pfsense 2.0.1 OpenVPN Configuration Guide

guide in OP updated for pfsense 2.1 beta 1. This is for an OpenVPN Server with connecting individual client PC's. Will do a site to site guide shortly.
 
I'm using this as a base to get started. I'm running into some issues, I'll post back later after I've worked them out. Appreciate you creating the thread.
 
Hi guys,

I've been going through this howto but I'm still struggeling a bit. I'm running pfsense 2.1 beta1 (due to the onboard NIC too new for stable release).

After everything is set up, I try to connect from my iOS device (iPhone 5) but immediately I'm disconnected. In the logs on the iPhone I get the message saying "tun_builder_error: ifconfig addresses are not in the same /30 subnet".

From the server log:

Mar 28 22:54:20 openvpn[80992]: 2.150.16.120:3829 WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'
Mar 28 22:54:20 openvpn[80992]: 2.150.16.120:3829 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1590', remote='link-mtu 1558'
Mar 28 22:54:20 openvpn[80992]: 2.150.16.120:3829 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
Mar 28 22:54:23 openvpn[80992]: 2.150.16.120:3838 WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'
Mar 28 22:54:23 openvpn[80992]: 2.150.16.120:3838 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1590', remote='link-mtu 1558'
Mar 28 22:54:23 openvpn[80992]: 2.150.16.120:3838 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'

I then added the line

push "topology subnet"

to /var/etc/opencpn/server1.conf

And then restarted the OpenVNP service.

This gets me a bit further. I'm successfully connected, but I can't reach anything on the network. The logfile on the iPhone is filled with "tun write error: cannot identify IP version for prefix"-messages.

On the server side I get this:

Mar 28 22:59:02 openvpn[96364]: 2.150.16.120:3839 WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'
Mar 28 22:59:02 openvpn[96364]: 2.150.16.120:3839 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1590', remote='link-mtu 1558'
Mar 28 22:59:02 openvpn[96364]: 2.150.16.120:3839 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
Mar 28 22:59:02 openvpn[96364]: 2.150.16.120:3839 [rsivertsen] Peer Connection Initiated with [AF_INET]2.150.16.120:3839
Mar 28 22:59:02 openvpn[96364]: user_cert/2.150.16.120:3839 MULTI_sva: pool returned IPv4=10.0.1.91, IPv6=(Not enabled)
Mar 28 22:59:03 openvpn[96364]: user_cert/2.150.16.120:3839 send_push_reply(): safe_cap=940

Any suggestions?

Thanks,
Ibux
 
The first problem I see is:

Mar 28 22:54:20 openvpn[80992]: 2.150.16.120:3829 WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'

Sounds like your phone is using tap, but you have the openvpn server set to tun. The guide I have posted as of right now is set for tap/bridging. I'm unfamiliar with the iphone client. I'm not sure how much I can help. Can you open its ovpn config file?

EDIT:

Again reading your logs from the OpenVPN server:

Mar 28 22:59:02 openvpn[96364]: 2.150.16.120:3839 WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'

Sounds like locally your openvpn server is set to TAP whereas your client is set to tun.

There seems to be a mismatch overall with the configs on the server and the client in both scenarios.

----------------

Honest question for the sake of the guide... Was I not clear enough in the difference between tap and tun?
 
Hi,

thanks for replying. You were very clear on the difference between tap and tun. I used tap on the server side, and thought that when exporting the OpenVPN connect file and importing it to the iPhone it would use tap as well.

However I just discovered that the iOS app doesn't support "dev tap" and "tls remote". So apparently I have to change from tap to tun on the server side to get this up and running. I'll try it out and see what happens.

Thanks,
Ibux
 
Hi again,

I changed the OpenVPN server to use tun instead. Exported the settings to the iPhone and allowed the tunnel network access to my LAN. And voilá, it works :)

Best regards,
Ibux
 
Any idea why my openvpn connection would establish and be fine (able to ping both directions) until it's in actual use (such as windows folder viewing, etc..) then it will stop responding for 1-6 minutes then come back for pings
 
shaggyspfld said:
Any idea why my openvpn connection would establish and be fine (able to ping both directions) until it's in actual use (such as windows folder viewing, etc..) then it will stop responding for 1-6 minutes then come back for pings
Click to expand...

Hey shaggy,

Two things come to mind. First thing is actual connectivity to your wan by the VPN client. If you ping your wan interface from the remote client do you get the dame behavior?

Second is multiple clients connecting using the same user certs. For instance I decommissioned one of our users laptops and copied their profile over to their new one. Some months later I repurposed that old laptop. It started to automatically connect to VPN again and was disrupting the connection on the user's connection to VPN similar to what you're describing.

There is two ways to circumvent this. First obviously create different certs for every device. Second there is an option to check to allow multiple connections.

If neither of these turn out to be it, please post your ovpn server and client logs.
 
Hey, thanks for the guide. I'm running pfSense 2.0.3. It seems a few things have changed since 2.0.1. Anyway, I'm trying to connect to the VPN from my Android phone using OpenVPN Connect. I imported the profile and all, but the VPN times out when I try to connect. Here are the OpenVPN logs from pfSense:

May 13 00:03:03 openvpn[27781]: event_wait : Interrupted system call (code=4)
May 13 00:03:03 openvpn[27781]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1589 192.168.2.1 255.255.255.0 init
May 13 00:03:03 openvpn[27781]: SIGTERM[hard,] received, process exiting
May 13 00:03:04 openvpn[58399]: OpenVPN 2.2.2 amd64-portbld-freebsd8.1 [SSL] [LZO2] [eurephia] built on Apr 2 2013
May 13 00:03:04 openvpn[58399]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 13 00:03:04 openvpn[58399]: Initializing OpenSSL support for engine 'cryptodev'
May 13 00:03:04 openvpn[58399]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
May 13 00:03:04 openvpn[58399]: TUN/TAP device /dev/tap1 opened
May 13 00:03:04 openvpn[58399]: /sbin/ifconfig ovpns1 192.168.1.201 netmask 255.255.255.248 mtu 1500 up
May 13 00:03:04 openvpn[58399]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1589 192.168.1.201 255.255.255.248 init
May 13 00:03:04 openvpn[59688]: UDPv4 link local (bound): 98.114.95.176:1194
May 13 00:03:04 openvpn[59688]: UDPv4 link remote: [undef]
May 13 00:03:04 openvpn[59688]: Initialization Sequence Completed

Any ideas?
 
I don't have much experience with the android client. However from just looking at your log on my phone I don't see anything wrong. Your instance of openvpn starts up with what looks like no issue. What I don't see is a line in there that mentions an incoming connection which would make sense because you said it timed out.

Firstly I would check the client logs on the android device. I don't know exactly where they are located though.
Secondly I would check pfsense's firewall logs and state log. Since its timing out in willing to bet the connection is dropping somewhere along the line.
 
Also. To eliminate any unknowns test this on a PC first. Lets get it working there, then we can address if ots the android or not that is the problem.
 
Good call on the client logs. I found the issue. I forgot to disable dynamic DNS on my FiOS router when I turned up pfSense. Sooo... the last update dyndns got was from the fios router and it's WAN address which is now private. Fixed that and all is good. Thanks!
 
So i assume you went the easy route (like me when i had an actiontek) and just doublt NAT'd your fios router and the set top boxes right along with it.

Good choice
 
Hey all.

I followed the instructions in this thread as best I could (seems some settings are missing / not there) and I have got it all connected.

BUT
I cannot browse / access my local LAN at all?
so I connect to the VPN. it is successful but I cannot access the Local LAN at my house where I am VPNing to.

Any ideas?
 
hmm just noticed that the new vpn adapter doesn't have a default gateway..could be the reason why?!

my server (2008r2) currently performs the dhcp and dns for the network at home.

Does this affect how my clients can VPN in?
 
Deadringers said:
Hey all.

I followed the instructions in this thread as best I could (seems some settings are missing / not there) and I have got it all connected.

BUT
I cannot browse / access my local LAN at all?
so I connect to the VPN. it is successful but I cannot access the Local LAN at my house where I am VPNing to.

Any ideas?
Click to expand...

specifically, what settings are missing? screenshot the openvpn server page and post it.
 
jadams said:
specifically, what settings are missing? screenshot the openvpn server page and post it.
Click to expand...

e.g. the tunnel network needs to be configured for me - I selected tap further up but it's still asking for a tunnel network.

WuuqoP9.png


LKXarMP.png
 
what version are you on?

check your packages for the openvpn tap fix.

if you're doing tap mode, specifying a tunnel network is contradictory
 
hey thanks for that - I installed the fix and it's just like yours now.

However my machine is still not picking up the default gateway?

worth mentioning that my pfsense box doesn't do DHCP for the LAN my server does.
 
Using a separate DHCP server is a little outside the scope of this guide. I'd have to go back through the lab and see whats up with using one.

For the sake of troubleshooting setup a scope in the openvpn server setup for clients to use.

EDIT: make sure it doesnt overlap the scope your primary dhcp server is using.
 
hmm I tried that and my DHCP scope currently covers 0.2 - 0.99

I added a new scope with the pfsense box and it does give it what ever address I have given it but still no gateway and I cannot even ping any part of the LAN. :(
 
Deadringers said:
Laptop running windows 7 64bit
Click to expand...

And the vpn interface does pick up an ip address and sn mask? Can you post an ipconfig output.

I'm not certain that it does get a gateway. I cant remember off the top of my head now. I wnot be able to check on this until later tonite.
 
There you go mate - thanks for the help btw.



Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . : nansoz.com
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-F4-6F-07-51
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::c894:72c2:fa27:b8ce%28(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 14 May 2013 17:30:45
Lease Expires . . . . . . . . . . : 14 May 2014 17:30:45
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 192.168.0.0
DHCPv6 IAID . . . . . . . . . . . : 469827572
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-FD-FF-29-F0-BF-97-DE-3A-34

DNS Servers . . . . . . . . . . . : 192.168.0.198
NetBIOS over Tcpip. . . . . . . . : Enabled
Click to expand...
 
Right update to this!

I HAVE GOT IT WORKING!

however...

The VPN is not used for any internet communication's and just for access to the LAN?

I'd quite like for all my traffic to go through the VPN and then to where ever it needs to go.

Any ideas on this?
 
So you want your remote client to route its internet traffic through the pfsense's internet connection?

There is a checkbox that mentions routing all traffic through the gateway on the server config page.

Curious though, what solved your initial problem?
 
jadams said:
So you want your remote client to route its internet traffic through the pfsense's internet connection?

There is a checkbox that mentions routing all traffic through the gateway on the server config page.

Curious though, what solved your initial problem?
Click to expand...


Thanks yea I got it working now properly :)

I think I hadn't setup the right rules to allow traffic from Open VPN to the WAN etc etc.

Also I checked that box and it's working a treat now.

Thanks!
 
Just a quick one...

Can I bump up the DH group to 2048 and just export the config again?

or should it just work?

Thanks :)
 
right I got no idea what is happening here....

So today I am here in the office with the VPN connected.

However now it's telling me it an "unknown network" and I cannot access any of my LAN resources.

It connects up fine just doesn't pass any traffic through!?

What could have happened...no config has changed.
 
Okay no idea what is happening here...

I connected with my old VPN (server 2008r2 insecure VPN) and then connected back with the new one...
it suddenly picked up the domain and is now all working.

This open VPN is flaky as best :(
 
Deadringers said:
This open VPN is flaky as best :(
Click to expand...

Something tells me the issue here is not with OpenVPN. Lots of people on this forum swear by it. I have several remote employees that run this to connect to the office 24/7. OpenVPN works wonders.

I work with alot of VPN software at my job connecting to all of different customer's sites. I run into issues all the time with DNS cache when disconnecting from their VPN. You're running more than one type of vpn on your machine? I'd start there.
 
Followed this to a T and still can't ping the LAN interface IP or any devices on my home network.

I connect and authenticate just fine though.

Pull a DHCP IP and subnet.

Gateway is blank.

Code: 
Wed Jun 12 14:51:49 2013 SIGHUP[hard,] received, process restarting
Wed Jun 12 14:51:49 2013 DEPRECATED OPTION: --tls-remote, please update your configuration
Wed Jun 12 14:51:49 2013 OpenVPN 2.3.1 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Mar 28 2013
Wed Jun 12 14:51:51 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jun 12 14:51:51 2013 Control Channel Authentication: using 'pfsense-udp-1194-saedrin-tls.key' as a OpenVPN static key file
Wed Jun 12 14:51:51 2013 UDPv4 link local (bound): [undef]
Wed Jun 12 14:51:51 2013 UDPv4 link remote: [AF_INET]67.175.159.234:1194
Wed Jun 12 14:51:52 2013 [pfSense] Peer Connection Initiated with [AF_INET]67.175.159.234:1194
Wed Jun 12 14:51:54 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 12 14:51:54 2013 open_tun, tt->ipv6=0
Wed Jun 12 14:51:54 2013 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{8881E8A9-147C-4754-9C9C-97A60CABCF30}.tap
Wed Jun 12 14:51:54 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.0.151/255.255.0.0 on interface {8881E8A9-147C-4754-9C9C-97A60CABCF30} [DHCP-serv: 192.168.0.0, lease-time: 31536000]
Wed Jun 12 14:51:54 2013 Successful ARP Flush on interface [29] {8881E8A9-147C-4754-9C9C-97A60CABCF30}
Wed Jun 12 14:51:59 2013 Initialization Sequence Completed
 
saedrin said:
Followed this to a T and still can't ping the LAN interface IP or any devices on my home network.

I connect and authenticate just fine though.

Pull a DHCP IP and subnet.

Gateway is blank.

Code: 
Wed Jun 12 14:51:49 2013 SIGHUP[hard,] received, process restarting
Wed Jun 12 14:51:49 2013 DEPRECATED OPTION: --tls-remote, please update your configuration
Wed Jun 12 14:51:49 2013 OpenVPN 2.3.1 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Mar 28 2013
Wed Jun 12 14:51:51 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jun 12 14:51:51 2013 Control Channel Authentication: using 'pfsense-udp-1194-saedrin-tls.key' as a OpenVPN static key file
Wed Jun 12 14:51:51 2013 UDPv4 link local (bound): [undef]
Wed Jun 12 14:51:51 2013 UDPv4 link remote: [AF_INET]67.175.159.234:1194
Wed Jun 12 14:51:52 2013 [pfSense] Peer Connection Initiated with [AF_INET]67.175.159.234:1194
Wed Jun 12 14:51:54 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 12 14:51:54 2013 open_tun, tt->ipv6=0
Wed Jun 12 14:51:54 2013 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{8881E8A9-147C-4754-9C9C-97A60CABCF30}.tap
Wed Jun 12 14:51:54 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.0.151/255.255.0.0 on interface {8881E8A9-147C-4754-9C9C-97A60CABCF30} [DHCP-serv: 192.168.0.0, lease-time: 31536000]
Wed Jun 12 14:51:54 2013 Successful ARP Flush on interface [29] {8881E8A9-147C-4754-9C9C-97A60CABCF30}
Wed Jun 12 14:51:59 2013 Initialization Sequence Completed
Click to expand...

Then you didnt follow it to a T ;) j/k.

What version of pfsense are you running. Not seeing a GW is not a problem. This guide is for TAP, not TUN. If I remember correctly I dont usually see one for my TUN configs either.

Looks like it connects perfectly. Firewall rules, or bridging to the LAN interface is where I'd start. Can you provide screen shots of those?

EDIT: I thought your name was familiar. You're Mr. Beastmode from the BF3 thread. I enjoy your videos!
 
jadams said:
Then you didnt follow it to a T ;) j/k.

What version of pfsense are you running. Not seeing a GW is not a problem. This guide is for TAP, not TUN. If I remember correctly I dont usually see one for my TUN configs either.

Looks like it connects perfectly. Firewall rules, or bridging to the LAN interface is where I'd start. Can you provide screen shots of those?
Click to expand...

2.0.3 Release.

Let me take some screens..

fwwan_zpse666db3f.jpg


fwlan_zpse71d0a5b.jpg


fwopt1_zps8ab329ec.jpg


fwopenvpn_zps6f38a3f7.jpg


int_zpsfdc90b30.jpg


bridge_zps34b4e47e.jpg
 
Only that first picture loaded. The other photobucket is failing on. But so far that firewall rule on the WAN looks good. Comparing it to my setup.
 
saedrin said:
2.0.3 Release.

Let me take some screens..

fwwan_zpse666db3f.jpg


fwlan_zpse71d0a5b.jpg


fwopt1_zps8ab329ec.jpg


fwopenvpn_zps6f38a3f7.jpg


int_zpsfdc90b30.jpg


bridge_zps34b4e47e.jpg
Click to expand...

Everything matches mine.

Goto Status ---> OpenVPN, whats it say while connected. Refresh a few times as well, make sure nothing changes.

Check the firewall logs Status ----> System logs. Filter the firewall logs for the public IP of the remote client connected. Check the OpenVPN tab for anything.

Post whatever you have.
 
You must log in or register to reply here.
Back
Top