Welcome, Guest. Please login or register. Did you miss your activation email?

pfSense Forum pfSense English Support OpenVPN OpenVPN on pfSense Installation guide for (Windows) Dummies :-) (road-warrior)

Username: Password:
Forever
Searc h

Login

Home

Help

Search

Login

Register

Company Formation HK PRC HK & worldwide company formations Better than load balancer Compare true broadband bonding to other load balancers. VPN Services -US Trusted Name for VPN Services. Get Unrestricted Access Now! www.VPNgates.com

www.unilink8.com

www.mushroomnetworks.com/bonding

previous next
Pages: [1] 2 3 4 5 Author Go Down
P RIN T

Topic: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warrior) (Read 101379 times)

0 Me m be rs and 1 Gue st are vie wing this topic.

Frewald
Ne wbie O ffline Posts: 16

OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (roadwarrior)

on: Fe bruary 11, 2008, 09:22:28 am

***** January 6, 2010: UPDATE: Below process confirmed working on pfSense1.2.2 Relase with OpenVPN Client 2.1.1 on Windows7 Ultimate 64Bit ***** Having spend most of my day to get OpenVPN running from a Windows Vista machine to a network on a pfSense box, i feel that a guide is needed for my kind; Windows-users not familiar with OpenVPN and alike A guide of how to connect a PC on the internet, to LAN behind a pfSense firewall using OpenVPN also known as a Road-Warrior setup This guide is NOT detailed regarding different configurations, and may not be the best security practices - so use it at your own risk... --First of all you need to have keys and certificates generated in order to configure the pfSense OpenVPN service; 1) Download and install the most recent software from http://openvpn.net/download.html If you plan to connect from a PC with Windows Vista you should get version 2.1 or newer. Use the default options 2) Start a command prompt with administrator-rights! This is done in Vista by clicking on START and then type CMD -> CMD.EXE should appear, and you RIGHT-Click on it and select 'Run as Administrator' 3) Change directory to c:\programfiles\openvpn\easy-rsa 4) run the "init-config.bat" file 5) Edit 'vars.bat' file. I suggest using 'Wordpad' and to be able to save the file again, you need to start Wordpad in the same manner as the command-prompt (see #2)

Wordpad in the same manner as the command-prompt (see #2) The following things need to be edited: "set KEY_COUNTRY=DK" 2 Letters country ID - I use DK for Denmark "set KEY_PROVINCE=na" 2 Letters Province ID - I use na as in 'Not Applicable' "set KEY_CITY=Copenhagen" Name of city set KEY_ORG=Frewald Name of your company set KEY_EMAIL=youremail@address.com Put an email-address here. Dont use you private address, since this is the common address for the Certificate Authority (or something...) Save the file 6) Run "vars.bat" 7) Run "clean-all.bat" Run "build-ca.bat" Then you are prompted for some different things; Leave them at default, except "Common Name" - put something like "pfSense-CA" 9) Run "build-key-server.bat server" Again you are prompted; leave them on default except "Common Name" - use "server" 10) Run build-dh.bat --Now its time to generate keys and certificates for the client(s) --11) Run "build-key.bat ovpn_client1" Again you are prompted; leave them on default except "Common Name" - here you should put in "ovpn_client1" (or whatever you have called it) The ovpn_client1 will be the name of the keys, certificate and the name you identify the connection on later. You can use whatever name you like, and generate as many as you want (with different names). 12) The following files should now be copied from c:\programfiles\openvpn\ easy-rsa\keys to c:\programfiles\openvpn\config ca.crt ovpn_client1.key ovpn_client1.crt (if you dont see a .crt file but only a .csr file, chances are that you dont have admin priviligies. Worst case generate the keys and certificates on a NONVista machine) 13) Make a file in the c:\programfiles\openvpn\config called "ovpn_client1.ovpn" and the file should contain (leave out the hashes): #### client dev tun proto udp remote 64.233.167.99 1194 ping 10 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert ovpn_client1.crt key ovpn_client1.key ns-cert-type server comp-lzo pull verb 3 ####

#### Please put in your own public IP address of you pfSense-box in the 'remote' line If you have chosen another name than 'ovpn_client1' then change it in the lines beginning with 'cert' and 'key' If you have more than one VPN client, you make one .ovpn-file per client (with the corresponding .key and .crt name) --Now its time to configure pfSense --21) Log into the web-gui of pfSense 22) Select VPN/OpenVPN and ad an entry in the 'server' page Use the following settings: Protocol: UDP Local port: 1194 Address pool: 192.168.200.0/24 (it should be a network that you DONT currently use) Local Network: 192.168.1.0/24 or whatever the network is that you want the VPN client to connect to !!UPDATE: Note to add this value you need to first add the server setting and the EDIT the settings again!! Remote Network: blank Cryptography: BF-CBC (128 bit) - or use what you want Authentication Method: PKI Now you need to have access to some of the files created in c:\programfiles\openvpn\ easy-rsa\keys (mentioned in #12) 23) Copy the WHOLE content of ca.crt into the "CA certificate" window 24) Copy the WHOLE content of server.crt into the "Server Certificate" window 25) Copy the WHOLE content of server.key into the "Server Key" window 26) Copy the WHOLE content of dh1024.pem into the "DH parameters" window 27) Tick DHCP-Opt: Disable NetBIOS (I dont use it anyway) 28) Tick LZO Compression --Now we need a few simple rules in the firewall --31) On the WAN interface you should make a rule that; PASS WAN Protocol: UDP source: any OS type: any Destination: any Destination port range from: OpenVPN Destination port range to: OpenVPN Tick in the LOG Leave the rest at default. 32) and another rule on the interface called LAN (or whatever the name of the net defined in #22 'address pool' is); PASS Any protocol Source: LAN (or whatever the name of the net defined in #22 'address pool' is) Any destination Remember to apply the new rules. Now you should be able to connect from OpenVPN (rightlick on the icon in the try and select Connect). But remember to start OpenVPN with ADMIN RIGHTS! A small trick; If you want a specific client to be able to access more than one subnet, you can add a 'Client Specific Configuration' in pfSense; Find it in the "WebGui/VPN/OpenVPN/Client-Specific configuration", use the Common Name given in #11 (ovpn_client1) and in custom options add the following line push "route 192.168.2.0 255.255.255.0" if thats the subnet that you want to have connection to.

Hope this small guide provides some help to those of us who isn't much into *nix and OpenVPN. There is problably a bunch of typ'O's - please write a comment when you see one that needs to be corrected... This setup is working on my current setup: pfSense 1.2 RC4 now running on 1.2 RELASE OpenVPN 2.1 RC7 Please visit http://openvpn.net/howto.htm for much more indepth info Best regards, Frewald ---Small update: If you later would like to add new clients, run point 2,3,6, and continue from point 11! dont run point 7-8-9-10!!!! Also note you need to do this on the machine that was orignally used to issue the certificates.
Last Edit: January 06, 2010, 08:29:18 am by Frewald Logge d

tacfit
Full Me m be r O ffline Posts: 193

Re: OpenVPN on pfSense - Installation guide for Windows-Dummies :-) (road-warrio

Reply #1 on: Fe bruary 11, 2008, 09:39:44 am

Thanks a lot for this! I'll be trying it out this week. I totally gave up on OpenVPN, solely because I couldn't figure it out in the first 10 minutes.
Logge d

Garf
Ne wbie O ffline Posts: 15

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #2 on: March 03, 2008, 05:41:08 am

This make the thing a hole lote easier. This thread should be Sticky.

Logge d

hoba
Adm inistrator He ro Me m be r O ffline Posts: 5844

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #3 on: March 03, 2008, 09:26:51 am

Thanks a lot for posting this!

W hat was the proble m to this solution again?

Logge d

BerSerK
Jr. Me m be r O ffline

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #4 on: March 04, 2008, 12:59:19 pm

O ffline Posts: 42

thanks, great tutorial!

Logge d

jahonix
He ro Me m be r O ffline Posts: 828

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #5 on: March 11, 2008, 09:21:01 am

Thanks alot for this tutorial, Frewald! Didn't have time to look into OpenVPN at all. Just followed your tutorial the evening before leaving for holidays and now I'm relaxed, enjoying the kids in the pool and keeping an eye on the mails in the office. Again, thanks for my very relaxed week!
Logge d

Chris
The ore tically, the ory and practis should be the sam e . Practically the y are n't.

mantissa
Ne wbie O ffline Posts: 5

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #6 on: March 13, 2008, 06:02:11 am

Hi Frewald, These instructions were beautifully easy! Got me up and running in no time! Kudos, Mantissa
Logge d

PredatoryFern
Ne wbie O ffline Posts: 1

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #7 on: March 22, 2008, 11:20:02 am

Hey Frewald, Excellent tutorial. Any objections to me taking (some or all of) this and adding it to the wiki?
Logge d

Rusty64bit
Jr. Me m be r O ffline Posts: 59

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #8 on: April 16, 2008, 05:16:09 pm

Frewald, you are the champ ! Thanks a lot for this "HowTo" I love pfsense.
Logge d Microsoft give s you "W indows" O pe nsource give s you the whole house

tacfit
Full Me m be r O ffline

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #9 on: April 17, 2008, 07:08:10 am

O ffline Posts: 193

Yeah, this is great.

Logge d

Frewald
Ne wbie

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #10 on: April 21, 2008, 10:02:56 pm

O ffline Posts: 16

Quote from: PredatoryFern on March 22, 2008, 11:20:02 am

He y Fre wald, Ex ce lle nt tutorial. Any obje ctions to m e tak ing (som e or all of) this and adding it to the wik i?

Great to hear that people like it - and feel free to post all or parts of it to the Wiki - as long as it helps ppl
Logge d

Wasca
Jr. Me m be r O ffline Posts: 77

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #11 on: April 22, 2008, 04:57:00 am

Could you please add to this sticky that if your using an OPT interface as your WAN2 that you should use TCP and not UDP for the protocol, this got me stummped until I dug deep on a thread that just mentioned it.
Logge d

GruensFroeschli
Global Mode rator He ro Me m be r O ffline Posts: 4716

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #12 on: April 22, 2008, 05:23:23 am

What exactly does not work with UDP? The problem with TCP is: TCP over TCP should generally not be used where it can be avoided. --> http://sites.inka.de/~W1011/devel/tcp-tcp.html

No i will not fix your com pute r! W e do what we m ust, be cause we can.

Logge d

Wasca
Jr. Me m be r O ffline Posts: 77

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #13 on: April 22, 2008, 07:15:39 am

I found this information on this forum page http://forum.pfsense.org/index.php/topic,8297.msg46717.html#msg46717 as soon as I swapped over to using TCP and updated my WAN2 rules to use TCP I could connect to the OpenVPN service on WAN2 (OPT1)
Logge d

rpryor
Ne wbie O ffline Posts: 2

Re: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warr
Reply #14 on: April 22, 2008, 07:32:46 pm

followed this tutorial but can only ping and connect to the pfsense box

protocol: udp locol port: 1194 address pool: 192.168.20.0/27 local network: 192.168.6.0/25 attached two pics are firewall rules results of ipconfig:
Code: C:\Documents and Settings\Administrator>ipconfig Window s IP Configuration

Ethernet adapter Wireless Netw ork Connection: Connection-specific DNS Suffix . : IP Address. . . . . . . . . . . . : 192.168.1.104 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gatew ay . . . . . . . . . : 192.168.1.1 Ethernet adapter TAP-Win32 Adapter V9: Connection-specific DNS Suffix . : IP Address. . . . . . . . . . . . : 192.168.20.6 Subnet Mask . . . . . . . . . . . : 255.255.255.252 Default Gatew ay . . . . . . . . . :

Results of Route Print:

Code: Netw ork Destination Netmask Gatew ay Interface Metric 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.104 25 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 192.168.0.0 255.255.255.0 192.168.0.1 192.168.0.1 20 192.168.0.1 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.0.255 255.255.255.255 192.168.0.1 192.168.0.1 20 192.168.1.0 255.255.255.0 192.168.1.104 192.168.1.104 25 192.168.1.104 255.255.255.255 127.0.0.1 127.0.0.1 25 192.168.1.255 255.255.255.255 192.168.1.104 192.168.1.104 25 192.168.6.0 255.255.255.128 192.168.20.5 192.168.20.6 1 192.168.14.0 255.255.255.0 192.168.20.5 192.168.20.6 1 192.168.20.1 255.255.255.255 192.168.20.5 192.168.20.6 1 192.168.20.4 255.255.255.252 192.168.20.6 192.168.20.6 30 192.168.20.6 255.255.255.255 127.0.0.1 127.0.0.1 30 192.168.20.255 255.255.255.255 192.168.20.6 192.168.20.6 30 192.168.122.0 255.255.255.0 192.168.122.1 192.168.122.1 20 192.168.122.1 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.122.255 255.255.255.255 192.168.122.1 192.168.122.1 20 224.0.0.0 240.0.0.0 192.168.0.1 192.168.0.1 20 224.0.0.0 240.0.0.0 192.168.1.104 192.168.1.104 25 224.0.0.0 240.0.0.0 192.168.20.6 192.168.20.6 30 224.0.0.0 240.0.0.0 192.168.122.1 192.168.122.1 20 255.255.255.255 255.255.255.255 192.168.0.1 192.168.0.1 1 255.255.255.255 255.255.255.255 192.168.1.104 192.168.1.104 1 Go Up 255.255.255.255 255.255.255.255 192.168.1.104 f0008 1 255.255.255.255 255.255.255.255 192.168.1.104 10007 1 255.255.255.255 255.255.255.255 192.168.20.6 192.168.20.6 1 255.255.255.255 255.255.255.255 192.168.122.1 192.168.122.1 1 Default Gatew ay: 192.168.1.1
Jum p to:

Logge d

Pages: [1] 2 3 4 5

P RIN T

previous next

=> OpenVPN

go

ASA5510-K8 1,910 USD New Original Cisco. Sealed in box 1 year warranty. Ship to worldwide www.networksellers.com/ FoxyVPN: US, EU, Asia IPs Unblock Websites, Surf Anonymously 24/7 Support, $5.75/mo www.foxyvpn.com VPN for Military Use $3,75 per month - yearly subscribe US, CA, UK, DE Servers
www.boxpn.com

Powe re d by SMF 1.1.15 | SMF 2011, Sim ple Machine s Page cre ate d in 0.066 se conds with 18 que rie s.