be causing it and how to fix it?
Thank you!
-
More importantly, will an old Lenovo box work with three NICs?
This can be a Xeon E5-26xxv3 and 128 GB RAM or a Celeron Dual Core @3,0GHz
So a little bit closer to the point what is in the "old Lenovo"!If yes, I'll buy another wired one for cheap so that I can do more stuff with it.
Buy a Intel Quad Port NIC for ~$60 so that is ~$15 for each Port but not consumer grade!
Another thing: the pfSense installation in my VMware just keeps on rebooting when I start it up.
It won't stop, it's just rebooting on and on, do you know what might be causing it and how to fix it????
- I prefer running it on bare metal
- if not able to run it on Hyper-V
-
My "old Lenovo" is a Celeron D with 512 MB of RAM. I will use this box to provide internet connection for only a couple of PCs and it's mainly for me to learn hot pfSense works and to learn more about networking in general.
I will buy an used one-port NIC cause it's disgustingly cheap, it will be for learning only. What I'd like to achieve is use the onboard NIC for WAN, the coming NIC for LAN (or vice versa) and the wireless NIC as an wireless access point (WLAN basically). So I hope that the old Lenovo will work with three NICs.
pfSense worked fine in my VMware Player before. And now I think it says something like that it wasn't dismounted properly and the just reboots and keeps rebooting… I don't know how to fix that.
Thank you for helping me.
-
I'll be getting another NIC soon and will be able to finish the hardware part of the pfSense box.
All I have to set right on it is assign the interface and it's IP address so that I can connect to it via the web interface, right? Everything else I can then set through the web interface?
Another question: is there something like a default template or default settings so that when I replace my home router with the pfSense box and connect to the internet I am already safe & secure? And then I can tweak the settings in peace?
Thank you!
-
If you intent to permit traffic coming in the new interface you have to add firewall rules.
The pfSense settings can be exported and restored over the WebGUI Dignostics > Backup/Restore. Or you can reset all settings in Dignostics > Factory defaults as well as in the console.
-
Everything else I can then set through the web interface?
Yes.
Another question: is there something like a default template or default settings so that when I replace my home router with the pfSense box and connect to the internet I am already safe & secure?
There is a default config and will be also some rules for the WAN interface if you set it up, but after this
you must also setting up rules for any other interface then!And then I can tweak the settings in peace?
You can do so no one is pressing you to be going fast.
-
I have installed another NIC into the pfSense box and it wouldn't recognise the new NIC. Then I reinstalled pfSense and now it works, all three NICs are recognised!
I've set the new NIC as WAN, the onboard NIC as LAN and the wireless nic as WLAN. When I set the WLAN NIC as an access point the pfSense box started having some trouble and my internet connection was unstable.
I was getting this displayed on the pfSense box monitor:
swap_pager_getswapspace(3): failed
swap_pager_getswapspace(3): failed
swap_pager_getswapspace(5): failed
swap_pager_getswapspace(16): failed
swap_pager_getswapspace(9): failed
swap_pager_getswapspace(16): failed
swap_pager_getswapspace(3): failed
swap_pager_getswapspace(3): failed
swap_pager_getswapspace(3): failed
swap_pager_getswapspace(3): failed
(it goes on and on…)And I was getting this displayed in the pfSense WebGUI notice:
Acknowledge All Notices
[There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table persist file /etc/bogonsv6]Could it be related to the fact that the box only has 512 MB of RAM? It has an 80 GB HDD though.
-
…and now pfSense is unable to boot up. It stops at Starting DHCP service... and I can hear the HDD but it won't go past that line and boot up. Do I have to reinstall pfSense? What caused this? How can avoid it in the future?
-
Could it be related to the fact that the box only has 512 MB of RAM? It has an 80 GB HDD though.
It seems like that.
I think, you won't need IPv6, so you may deactivate it. You may also deactivate IPv4 Bogons, you won't need it really for your purpose.
Further you should keep the amount of tables in generally small and don't use large tables like pfBlockerNG. Then the 512 MB should be enough, however, I don't know how much is required by AP function. You better ask this under hardware topic.And yes, maybe the 32bit version requires less RAM.
-
OK, I will reinstall now. I'm not sure if I should install the 32-bit version since the 64-bit is recommended and my CPU supports 64-bit.
How/where do I deactivate IPv6? and the IPv4 Bogons (I don't even know what that is)?
I haven't done anything with tables yet. All I did was set up WAN, LAN and WLAN. And when is tried applying changes to WLAN settings the errors started…
-
I reinstalled the 64-bit version and it works fine. Except…
I have not enabled the IPv6 or Bogons so I guess that should keep down the RAM usage?
I enabled the WLAN (wireless NIC) but it's DHCP service assigned my wired LAN PC an IP from the wireless pool and there was no DNS and I couldn't go anywhere on the internet. This is really weird, I know I'm a newbie but still - weird.
I have completely disabled the WLAN interface now and LAN interface's DHCP assigned me an IP which conencts to it's DNS and now it's OK. But that about the wireless - I really don't get it!
-
IPv6 is enabled by default. You can disabled it in System: Advanced: Networking.
The Bogons? I don't know. I think, I've read here that it is possible to disable it. Maybe the table isn't loaded if you uncheck "Block bogon networks" in the interface settings. -
Uhm… what is the goal here exactly? Why "disable" IPv6? It disables nothing, it only blocks all IPv6 traffic (even written in the GUI).
-
Save memory. If IPv6 is not enabled the IPv6 bogons table is not loaded.
-
Uh… Disable the bogons instead! facepalm
-
if you had read the last posts you would know that we know no way, how to disable bogons.