PfSense - OpenVPN

Overview and Objective

This document outlines the process for setting up a site-to-site OpenVPN connection using pfSense. The goal is to establish a secure, encrypted tunnel between two separate networks over the internet, ensuring secure communication and data transfer between the connected networks.

The objective of this guide is to provide step-by-step instructions for configuring this site-to-site OpenVPN connection using SSL/TLS on pfSense. This setup aims to create a secure link between two remote networks, allowing for seamless and secure communication as if they were on the same local network.

Network Diagram

• Site A: This site has a local area network (LAN) connected to a pfSense router. The pfSense router at Site A is configured as the OpenVPN server.
• Site B: This site also has a local area network (LAN) connected to a pfSense router. The pfSense router at Site B is configured as the OpenVPN client.

The end result is that Site A and Site B will be securely connected as if they are on the same local network, allowing seamless communication between the two sites.

Why PFsense

pfSense offers a user-friendly interface with an integrated OpenVPN, simplifying the setup process significantly. Its comprehensive documentation and strong community support further streamline implementation, making it a highly accessible and cost-effective solution for secure site-to-site VPN connections.

Table of Contents

• Overview
• Objective
• Certificates
  • Create a Certificate Authority CA
  • Creating Server and User Certificates
    • Creating Server Certificates
    • Creating User Certificates
  • Import certificates from OpenVPN Server to the Client Server.
• OpenVPN Server
  • Configuring PFsense as OpenVPN Server
  • Interface Assignment Configuration
  • Set Firewall Rules
• OpenVPN Client
  • Configuring PFSense as OpenVPN Client
  • Interface Assignment Configuration
  • Set Firewall Rules
  • Static Routes Configuration

• Summary

Certificates

Create a Certificate Authority (CA)

1. From the top menu click System > Certificates
   
2. Make sure you are at Authorities tab then click Add
   
3. Fill up the requirted information:

   • Descriptive name : ronworks.com you can put anything as description

   • Under Internal Certificate AUthority, the default will work but it is ideal to put in your information to avoid confusion id having multiple CAs.

   • then click Save.
     

4. Verify that the CA is created then click Certificates tab.
   

Creating Server and User Certificates

Creating Server Certificates

1. From the Certificates tab, click Add/Sign.
   
2. At the Add/Sign a New Certificate section, make sure that:
   • Method : Create Internal Certificate
   • Descriptive name can be anything helpful for you to describe its purpose.
     
3. At the Internal Certificate section, make sure that:
   • Certificate Authority us same as the Certificate Authority (CA) created earlier.
   • For Common Name the combination of the descriptive name and the CA can be used.
     
4. At the Certificate Attributes section, make sure that the Certificate type is Server Certificate. Then click Save.
   

Creating User Certificates

1. Follow steps in creating server certificates. Take note of the following changes.
   
2. At the Certificate Attributes section, choose User Certificate in Certificate type then click Save.
   
3. Verify that the certificates are created according to the specification inputed.
   

Import certificates from OpenVPN Server to the Client Server.

1. On both server and client open pfsense.
2. Go to System > Certificates then click authorities.
   
3. On the server side click edit on the Certificate authority (CA) to be imported and Add on the client.
   
4. On the client’s Method choose Import an existing Certificate Authority fromt he dropdown. Then copy all field values from the server to the client. Then click Save.
   
5. Then on both server click, click Certificates tab.
   On the server click edit for the User Certificate then Add/Sign on the client.
   
6. On the client’s method choose Import an existing Certificate then copy the same values from the server side. Then click Save.
   

OpenVPN Server

Configuring PFsense as OpenVPN Server

1. VPN > OpenVPN
   
2. Click Servers tab then click Add
   
3. At the General Information, indicate a description to this vpn server.
   
4. At Mode of Configuration choose:
   • Server mode : Peer to Peer ( SSL/TLS )
   • Device Mode : tun - Layer e Tunnel Mode
     
5. At Endpoint Configuration, use the following settings:
   • Protocol : UDP on IPv4 only
   • Interface : WAN
   • Local port : 1194
     
6. At the Cryptographic Settings:
   • Use a TLS Key : Make sure its unchecked
   • Peer Certificate Authority : Make sure its the same CA created in certificates section.
   • Server certificate : Choose the server certificate created for this server.
     
   • Enforce key usage : Make sure its checked
     
7. At the Tunnel Settings:
   • IPv4 Tunnel : 10.8.0.0/24 - Assign a network that will be used by the tunnel. Use a network address not used anywhere in your network.
   • IPv4 Local network(s) : 192.168.100.0/24 - Put in here the local LAN network you want to be accessible through VPN
   • IPv4 Remote network(s) : 192.168.200.0/24 - The target network intended to be routed in this tunnel.
     
8. Scroll down to Advanced Configuration, at Gateway creation choose IPv4 only then click Save.
   
9. Go to Client Specific Override tab, then click Add.
   
10. Be guided that :
    • Description : Put a name to describe this setting.
    • Common name : THis is the CN entry on the user certificate.
    • Server List : Choose the VPN server created earlier.
      
11. For IPv4 Remote Network/s, fill this up with the remote LAN’s network address.
    
12. Click Save.

Interface Assignment Configuration

1. From the top level menu click Interfaces > Assignments.
   
2. Verify that there’s an interface named that corresponds to vpn server then click Add.
   
3. Once Added, click the name of the added interface.
   
4. Check the Enable interface box. And put appropriate name. Then click Save.
   
5. CLick Apply Changes for the settings to take effect.
   

Set Firewall Rules

1. From the top level menu click Firewall > Rules.
   
2. Go to OpenVPN_interface tab (this is the same just added in the steps above). Then click Add.
   
3. THen follow these settings:
   • Action : Pass
   • Interface : OPENVPN_INTERFACE
   • Address Family : IPv4+IPv6
   • Protocol : Any
   • Source : Any
   • Destination : Any
     
4. Click Save.
5. Click Apply Changes for the changes to take effect.
   

OpenVPN Client

Configuring PFSense as OpenVPN Client

Do the following on the pfsese on the remote network

1. VPN > OpenVPN
   
2. Click Clients tab then click Add
   
3. At the General Information put in a description to idenfy this client.
   
4. For Endpoint Configuration choose the following:
   • Protocol : UDP on IPv4 only
   • Interface : WAN
   • Server host or address : 200.168.100.2 - This should be same IP of the server’s WAN address of the VPN server. This IP should be reachable (ping) from the client.
   • Server port : 1194 - Same port used by the VPN server
     
5. At the Cryptographic Settings:
   • Use a TLS Key : unchecked
   • Peer Certificate Authority : Use the certificated imported CA
   • Client certificate : Use the certificated imported user certificate
     
6. Scroll down to Gateway creation and choose IPv4 only. Then click Save.
   

Interface Assignment Configuration

1. From the top level menu click Interfaces > Assignments.
   
2. Verify that there’s an interface named that corresponds to vpn server then click Add.
   
3. Once Added, click the name of the added interface.
   
4. Check the Enable interface box. And put appropriate name. Then click Save.
   
5. CLick Apply Changes for the settings to take effect.
   

Set Firewall Rules

1. From the top level menu click Firewall > Rules.
   
2. Go to OpenVPN_interface tab (this is the same just added in the steps above). Then click Add.
   
3. Then follow these settings:
   • Action : Pass
   • Interface : OPENVPN_INTERFACE
   • Address Family : IPv4+IPv6
   • Protocol : Any
   • Source : Any
   • Destination : Any
     
4. Click Save.
5. Click Apply Changes for the changes to take effect.
   

Static Routes Configuration

1. From the top menu click System > Routing
   
2. Click Static Routes tab, then click Add.
   
3. At the route entry create a route going to the remote network through OpenVPN interface. Then cLick Save.
   

Summary

This guide detailed the necessary steps to configure a site-to-site OpenVPN connection using PfSense. Key steps included creating certificate authorities, server and user certificates, configuring the OpenVPN server and client settings, and setting up the necessary firewall rules and interface assignments. This guide ensures that users can establish a secure and reliable VPN tunnel between two sites, facilitating secure data exchange.