Messages

16

16.7 Legacy Series / Re: Configuring OPNsense as an OpenVPN client to a VPN server

« on: April 10, 2017, 02:00:21 pm »

Hey geofflowemn,

I have created a "HOW TO" on setting up VPN Routing with opnsense, these should be the droids your looking for

https://forum.opnsense.org/index.php?topic=4979.msg19771#msg19771

17

General Discussion / Re: OPNsense and OpenVPN (AirVPN) setup

« on: April 10, 2017, 01:38:52 pm »

Finished writing my "HOW TO" on VPN Routing in Opnsense, Im using AirVPN so this will prob help Nnyan

https://forum.opnsense.org/index.php?topic=4979.0
 

18

Tutorials and FAQs / HOWTO - Routing Traffic over Private VPN

« on: April 10, 2017, 01:34:53 pm »

Hi Guys,

Below is a step by step guide to configuring Opnsense 17.1.4 to route LAN traffic out via your private VPN provider.
(In my case, AirVPN)

I have a setup where I want all computers on my LAN to have a direct connection to the Internet, but "Some" computers I want connected to the VPN *cough torrenting cough *

===================================================================
Step 1:

Get all your certificate information together: (cert files supplied from your private VPN provider)

  - VPN_Provider.ovpn
  - CA.crt (Certificate Athortiy)
  - TA.key (OpenVPN Static key V1)
  - User.crt (User Certificate)
  - User.key (RSA Private Key)

===================================================================
Step 2:

Navigate to System > Trust > Authorities, "add or import CA"

 - Descriptive name: VPNCA
 - Certificate data: (paste the contents of your CA.crt file here)
 - Certificate Private key:(paste the contents of your user.key file here, AKA RSA Private Key)
 - Serial for next Certificate : None

SAVE

===================================================================
Step 3:

Navigate to System > Trust > Certificates, "add or import certificate"

 - Method: Import an existing Certificate
 - Descriptive name: none
 - Certificate data: (paste the data in your user.crt file here)
 - Private key data: Leave blank, otherwise enter your user.key data here, mine was manually entered in on the next step.

SAVE

===================================================================
Step 4:

Navigate to VPN > OpenVPN > Clients, "add client"
Edit the following settings:(some may differ depending on your VPN provider)

 - Server Mode: Peer to Peer (SSL/TLS)
 - Protocol: UDP (check your ovpn file)
 - Device Mode: tun (check your ovpn file)
 - Interface: (Your WAN interface)
 - Local port:443 (check your ovpn file)
 - Server Host or Address: 123.45.67.890 (check your ovpn file)
 - Server Port: 443 (check your ovpn file)
 - Server host name resolution: Ticked
 - Description: "Name of your VPN Provider"

Cryptographic Settings:

 - TLS Authentication: Ticked (paste the data in your ta.key file here, AKA OpenVPN Static key V1)
 - Peer Certificate Authority: Select "VPNCA" or whatever you called the description in step 2.
 - Client Certificate: Select "Userkey CA:VPNCA *In Use"
 - Encryption: Check your VPN Provider, mine was AES-256-CBC (256 bit key, 128 bit lock)
 - Auth Digest Algorithm: SHA1(160-bit) (Check with your VPN Provider)
 - Disable IPV6: Ticked
 - Advance Configuration: "Paste the below data into the field"
   
   persist-key
   persist-tun
   remote-cert-tls server
   auth-nocache
 
- Verbosity level: 3

SAVE

NOTE: The first time you enter this page, the "TLS Authentication" section to paste your ta.key does not show up until you've clicked save. So go back to this menu after saving, and paste it in 

===================================================================
Step 5:

Check to see if your VPN connection is online,

 - Navigate to VPN > OpenVPN >  Connection Status

You should see "Status" UP with your "Remote Host" IP address supplied from the VPN Provider

Now check the log file for the words " Initialization Sequence Completed "
If you've come this far your on the right track

===================================================================
Step 6:

 - Navigate to Interfaces > Assignments
 - Select the pull down menu under "new interface" and make sure the "ovpnc1" option is selected
 - Click the orange "+" button
 - Tick Enable Interface and Save
 - Description = VPN (note this is a "Virtual" interface, its not referenced to an physical Ethernet port)
 - IPV4 Configuration type = DHCP
 - IPV6 = None
 - Note: Leave all other settings as default (empty/unticked)

===================================================================
Step 7.

 - Navigate to Firewall > Aliases > View
 - Add a new Alias
 - Name: VPNTraffic
 - Description : VPNTraffic
 - Type: Host:
 - First entry: 192.168.X.X

NOTE: (enter the IP address of Computers/devices you want to be on the VPN here. I personally enter the IP address of my Wireless router I have attached to my LAN, The wireless router has DHCP enabled so all wireless devices connected to this access point have their traffic passed via the VPN )

If you dont have a spare Wifi router, you can manually add IPs to computers on your network here.

My Network Map:  WAN--->Opnsense--->LAN--->Switch--->Wifi router runing its own DHCP - - - -> "Wireless devices"

!!!WARNING!!! Dont dodge this step, even if you think you know what im doing, the whole point of making aliases is important, and it wont work without them.

 - SAVE
===================================================================
Step 8:

Ok so heres the weird part, This had me going nuts for a while, but after a bottle of Jack Daniel's Tennessee Honey, it finally clicked!.
You NEED to use aliases rather than specifiying IP ranges directly, it makes all the difference for some reason, even though the concept
is the same.

 - Navigate to Firewall > NAT > Outbound
 - Select "Manual outbound NAT generation" (Leave the default generated WAN rules AS IS)
 - Add a new rule

Rule 1.
 - Interface: VPN (The one you created in Step 6)
 - Source: VPNTraffic ( The alias you created in Step 7)
 - Translation / target: Interface Address (as in, just select "Interface address" from the dropdown menu)
 NOTE: Leave ALL other options as default/any

Rule 2. (Same as Rule 1, but....)
 - Destination port: 500 (Select "Other" from dropdown menu and enter 500 in the field)
 - Static Port: Ticked
 NOTE: Leave ALL other options as default/any

Rule 3.
 - Interface: VPN (The one you created in Step 6)
 - Source: Single host or network, 127.0.0.0 / 8
 - Translation / target: Interface Address (as in, just select "Interface address" from the dropdown menu)
NOTE: Leave ALL other options as default/any
NOTE: Make sure the above rules "are above" your auto generated WAN outbound rules when looking at the entire list from top to bottom.

- Apply settings.
====================================================================
Step 9.

 - Navigate to Firewall > Rules > LAN
NOTE: The order of Rules from top to bottom on this page matter:
Starting at the top, you should have the "Anti-Lockout Rule"
Next, start adding rules as follows:

Rule 1. (The Rule to pass selected clients traffic out via the VPN)
 - Interface: LAN
 - TCP/IP Version: IPv4
 - Source: VPNTraffic (Alias)
 - Gateway: VPN_DHCP (ie, the auto-generated VPN Gateway option)

Rule 2. (Pass all other traffice out via the defaul gateway "WAN")

 - Interface: LAN
 - TCP/IP Version: IPv4
 - Source: Any
 - Gateway: WAN_PPPoE (ie, the auto-generated WAN Gateway, the name might be different depending
on your WAN connection method)

- Apply settings

NOTE: All other tabs in my rules section eg OPENVPN/VPN/WAN are empty NO RULES exist.
your settings may differ, but thats the basic setup. Also, check:
https://www.dnsleaktest.com/ and
https://www.ipchicken.com/
after you've completed these steps.
=================================================================
DONE

If I've missed anything, feel free to troll

Cheers

19

General Discussion / Re: OPNsense and OpenVPN (AirVPN) setup

« on: April 09, 2017, 06:10:45 pm »

I'm in the process of writing a detailed AIRVPN routing guide for opensense now, should have it ready by tomorrow.

20

17.1 Legacy Series / Re: Routing VPN and non-VPN traffic How-To?

« on: April 09, 2017, 04:22:22 pm »

Ok, I've worked out how to get this going, it took all day messing around with settings but heres what worked for me:

I took a screenshot of my Firewall>NAT>Outbound

you'll notice, im using an Alias called "ASUSRouter" that contains a single LAN IP on my network assigned to my Asuswifi router. meaning that any clients, eg mobile phones that are connect to that wifi, have their traffic routed through the VPN

Next up,

You need to edit your Firewall LAN rules,

After pulling my hair out for ages wondering why my settings wouldn't work, i discovered that NOTHING works without using an "Alias" for some weird reason. eg, I had a LAN rule that pointed all traffic on my 192.168.1.170(Asusrouter)to pass via the VPN gateway. but noooooo It doesn't work unless you create an alias to 192.168.1.170 and select the "alias" rather than manually punching in the "Single Host or Network" even though it means the same thing!.

So yeah, long story short, any IP i add to this "ASUSRouter" alias will be routed via the VPN, all other computers on my LAN NOT connected to that asus router pass directly out the WAN

Note: the order you have your LAN Rules in the list is IMPORTANT, from top to bottom i have my "Allow Asusrouter alias rule to VPN gateway" FIRST, then the rule below that is my IPV4* to WAN Gateway rule.

Also note, I dont have any rules under my VPN OR OPENVPN Tabs under Firewall>Rules.

Hope this helps

Cheers

21

17.1 Legacy Series / Re: OPNsense install from a USB key

« on: April 08, 2017, 07:18:49 am »

Just spent half my day trying to Install from a USB drive with no luck,

Used Rufus, Win32Diskimager using the OPNsense-17.1.4-OpenSSL-cdrom-amd64.iso
and OPNsense-17.1.4-OpenSSL-vga-amd64.img STILL DIDNT WORK!!

Even tried using YUMMI

Ended up using imgburn to burn the ISO to a DVD then installed via an external USB DVD drive.


That worked!

My opnsense PC is a Intel NUC

22

17.1 Legacy Series / Re: Routing VPN and non-VPN traffic How-To?

« on: April 08, 2017, 07:11:48 am »

Thanks mate,

Just checked my setting from the link you posted, still no luck but i'll keep trying.

Cheers

23

16.7 Legacy Series / Re: Configuring OPNsense as an OpenVPN client to a VPN server

« on: April 07, 2017, 03:42:19 am »

Hi geofflowemn,

Let us know when your back, I've been trying to get this VPN routing to work with no luck, I've tried many combinations of settings under Outbound NAT and Firewall rules.

Question: Under the OpenVPN connection Log, does your system report any FURTHER entries after " initialization sequence completed " ? (Once its reporting as connected)

Just trying to compare outputs.

Cheers

24

17.1 Legacy Series / Re: Routing VPN and non-VPN traffic How-To?

« on: April 07, 2017, 03:33:06 am »

Hi Noctur

I've been pulling my hair out trying to setup the same thing, have a look at this link:

https://wretmo.se/2016/01/24/how-to-setup-openvpn-client-on-opnsense/

AND this:

https://forum.opnsense.org/index.php?topic=4053.0

Let me know if you have any luck, I'm almost ready to give up :/