The pfSense Store

Author Topic: Tutorial: Configuring pfSense as VPN client to Private Internet Access  (Read 184087 times)

0 Members and 1 Guest are viewing this topic.

Offline Finger79

  • Full Member
  • ***
  • Posts: 193
  • Karma: +18/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #315 on: December 04, 2017, 02:50:23 am »
@Haze028, I noticed your LAN network is 150.160.170.0/24, which is a public IP range.  If you haven't purchased or otherwise own this block of IPs, you should stick with private IP ranges.

Offline bcruze

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +1/-0
    • View Profile

Offline bcruze

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #317 on: December 20, 2017, 11:01:37 am »
i've followed the instructions above and now i am getting several events in the logs

WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1542'

WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.

seems like several red flags.  what is everyone's opinion on this?

Offline Finger79

  • Full Member
  • ***
  • Posts: 193
  • Karma: +18/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #318 on: December 21, 2017, 06:15:28 pm »
i've followed the instructions above and now i am getting several events in the logs

WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1542'

WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.

seems like several red flags.  what is everyone's opinion on this?

I get the 'link-mtu' warnings as well.  The Blowfish/SWEET32 warning is because PIA can't competently maintain their systems (and I'm a customer!) and still defaults to BF-CBC instead of at least AES-128-CBC.  They really should be using the latest OpenVPN 2.4.4 with NCP support.  As much as I like PIA, they can be a real frustrating PI[T]A....

As long as you (the client endpoint) have your config set to use AES-128-CBC or AES-256-CBC, it'll override the server settings, so don't worry about that warning.

Offline Dave R

  • Newbie
  • *
  • Posts: 16
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #319 on: January 03, 2018, 09:49:02 am »
Thanks for the guide. I was able to get this configured in about an hour or so. There are a couple of things to note:

1) OpenVPN server port numbers are different for PIA depending if you use a sha256 or sha128 cert: https://www.privateinternetaccess.com/forum/discussion/21213/sha256-with-openvpn

2) I didn't want my Steam gaming traffic going over the VPN (ports 27000-27015,...) so I used a NAT Alias to create a list of ports to apply to the outbound NAT rule.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #320 on: January 03, 2018, 11:45:37 am »
That's great but outbound NAT rules have nothing to do with what traffic goes out which interface. They only dictate what NAT occurs when traffic is already routed out that interface by policy routing or the routing table.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Dave R

  • Newbie
  • *
  • Posts: 16
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #321 on: January 03, 2018, 12:23:18 pm »
Hrm, makes sense I guess. Got a link to something explaining how to route 80/443/53 over the VPN interface while leaving all other traffic egressing the WAN ?

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #322 on: January 03, 2018, 12:26:33 pm »
Just check don't pull routes in the OpenVPN Client configuration then policy route those destination ports to the VPN Gateway followed by pass any without setting a gateway.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Dave R

  • Newbie
  • *
  • Posts: 16
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #323 on: January 03, 2018, 01:13:38 pm »
Ah, I think that works but only if I specify the VPN gateway in the LAN pass rule (under Advanced).  You mention "pass any without setting a gateway." but where else would I specify the VPN gateway for those ports?
« Last Edit: January 03, 2018, 01:49:25 pm by Dave R »

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #324 on: January 03, 2018, 02:06:47 pm »
You policy route using firewall rules as you already stated. So you make a rule specifying those destination ports and the desired gateway/gateway group.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Dave R

  • Newbie
  • *
  • Posts: 16
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #325 on: January 03, 2018, 03:26:07 pm »
Thanks. Netflix won't work going over the vpn interface so I've created a hosts Alias containing the IP ranges for AS2906 (netflix) and created a second rule on the LAN to route the Netflix alias destinations over the WAN interface instead of the VPN interface. It doesn't seem to pick up the change though. I've reset under 'diagnostics > states > reset states' but the rule doesn't seem to be working. Tcpdump on the vpn interface shows the Aliased IP addresses still going over that interface. 

The docs say "first match wins" so if I have the Netflix rule at the top, and the VPN rule after that this should be working, correct? I'm assuming I'm missing some IP addresses Netflix is using but want to make sure I understand the rule ordering.
« Last Edit: January 03, 2018, 03:30:32 pm by Dave R »

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #326 on: January 03, 2018, 03:44:18 pm »
Post your rules then. I guarantee if the alias contains the required destinations and the rules are done correctly, it works.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Dave R

  • Newbie
  • *
  • Posts: 16
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #327 on: January 03, 2018, 04:54:33 pm »
The rules are working, I think I'm just missing IP ranges. I'm using tcpdump on the PFsense box to see what's egressing the vpn interface. Even after adding a new range, I'll reload Netflix in my web browser and tcpdump shows it still hitting that IP on the vpn. If I wait a minute or so, then it seems to pick it up. Are rule changes only applied to new connections?

Offline bcruze

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #328 on: January 03, 2018, 05:07:53 pm »
this works for me

180 is the static ip address of my tv
« Last Edit: January 03, 2018, 05:33:42 pm by bcruze »

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #329 on: January 03, 2018, 07:38:24 pm »
Yes, it is often easier to just exclude everything from the device from egressing the VPN than try to match every destination address and port for something like netflix.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM