PfSense for secure browsing from public WiFi?



  • I'm searching for a robust, good performing system to solve two problems, and I wonder if pfSense could be part of the solution.  I'd appreciate any comments from those who know more about pfSense and OpenVPN than I do.

    I want a system that does the following two tasks:

    1. Provide a secure means to access the FreeNAS GUI from the WAN, so I can administer the system when I am on the road.

    2. Allow me to connect via OpenVPN when I'm on public WiFi, and then forward the connection to the internet at large, allow me to safely check email, browse the web etc without risk of man in the middle attacks, etc.  I've looked for threads that discuss this, but maybe I'm not using the right search terms because I'm finding nothing.  How should this capability be described?

    My current broadband connection is 120 Mbps up/10 Mbps down.  We live in a somewhat rural area, so I doubt it will get much better than in the foreseeable future.

    Currently, I use an Apple Airport Extreme as router and wireless access point, with a dumb switch to provide extra LAN connections.  I envision putting the Airport in bridge mode, and then putting the pfSense box between the broadband modem and the Apple Airport.  Is this a good architecture?

    Is pfSense (on suitable hardware) a good way to accomplish the above two tasks, or should I look elsewhere?

    Thanks.


  • LAYER 8 Global Moderator

    yes pfsense would allow you to vpn and admin anything on your network, and sure you could then surf the internet through this vpn connection.

    I would assume your APE is also your wireless..  Putting that in front of pfsense and still using it for wireless is not a typical setup.  There must be another device that connects you to the internet that your APE is plugged into?

    Putting that into bridge mode yes would be a preferred setup vs double nat.

    Then you put your APE behind pfsense as just an AP..  Just turn off its dhcp server, connect it to your network via one of its lan ports and then give it an IP on the network your connecting it to so you can connect to it and manage the wifi.



  • Yes, the APE is also my wireless access point.  There is a broadband modem before the APE.

    The proposed configuration is:

    Broadband                                          <->  dumb switch  <-> various LAN connections
    modem    <->  pfSense <->  Apple Airport Extreme  <->  Desktop Mac
                                                      <->  FreeNAS server



  • modem <-> pfsense <-> dumb switch <-> APE
                                      <-> Mac
                                      <-> FreeNAS
                                      <-> Other LAN stuff



  • @moikerz:

    modem <-> pfsense <-> dumb switch <-> APE
                                      <-> Mac
                                      <-> FreeNAS
                                      <-> Other LAN stuff

    I'll need a better switch if I do that.  I did have the Mac and FreeNAS connected through the switch at one point, but I found that I got much better throughput if I bypassed the switch.  It is a TP-Link SG1005D, which gets good reviews, so I was surprised that it didn't perform well for me.  Maybe I was expecting too much from an unmanaged switch.

    Once I bridge the APE, can it act as a switch (as I had it used above), or is that simply not possible?


  • LAYER 8 Global Moderator

    You can use the switch ports on the APE as just switch, I don't know why you keep saying bridge for the APE??  Are you wanting to bridge the wan port to the lan ports so you have an extra port?  Really don't see the point.

    Normally you would put your switch before any other devices - but yes you can leverage the switch ports on your APE once you set it up as just an Access Point.

    As to your performance on your switch..  Its a gig switch what do you think you should get, and what are you getting.. And you say if you use the ports on your APE you get better performance??  Gig is gig is gig is gig..  You should see very sim performance in home setup with any gig switch be it dumb, smart or fully managed.

    Your not doing anything that suggest you need a smart/managed switch - now if you want to do vlans then sure.  If you want more insight into your network via reporting of interface stats, or rate limiting, igmp snooping, etc. etc.. then sure a smart/managed switch makes sense.  And to be honest the prices are really very very reasonable these days.  I personally would never buy a dumb switch since your only talking a few dollars more to get a smart version..  And you can get some really feature rich devices for in the low 100's etc..  As long as your not talking really large port density..

    It is possible that some devices don't like each other, comes down to your nic and switch..  But really everything should work and give you the performance they state on their spec shit..  I would be very curious to how you determine that the performance of your switch is less than the performance of the switch on your APE.. Did you run iperf testing, file copies?  what?



  • @johnpoz:

    You can use the switch ports on the APE as just switch, I don't know why you keep saying bridge for the APE??  Are you wanting to bridge the wan port to the lan ports so you have an extra port?  Really don't see the point.

    I'm using the word "bridged", as it matches what I see in Airport Utility.  I've got three options for the router mode, "DHCP and NAT", "DHCP" and "OFF (bridge mode)".  I thought that the third option is the one that I should use if pfSense was doing the router function.  Am I wrong?  Has Apple mis-named that option?

    @johnpoz:

    As to your performance on your switch..  Its a gig switch what do you think you should get, and what are you getting.. And you say if you use the ports on your APE you get better performance??  Gig is gig is gig is gig..  You should see very sim performance in home setup with any gig switch be it dumb, smart or fully managed.

    Did you run iperf testing, file copies?  what?

    I was expecting 10-20% less than 1 Gbps, due to various overheads.  Originally, I was getting significantly lower than expected throughput when transferring large files to FreeNAS.  I rejigged the network to take the switch out of the picture, and the speeds went up to about what I was expecting.  iperf and netperf both show close enough to 1 Gbps to keep me happy.

    But, I just did tests with netperf, and I get 940 Mbps with or without the switch in play.  So, perhaps the switch is not a problem, and I had some other variable at play that I didn't realize at the time.  More testing required.


  • LAYER 8 Global Moderator

    That mode listing in your APE is kind of pointless unless that is the only way to turn of its dhcp server?  To use any wifi router as just an AP all that is required is turn off its dhcp server, connect it to your network with one of its lan ports.

    If you want to make it easier to manage then put its lan IP on your network.  Since your not connecting anything to its wan port what it thinks is doing between a wan connection and its lan ports is completely pointless…

    Pretty much every single soho router out there is the same sort of setup, wifi bridged to the switch ports.. If you want to bridge in the wan port for an extra port that is up to you..  But normally 1 port is not an issue, and its just easier to ignore its use vs playing with badly worded modes in these soho devices.

    Personally if you want wifi, get a AP.. If you want ports get a switch.. Not real big on the everything one box sort of setup..  While sure any soho router can be used as AP they are not designed to be strategically placed/mounted for best wifi coverage..  And they also need a very close power plug.

    Sure if you want to reuse the hardware switch ports as a dumb switch.. sure..  But if what your after is GOOD wifi, get a AP that is poe and designed to be mounted  to give you best coverage.



  • Using OpenVPN via public hotspot may not be as secure as one might expect it to be if using DNS to resolve host names.  Extra care must be taken to insure that the local DNS is not used.

    Local vs VPN DNS Name Resolution
    https://forum.pfsense.org/index.php?topic=77421.msg422027#msg422027
    https://forum.pfsense.org/index.php?topic=77421.msg422311#msg422311

    OpenVPN Forum Thread:
    https://forums.openvpn.net/viewtopic.php?t=15939



  • Using OpenVPN via public hotspot may not be as secure as one might expect it to be if using DNS to resolve host names.

    From Windows 8 and up, Microsoft introduced parallel DNS aka Smart Multi-Homed Name Resolution.

    To avoid this from happening, one puts

    block-outside-dns
    register-dns
    

    in the client config.

    The client log will then show

    us=537679 Blocking outside DNS
    us=537679 Opening WFP engine
    us=537679 Adding WFP sublayer
    us=547679 Blocking DNS using WFP
    us=547679 Tap Luid: 1688849893818368
    us=547679 Filter (Block IPv4 DNS) added with ID=88910
    us=547679 Filter (Block IPv6 DNS) added with ID=88911
    us=547679 Filter (Permit IPv4 DNS queries from TAP) added with ID=88912
    us=547679 Filter (Permit IPv6 DNS queries from TAP) added with ID=88913
    

    and

    C:\Windows\system32\net.exe start dnscache
    C:\Windows\system32\ipconfig.exe /flushdns
    C:\Windows\system32\ipconfig.exe /registerdns
    End net commands...
    


  • Does that also block local name resolution?  If so then that creates issues for using local services such as printers etc.

    What I would like to see is a means to only resolve local names locally and everything else via the VPN DNS.



  • Try it, it works here.



  • @Pippin:

    Try it, it works here.

    I will at some point.  But not in a situation right now for doing that.



  • The "–register-dns" option appears to be what enabling the pfSense "Force DNS cache update" option does.

    Force DNS cache update 
    Run "net stop dnscache", "net start dnscache", "ipconfig /flushdns" and "ipconfig /registerdns" on connection initiation. This is known to kick Windows into recognizing pushed DNS servers.


    --block-outside-dns
    Block DNS servers on other network adapters to prevent DNS leaks. This option prevents any application from accessing TCP or UDP port 53 except one inside the tunnel. It uses Windows Filtering Platform (WFP) and works on Windows Vista or later.

    --register-dns
    Run net stop dnscache, net start dnscache, ipconfig /flushdns and ipconfig /registerdns on connection initiation. This is known to kick Windows into recognizing pushed DNS servers.

    Since both of these are reliant on Windows executables and features.  Do they cause any issues for non-Windows clients using the VPN?

    Do any non-Windows clients have similar issues with DNS leakage to the non-VPN adapters?



  • Not sure but I have a strong feel the client will state something like this in the log:

    us=327673 NOTE: --block-outside-dns is disabled since we are running on OS XXX
    us=327673 NOTE: --register-dns is disabled since we are running on OS XXX
    


  • Do any non-Windows clients have similar issues with DNS leakage to the non-VPN adapters?

    Not that I know of…..



  • The "–block-outside-dns" option results in this.

    Thu Apr 28 14:26:17 2016 TCP: connect to [AF_INET]192.168.2.42:1194 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.



  • That log message is/seems unrelated to the block-outside-dns because it`s around for many years when block-outside-dns was non-existent ;)

    Check your config.



  • It only happens with the block-outside-dns option.

    The config is straight forward.  Nothing exotic.



  • khorton,
    As a direct answer to your #2 question: the term you are looking for is a "full-tunnel" VPN - all traffic goes through the tunnel. The opposite of this is a "split-VPN" or "split-scope VPN", where only data destined for the remote network goes over the VPN, all other data goes out the regular local internet.

    Best security is done with a full-tunnel VPN. This means remote user is subject to internet speeds at the host, filtering via the host, etc. Example, if a home user with a 100/20 connection connects to a full-tunnel VPN to corporate HQ, who has a 10/10 connection, then remote user is subject to all filter rules as at HQ, and only has a 10/10 connection to the Internet.



  • Ah ha.  The  block-outside-dns option was added in 2.3.9.  I've not updated from 2.3.8 yet.



  • Yup thats right  :)



  • Well latest version wasn't the solution.  Still get the same error with vesion 2.3.10.
    (although the message itself is apparently bogus due to use of incorrect error code library translation from what I've read.)



  • Yes, it`s error 138, not only OpenVPN is "plagued" by it.

    You use IP, domain or DDNS to connect?
    Try IP… just a shot in the dark.



  • @moikerz:

    khorton,
    As a direct answer to your #2 question: the term you are looking for is a "full-tunnel" VPN - all traffic goes through the tunnel. The opposite of this is a "split-VPN" or "split-scope VPN", where only data destined for the remote network goes over the VPN, all other data goes out the regular local internet.

    Best security is done with a full-tunnel VPN. This means remote user is subject to internet speeds at the host, filtering via the host, etc. Example, if a home user with a 100/20 connection connects to a full-tunnel VPN to corporate HQ, who has a 10/10 connection, then remote user is subject to all filter rules as at HQ, and only has a 10/10 connection to the Internet.

    Thank you very much for the terminology education.  I'll look for info on full-tunnel VPN, and pfSense.

    I was quite aware that I'd be getting 10/10 speed, at best.  But, I'm prepared to live with that, all in the name of security when away from home.



  • Okay got it working.  The "block-outside-dns" option either has to be in the client config file or push needs to be used in the pfSense advanced options: push "block-outside-dns".

    I forgot about the push thing.

    Don't see the blocking outside DNS and WFP log entries you show but it is blocking the local DNS.  Which means no local names are resolved either.  So not really very usable for me, unless there is still something not working correctly.



  • @johnpoz:

    That mode listing in your APE is kind of pointless unless that is the only way to turn of its dhcp server?  To use any wifi router as just an AP all that is required is turn off its dhcp server, connect it to your network with one of its lan ports.

    That mode switch is the only way that I know to turn off DHCP on the Airport Extreme.  If you know a beter way, I'd love to learn about it.

    @johnpoz:

    If you want to make it easier to manage then put its lan IP on your network.  Since your not connecting anything to its wan port what it thinks is doing between a wan connection and its lan ports is completely pointless…

    You've lost me here.  What do you mean by "put its lan IP on your network"?  How would I accomplish that?

    @johnpoz:

    Personally if you want wifi, get a AP.. If you want ports get a switch.. Not real big on the everything one box sort of setup..  While sure any soho router can be used as AP they are not designed to be strategically placed/mounted for best wifi coverage..  And they also need a very close power plug.

    Sure if you want to reuse the hardware switch ports as a dumb switch.. sure..  But if what your after is GOOD wifi, get a AP that is poe and designed to be mounted  to give you best coverage.

    If I was starting from scratch today, I probably wouldn't buy the APE.  But, I've got it, and I'm very happy with the WiFi coverage, so I'm not in a rush to spend a bunch of money on something "better".



  • Hey sorry Khorton,  I kind of hijacked your thread here.  Though the content is very relevant to the "secure browsing from public WiFi" topic.



  • @NOYB:

    Don't see the blocking outside DNS and WFP log entries

    Set

    verb 4

    in client config.

    Yeah, uhum sorry too…



  • @khorton:

    @johnpoz:

    That mode listing in your APE is kind of pointless unless that is the only way to turn of its dhcp server?  To use any wifi router as just an AP all that is required is turn off its dhcp server, connect it to your network with one of its lan ports.

    That mode switch is the only way that I know to turn off DHCP on the Airport Extreme.  If you know a beter way, I'd love to learn about it.

    @johnpoz:

    If you want to make it easier to manage then put its lan IP on your network.  Since your not connecting anything to its wan port what it thinks is doing between a wan connection and its lan ports is completely pointless…

    You've lost me here.  What do you mean by "put its lan IP on your network"?  How would I accomplish that?

    @johnpoz:

    Personally if you want wifi, get a AP.. If you want ports get a switch.. Not real big on the everything one box sort of setup..  While sure any soho router can be used as AP they are not designed to be strategically placed/mounted for best wifi coverage..  And they also need a very close power plug.

    Sure if you want to reuse the hardware switch ports as a dumb switch.. sure..  But if what your after is GOOD wifi, get a AP that is poe and designed to be mounted  to give you best coverage.

    If I was starting from scratch today, I probably wouldn't buy the APE.  But, I've got it, and I'm very happy with the WiFi coverage, so I'm not in a rush to spend a bunch of money on something "better".

    Turn off the DHCP function (and any other functions you can turn off) on the APE.

    If you can, configure the APE's LAN port with a static IP in the same range as the rest of your network.

    Connect any of the APE's LAN ports to the switch.

    Example: pfSense at 192.168.0.1, pfSense connected to dumb switch, APE at 192.168.0.2, APE LAN connected to dumb switch. pfSense offers DHCP in range of 192.168.0.100-192.168.0.199. This way everything is connected to the switch, you do not use the APE's WAN port, and the APE is not offering DHCP/DNS in competition with pfSense.


  • LAYER 8 Netgate

    "Wireless Access Points" are bridges. They connect wireless networks to wired networks at layer 2. That's why Apple calls access point mode "Bridge Mode." In bridge mode the unit does not route traffic at all between interfaces. Everything is bridged. The regular wireless network is on the ethernet port untagged. The guest wireless network is tagged 1003. The AP even understands the concept of a default gateway on the regular (trusted) network so it can be easily administered remotely.

    If you were to make the AirPort's guest network be the guest network, you could create a pfSense interface that was completely discrete from your regular network. Completely different firewall rules, policies, DNS, etc. This would probably entail a managed switch or at least a dedicated pfSense interface. Managed switch would be better. You can get one for < $40.



  • @Derelict:

    If you were to make the AirPort's guest network be the guest network, you could create a pfSense interface that was completely discrete from your regular network. Completely different firewall rules, policies, DNS, etc. This would probably entail a managed switch or at least a dedicated pfSense interface. Managed switch would be better. You can get one for < $40.

    How would the various boxes be physically connected with this setup?  Would it be:

    modem <-> pfSense <-> switch <-> APE

    I've pretty much decided that I will build a pfSense box, but it won't happen until June at the earliest.  I'll check back in then if I need any OpenVPN assistance.  I'll start a new thread in the HW section to help me decide what the best option is for the build.  Thanks for everyone's assistance.


  • LAYER 8 Global Moderator

    does the APE support vlans? If so then sure you can do all kinds of fun stuff with multi wifi ssid on different networks.  If it does not support vlans and your not using it as a router then you could not leverage "its" guest network function.

    It really would behoove you to get a real AP that supports vlans and a managed switch if your wanting to have multiple wifi networks on different networks, etc.

    It does not matter what way you connect the stuff if your just using the APE switch ports.. When used as AP in general setup its just got wifi bridge to its lan network.  so be it the ape switch is connect to pfsense and then the switch is connected to another lan port, or your switch is connected to pfsense and then the ape switch ports makes little difference.



  • @johnpoz:

    does the APE support vlans? If so then sure you can do all kinds of fun stuff with multi wifi ssid on different networks.  If it does not support vlans and your not using it as a router then you could not leverage "its" guest network function.

    It really would behoove you to get a real AP that supports vlans and a managed switch if your wanting to have multiple wifi networks on different networks, etc.

    No VLANs on the APE, as it only has a very simply user interface (typical Apple product that tries to satisfy the needs of the vast majority of users, in the simplest way possible).

    I have no need for multiple WiFi networks, and I'm happy with the WiFi performance, so I see no need to spend the money for a different wireless AP.  You can only spend each dollar once, and I'd rather put money in a pfSense box.


  • LAYER 8 Netgate

    There are you just can't set them. Like I said the regular SSID is on the ethernet port (WAN/Inernet in bridge mode) untagged. The guest network is tagged 1003.



  • The Airport Extreme makes a fine Access Point and switch if you only need 4 Lan ports. In the Windows Airport utility, Internet tab, you have the Connection Sharing drop down in which you specify Off (Bridge mode). With that set you can also use the Wan port as just another Lan port providing a total of 4 ports.


Log in to reply