Netgate SG-1000 microFirewall

Author Topic: Tutorial: Configuring pfSense as VPN client to Private Internet Access  (Read 197925 times)

0 Members and 2 Guests are viewing this topic.

Offline thethrow

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #300 on: April 05, 2017, 01:36:28 am »
Leaving this note for myself for 6 months when I forget.  8). Unsure if it was discussed prior, but may be worth adding to the tutorial. 

I was struggling with the routing part, as I expected the traffic to stop when my gateway went down, once I assigned a VPN gateway to the "Default allow LAN to any rule"

In order to make this work how I expected, I had to make the following change:

(System | Advanced | Miscellaneous)
Do not create rules when gateway is down
By default, when a rule has a gateway specified and this gateway is down, the rule is created omitting the gateway. This option overrides that behavior by omitting the entire rule instead.


Offline CTrax

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #301 on: April 05, 2017, 04:02:01 pm »
While I appreciate the detail of the original PIA VPN tutorial and all of the subsequent contributions, I've not been able to combine all of that into a working VPN + Bypass configuration. PIA VPN works; it's the 'bypass' exception that does not.

Problem:
I've successfully configured PIA VPN and ipecho.net confirms a PIA IP address but something is preventing any Firewall exception Rule I create (to 'bypass' VPN) from having those IP routed around VPN -- such rules appear to be just ignored. I've read, searched and tried every config modification I can find; no luck. All IPs for devices are static IPs on the same 192.168.1.X network but they all just use the tunnel.

Any idea of what to observe or what config to check or change would be appreciated. Thanks!

Intent:
Run the entire local 192.168.1.X net through the PIA VPN -- except a few specific static IP devices.

Network:
ISP - (108.x.x.x) - ISP ADSLmodem - (108.x.x.x) - SG-2440 - (172.28.x.x) - Router/SW - 192.1681.X local net
SG-2440 is at 2.3.2.p1, no added packages

Gateways:
DSLGW(default) / WAN / 108.x.x.x / 108.x.x.x / ADSL Gateway
PIAVPN_VPNV4 / WAN / 10.64.10.5 / 10.64.10.5 / Interface PIAVPN_VPNV4 (the 10.x.x.x appears dynamic)
PIAVPN_VPNV6 / WAN / <blank> / <blank> / Interface PIAVPN_VPNV4

Interfaces:
Existing defaults: WAN, LAN
Deleted: OPT2 (unused)
Renamed OPT1:  Enable[X] / Name: PIAVPN / Network port: ovpnc1(PIA openVPN)

Firewall:
NAT:
Existing: (6) WAN Mappings
Copied: (6) and rename Interface: PIAVPN

Aliases:
Roku / 192.168.1.209
VPNPath / 192.168.1.200-208 range

Rules: WAN: (only existing block private and bogon)
Rules: PIAVPN: (no rules)
Rules: OpenVPN: (no rules)

Rules: LAN:
Added: Roku / any port,dest / DSLGW gateway
Added: VPNPath / any port,dest / PIAVPN gateway

Offline thethrow

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #302 on: April 06, 2017, 07:59:19 pm »
While I appreciate the detail of the original PIA VPN tutorial and all of the subsequent contributions, I've not been able to combine all of that into a working VPN + Bypass configuration. PIA VPN works; it's the 'bypass' exception that does not.

Problem:
I've successfully configured PIA VPN and ipecho.net confirms a PIA IP address but something is preventing any Firewall exception Rule I create (to 'bypass' VPN) from having those IP routed around VPN -- such rules appear to be just ignored. I've read, searched and tried every config modification I can find; no luck. All IPs for devices are static IPs on the same 192.168.1.X network but they all just use the tunnel.

Any idea of what to observe or what config to check or change would be appreciated. Thanks!

Intent:
Run the entire local 192.168.1.X net through the PIA VPN -- except a few specific static IP devices.

Network:
ISP - (108.x.x.x) - ISP ADSLmodem - (108.x.x.x) - SG-2440 - (172.28.x.x) - Router/SW - 192.1681.X local net
SG-2440 is at 2.3.2.p1, no added packages

Gateways:
DSLGW(default) / WAN / 108.x.x.x / 108.x.x.x / ADSL Gateway
PIAVPN_VPNV4 / WAN / 10.64.10.5 / 10.64.10.5 / Interface PIAVPN_VPNV4 (the 10.x.x.x appears dynamic)
PIAVPN_VPNV6 / WAN / <blank> / <blank> / Interface PIAVPN_VPNV4

Interfaces:
Existing defaults: WAN, LAN
Deleted: OPT2 (unused)
Renamed OPT1:  Enable[X] / Name: PIAVPN / Network port: ovpnc1(PIA openVPN)

Firewall:
NAT:
Existing: (6) WAN Mappings
Copied: (6) and rename Interface: PIAVPN

Aliases:
Roku / 192.168.1.209
VPNPath / 192.168.1.200-208 range

Rules: LAN:
Added: Roku / any port,dest / DSLGW gateway
Added: VPNPath / any port,dest / PIAVPN gateway

3 things to check:
-See my post above, make the change.
-RE: LAN rules Roku is set at your "source"
-put your alias under Firewall | Aliases | IP

Also may want to try just plugging in the address to the source (e.g. 192.168.1.209 for roku), and not using an alias, just for testing.

Offline bartgrefte

  • Full Member
  • ***
  • Posts: 109
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #303 on: August 30, 2017, 08:06:29 am »
Just now I went through this howto to set up a virtualized pfSense as VPN client. Since I do not want all traffic to go through VPN, just one or two specific programs, I figured I'd set up a virtual pc with pfSense and Squid and set the programs in question to connect to Squid so that the traffic goes through pfSense and it's VPN client.

I got a bit confused at the compression setting, there is nothing to check, instead there's a drop down menu with 5 options, I set it to "enabled with adaptive compression". Not sure if it's the right choice though...

Plus option "Auth digest algorithm" is not listed in the howto, I left the default setting as it was, SHA1 (160-bit)

After finishing following the howto, I ended up with "reconnecting; tls-error" as status and this in the log:
Quote
Aug 30 14:25:40    openvpn    26470    TLS: Initial packet from [AF_INET]46.166.137.250:1194, sid=95cdf14a 8a04e2c6
Aug 30 14:25:40    openvpn    26470    VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=US, ST=OH, L=Columbus, O=Private Internet Access, CN=Private Internet Access CA, emailAddress=secure@privateinternetaccess.com
Aug 30 14:25:40    openvpn    26470    OpenSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Aug 30 14:25:40    openvpn    26470    TLS_ERROR: BIO read tls_read_plaintext error
Aug 30 14:25:40    openvpn    26470    TLS Error: TLS object -> incoming plaintext read error
Aug 30 14:25:40    openvpn    26470    TLS Error: TLS handshake failed
Aug 30 14:25:40    openvpn    26470    TCP/UDP: Closing socket
Aug 30 14:25:40    openvpn    26470    SIGUSR1[soft,tls-error] received, process restarting
Aug 30 14:25:40    openvpn    26470    Restart pause, 2 second(s)
I solved that by changing the port from 1194 to 1198 and the encryption algorithm from BF-CBC (128-bit) to AES-128-CBC (for standard certificates), see https://www.privateinternetaccess.com/forum/discussion/comment/42294/#Comment_42294 for more info.

After that, the VPN showed as "up", so I accessed pfSense's console and ran both
Code: [Select]
curl -s checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//' and
Code: [Select]
curl ipinfo.io/ipBoth show an IP-address that's not my public IPv4-address issued by my ISP, nor the private address issued by my router to pfSense's WAN-interface, so I guess its working :)

I have some questions though.
- Should I disable IPv6 on pfSense? Since PIA doesn't seem to support it.
- As for the NAT-rules part of the howto, I doubled all the rules while setting the VPN as interface as instructed. Since there are now rules for two outbound interfaces, how will I know if the traffic always goes through the VPN?

Offline DaveB

  • Newbie
  • *
  • Posts: 12
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #304 on: August 31, 2017, 06:14:24 am »
While I appreciate the detail of the original PIA VPN tutorial and all of the subsequent contributions, I've not been able to combine all of that into a working VPN + Bypass configuration. PIA VPN works; it's the 'bypass' exception that does not.

Problem:
I've successfully configured PIA VPN and ipecho.net confirms a PIA IP address but something is preventing any Firewall exception Rule I create (to 'bypass' VPN) from having those IP routed around VPN -- such rules appear to be just ignored. I've read, searched and tried every config modification I can find; no luck. All IPs for devices are static IPs on the same 192.168.1.X network but they all just use the tunnel.

Any idea of what to observe or what config to check or change would be appreciated. Thanks!

Intent:
Run the entire local 192.168.1.X net through the PIA VPN -- except a few specific static IP devices.

Network:
ISP - (108.x.x.x) - ISP ADSLmodem - (108.x.x.x) - SG-2440 - (172.28.x.x) - Router/SW - 192.1681.X local net
SG-2440 is at 2.3.2.p1, no added packages

Gateways:
DSLGW(default) / WAN / 108.x.x.x / 108.x.x.x / ADSL Gateway
PIAVPN_VPNV4 / WAN / 10.64.10.5 / 10.64.10.5 / Interface PIAVPN_VPNV4 (the 10.x.x.x appears dynamic)
PIAVPN_VPNV6 / WAN / <blank> / <blank> / Interface PIAVPN_VPNV4

Interfaces:
Existing defaults: WAN, LAN
Deleted: OPT2 (unused)
Renamed OPT1:  Enable[X] / Name: PIAVPN / Network port: ovpnc1(PIA openVPN)

Firewall:
NAT:
Existing: (6) WAN Mappings
Copied: (6) and rename Interface: PIAVPN

Aliases:
Roku / 192.168.1.209
VPNPath / 192.168.1.200-208 range

Rules: WAN: (only existing block private and bogon)
Rules: PIAVPN: (no rules)
Rules: OpenVPN: (no rules)

Rules: LAN:
Added: Roku / any port,dest / DSLGW gateway
Added: VPNPath / any port,dest / PIAVPN gateway


Hi

Just been struggling with a similar problem and concluded that it was my settings under Firewall/NAT/Outbound - Manual Outbound that were wrong. I had overwritten the existing rules with my VPN rules rather than duplicating and then modifying.

Copy of Rules that sorted it for me is shown below.
Hope you can get it sorted.

Offline Finger79

  • Full Member
  • ***
  • Posts: 195
  • Karma: +18/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #305 on: August 31, 2017, 07:15:33 am »
I don't think the ISAKMP/500 rules need to be created for the VPN.  Just the two (localhost to VPN and LAN to VPN).  They can be safely removed.
« Last Edit: August 31, 2017, 07:26:50 am by Finger79 »

Offline fnkngrv

  • Newbie
  • *
  • Posts: 4
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #306 on: October 23, 2017, 01:19:20 am »
I followed the PIA guide on their support page completely however it didn't work.  For grins I went in and saw that there was a system update.  I was on 2.3.4 and 2.4 released on Oct 10th.  I have no clue if the update resolved some type of internal software issue however after going back in and having to redo the configs it is now working.  Just figured that I would share for anyone that might be running into issues recently.  Thanks for the tutorial.  I will need to come back to it again for setting up a machine or two to skip using it.

On a sidenote I had followed Mark Furneaux's PFSense guide videos and had hardcoded a dozen or so DNS servers.  Would it be advisable that I have my PIA VPN up and running to remove those?
« Last Edit: October 23, 2017, 01:22:46 am by fnkngrv »

Offline Finger79

  • Full Member
  • ***
  • Posts: 195
  • Karma: +18/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #307 on: October 23, 2017, 07:02:51 am »
On a sidenote I had followed Mark Furneaux's PFSense guide videos and had hardcoded a dozen or so DNS servers.  Would it be advisable that I have my PIA VPN up and running to remove those?
Are you using Unbound as a DNS Resolver or the old school dnsmasq for DNS Forwarding?  You can have your cake and eat it too.  Meaning, you can have all your clients' DNS queries get routed over the VPN, but the pfSense box itself still needs to be able to do DNS in case the VPN tunnel goes down.

So your list would be something like:

127.0.0.1 (this is there by default, no need to manually add)
DNS 1
DNS 2
DNS 3
etc.

This way for PIA you don't have to hardcode the IP address in the OpenVPN client configuration page.  You can actually do the FQDN us-florida.privateinternetaccess.com (or whatever).

Offline gtj

  • Jr. Member
  • **
  • Posts: 25
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #308 on: November 10, 2017, 06:42:48 am »
This is an excellent tutorial and in great detail.
I have set the PIA client successfully however I have also set an OpenVPN sewrver for remote access and these 2 don't seem to work together. I have to disable the server to have the PIA Client encrypting traffic while if I want to connect to my LAN from a remote location, I have to disable the PIA client.

Can anyone please advise what rules should anyone use in order to have both OpenVPN instances running at the same time?

Any help woul;d be much appreciated.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10257
  • Karma: +1176/-313
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #309 on: November 10, 2017, 02:41:32 pm »
They are completely separate. Just use a separate tunnel network for the Remote Access OpenVPN.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline gtj

  • Jr. Member
  • **
  • Posts: 25
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #310 on: November 10, 2017, 02:48:15 pm »
They are completely separate. Just use a separate tunnel network for the Remote Access OpenVPN.

Does this mean I have to choose under Firewall - Rules - OpenVPN Server a different gateway for the server? (''clean'' WAN instead of the PIA gateway)

Thanks!
« Last Edit: November 10, 2017, 03:46:43 pm by gtj »

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10257
  • Karma: +1176/-313
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #311 on: November 11, 2017, 09:43:56 am »
You need to select the interface you expect the connections from the client to arrive on. That is probably WAN and not PIA.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline gtj

  • Jr. Member
  • **
  • Posts: 25
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #312 on: November 11, 2017, 12:13:15 pm »
You need to select the interface you expect the connections from the client to arrive on. That is probably WAN and not PIA.

Still can't set it right. When a client is connected to the OpenVPN server, my PIA connection is either slow or down. I have to disable the server to get my connection back.

Do I have to create a rule for both OpenVPN and PIA interfaces or just for OpenVPN? Currently under Firewall ---> Rules ---> PIA there aren't any rules set at all.

I have created a rule for the OpenVPN interface to look like the one below:

Interface: LAN (''Bridge'' in my case as I have bridged 2 NICs to act as one)
Address Family: IPv4
Protocol: TCP/UDP
Source:Any
Destination: Any
Destination Port Range: 1194

Advanced Options -->  "Gateway"---> WAN

I apply the above but still don't see any difference.
« Last Edit: November 11, 2017, 12:50:10 pm by gtj »

Offline gtj

  • Jr. Member
  • **
  • Posts: 25
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #313 on: November 12, 2017, 08:04:02 am »
Anyone that can actually help with the problem above? It will be much appreciated.

I did the following:

-I have created separate interfaces for both my PIAVPN and OpenVPN Server.

-Under NAT, I generated the default WAN ''Outbound'' values for both PIAVPN (client) & OpenVPN Server

-Created a WAN rule which allows TCP/UDP traffic to port 1194 and have selected under ''Advanced Settings'' ----> ''Gateway'' the WAN_DHCP instead of the ''Default'' I then duplicated that rule to be present under ''LAN'' as well as under ''Bridge'' tab as I have bridged the 2 NICs of my APU2C4 to act as one LAN.

-There are no rules at all under the tabs ''OpenVPN'', ''LAN2'', ''OPENVPN'', ''BR0''.
At the moment, rules are set only for ''WAN'', ''LAN'' and ''Bridge''.

On the pfSense dashboard the available interfaces are all being shown as active:

WAN         ---- up        (ip assigned)
LAN          ---- n/a
LAN2        ---- n/a
PIAVPN     ---- up        (ip assigned)
OpenVPN  ---- up        (ip assigned)
BR0          ---- up        (ip assigned)

What am I missing?
« Last Edit: November 12, 2017, 08:34:45 am by gtj »

Offline Haze028

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #314 on: December 02, 2017, 12:01:34 pm »
I've followed a few different guides, and googled for quite a while and can't seem to get my connection to work properly. 
My mappings are set:




pfSense shows openVPN as connected, and my VPN interface has an IP assigned to it.  Everything looks like it should be good




I have two LAN firewall rules to specify which computers use the vpn and which don't:



I am unable to access the internet when OpenVPN is connected from a VPN_Users aliased computer.
I am able to ping fine from this computer ex. www.google.ca, but when I try to load a page Firefox just sits saying "Preforming TLS Handshake with.." and never loads. As soon as I shut down OpenVPN service, internet works as normal


I've tried looking at the log, but see no mention of an error.




 I'm assuming this is related to my firewall not being configured properly and blocking the access.  I just don't know what I'm missing.

Any Suggestions?