Setting up OpenVPN on pfSense can seem daunting, but fear not! This guide breaks down the process into manageable steps, ensuring a secure and reliable VPN connection. Let's dive in!

Why Use OpenVPN with pfSense?

Before we jump into the configuration, let's quickly cover why combining OpenVPN with pfSense is a smart move. OpenVPN is a robust and highly configurable VPN protocol, known for its security and flexibility. pfSense, on the other hand, is a powerful open-source firewall and router software. Together, they provide a secure and customizable VPN solution for your home or business network. This setup allows you to securely access your network from anywhere in the world, protecting your data from prying eyes on public Wi-Fi or untrusted networks. Plus, it gives you granular control over your VPN connections, allowing you to tailor the setup to your specific needs.

OpenVPN's Strengths: OpenVPN is renowned for its strong encryption and adaptability, making it a favorite among security-conscious users. It supports a variety of encryption algorithms and authentication methods, allowing you to fine-tune your security posture. Furthermore, OpenVPN can be configured to run on different ports, making it harder for network administrators to block VPN traffic. This is particularly useful in environments where VPN usage is restricted. By integrating OpenVPN with pfSense, you leverage the strengths of both technologies, creating a formidable security barrier for your network.

pfSense's Role: pfSense acts as the gatekeeper for your network, controlling all incoming and outgoing traffic. When you set up OpenVPN on pfSense, you're essentially creating a secure tunnel through your firewall. This tunnel encrypts all data passing through it, preventing eavesdropping and ensuring data integrity. pfSense also provides advanced features like traffic shaping and intrusion detection, which can further enhance the security and performance of your VPN connection. Moreover, pfSense's web interface makes it relatively easy to manage your OpenVPN configuration, even if you're not a command-line guru. So, for those looking for a blend of power and usability, pfSense with OpenVPN is a winning combination.

Prerequisites

Before we begin, make sure you have the following:

• A running pfSense installation.
• A basic understanding of networking concepts.
• Administrative access to your pfSense web interface.

Step 1: Install the OpenVPN Client Export Package

First, we need to install the OpenVPN Client Export package. This package simplifies the process of creating client configurations.

1. Navigate to System > Package Manager > Available Packages.
2. Search for openvpn-client-export.
3. Click Install and confirm the installation.

This package will allow you to easily generate configuration files for your OpenVPN clients, saving you a lot of manual configuration work. Once installed, you'll find a new section under the VPN menu in the pfSense web interface.

The OpenVPN Client Export package streamlines the process of configuring OpenVPN clients, making it much easier to deploy VPN access to multiple users or devices. Instead of manually creating configuration files for each client, you can use the package to generate them automatically. This not only saves time but also reduces the risk of errors. The package supports various client operating systems, including Windows, macOS, Linux, and Android, ensuring compatibility with a wide range of devices. Furthermore, it allows you to customize the client configurations to suit your specific needs, such as enabling or disabling certain features. With the OpenVPN Client Export package, managing your OpenVPN clients becomes a breeze.

Step 2: Configure the Certificate Authority (CA)

Next, we need to create a Certificate Authority (CA). This CA will be used to sign certificates for the OpenVPN server and clients.

1. Go to System > Cert. Manager.
2. Click the + Add button under the CAs tab.
3. Fill in the following details:
   • Descriptive name: MyOpenVPNCa (or any name you prefer)
   • Method: Create an internal Certificate Authority
   • Key length: 2048
   • Lifetime: 3650 (10 years, adjust as needed)
   • Fill in the remaining fields with your organization's information.
4. Click Save.

The Certificate Authority (CA) is a critical component of your OpenVPN setup, as it's responsible for issuing and managing the certificates that authenticate your server and clients. Think of it as the trusted authority that verifies the identity of everyone connecting to your VPN. When creating a CA, it's important to choose a strong key length (e.g., 2048 bits or higher) to ensure the security of your certificates. You should also set a reasonable lifetime for your certificates, balancing security with convenience. While a longer lifetime reduces the frequency of certificate renewals, it also increases the risk of compromise. A lifetime of 10 years is a good starting point, but you may want to adjust it based on your specific security requirements.

The details you provide when creating the CA, such as your organization's name and location, will be included in the certificates it issues. This information helps to establish trust and verify the authenticity of the certificates. It's important to ensure that this information is accurate and up-to-date. Once you've created the CA, you can use it to issue certificates for your OpenVPN server and clients. These certificates will be used to authenticate the connections between the server and clients, ensuring that only authorized users can access your network. Without a properly configured CA, your OpenVPN setup would be vulnerable to attacks, so it's essential to get this step right.

Step 3: Create the OpenVPN Server

Now, let's create the OpenVPN server instance.

1. Navigate to VPN > OpenVPN > Servers.
2. Click + Add.
3. Configure the following settings:
   • Server mode: Remote Access (SSL/TLS)
   • Protocol: UDP
   • Device mode: tun
   • Interface: WAN
   • Local port: 1194 (or any unused port)
   • Description: OpenVPN Server (or any descriptive name)
   • Certificate Authority: Select the CA you created in Step 2 (MyOpenVPNCa).
   • Server certificate: Click Create new certificate and fill in the details. Use a descriptive name like OpenVPN Server Cert. The common name (CN) should ideally be the same as your external IP address or hostname. If you use a dynamic DNS service, use that hostname.
   • Encryption algorithm: AES-256-CBC (or any strong cipher)
   • Hash algorithm: SHA256
   • TLS Authentication: Check the box.
   • IPv4 Tunnel Network: 10.0.8.0/24 (or any private IP range not in use on your network)
   • IPv4 Local Network(s): Your internal network (e.g., 192.168.1.0/24).
   • Concurrent connections: Set this to the maximum number of simultaneous VPN connections you want to allow.
   • Compression: LZ4
   • Custom options: Add push "redirect-gateway def1"; to route all client traffic through the VPN and push "dhcp-option DNS 192.168.1.1"; to push your DNS server.
4. Click Save.

Creating the OpenVPN server involves several key decisions that will impact the security and performance of your VPN connection. The Server mode setting determines how the OpenVPN server will operate. In this case, we're using Remote Access (SSL/TLS), which is the most common mode for allowing remote users to connect to your network. The Protocol setting determines the transport protocol used for the VPN connection. UDP is generally preferred for its speed and efficiency, but TCP may be more reliable in some network environments. The Device mode setting specifies the type of virtual network interface used for the VPN connection. tun is the most common and recommended mode.

The Interface setting determines which network interface the OpenVPN server will listen on. In most cases, you'll want to select your WAN interface, which is the interface that connects to the internet. The Local port setting specifies the port number that the OpenVPN server will listen on. The default port is 1194, but you can change it to any unused port. Choosing a non-standard port can help to obscure your VPN traffic and make it harder for network administrators to block it. The Server certificate is used to authenticate the OpenVPN server to clients. When creating a new certificate, it's important to use a strong password and to keep the certificate secure. The Encryption algorithm and Hash algorithm settings determine the encryption and hashing algorithms used for the VPN connection. AES-256-CBC and SHA256 are both strong algorithms that provide good security.

The IPv4 Tunnel Network setting specifies the IP address range used for the VPN tunnel. This should be a private IP address range that is not used on your local network. The IPv4 Local Network(s) setting specifies the IP address range of your local network. This is the network that VPN clients will be able to access when connected to the VPN. The Concurrent connections setting limits the number of simultaneous VPN connections that can be established. This can help to prevent your server from being overloaded. The Compression setting enables compression of VPN traffic, which can improve performance, especially on slow network connections. LZ4 is a fast and efficient compression algorithm.

Finally, the Custom options setting allows you to add custom OpenVPN options to the server configuration. The push "redirect-gateway def1"; option tells clients to route all their traffic through the VPN, while the push "dhcp-option DNS 192.168.1.1"; option pushes your DNS server to clients. These options can be customized to suit your specific needs.

Step 4: Configure Firewall Rules

We need to create firewall rules to allow OpenVPN traffic.

1. Go to Firewall > Rules.
2. Select the WAN interface.
3. Click + Add to create a new rule.
4. Configure the following:
   • Action: Pass
   • Interface: WAN
   • Protocol: UDP
   • Source: Any
   • Destination: This Firewall, Port, 1194 (or the port you chose in Step 3)
   • Description: Allow OpenVPN Traffic
5. Click Save.
6. Click Apply Changes.

This rule allows UDP traffic on the specified port to reach the pfSense firewall, which is essential for establishing the OpenVPN connection. Without this rule, the firewall would block incoming VPN traffic, preventing clients from connecting to the server. It's important to ensure that the rule is configured correctly, with the correct protocol, source, and destination settings. The Action setting should be set to Pass to allow the traffic to pass through the firewall. The Interface setting should be set to WAN to specify that the rule applies to traffic coming in from the internet. The Protocol setting should be set to UDP to match the protocol used by the OpenVPN server. The Source setting should be set to Any to allow connections from any IP address. The Destination setting should be set to This Firewall and the port should match the port you configured for the OpenVPN server in Step 3. Finally, the Description setting should be set to a descriptive name, such as Allow OpenVPN Traffic, to help you identify the rule later.

7. Go to Firewall > Rules.
8. Select the OpenVPN interface (a new interface should have been created automatically).
9. Click + Add to create a new rule.
10. Configure the following:
    • Action: Pass
    • Interface: OpenVPN
    • Protocol: Any
    • Source: OpenVPN net
    • Destination: Any
    • Description: Allow OpenVPN to LAN
11. Click Save.
12. Click Apply Changes.

This rule allows traffic from the OpenVPN tunnel to reach your local network. Without this rule, VPN clients would be able to connect to the server, but they wouldn't be able to access any resources on your local network. It's important to ensure that this rule is configured correctly, with the correct protocol, source, and destination settings. The Action setting should be set to Pass to allow the traffic to pass through the firewall. The Interface setting should be set to OpenVPN to specify that the rule applies to traffic coming from the OpenVPN tunnel. The Protocol setting should be set to Any to allow all types of traffic. The Source setting should be set to OpenVPN net to specify that the traffic is coming from the OpenVPN tunnel network. The Destination setting should be set to Any to allow access to any destination on your local network. Finally, the Description setting should be set to a descriptive name, such as Allow OpenVPN to LAN, to help you identify the rule later.

Step 5: Configure NAT Outbound Rules

If you want your OpenVPN clients to access the internet through your pfSense box, you need to configure NAT outbound rules.

1. Go to Firewall > NAT > Outbound.
2. If the mode is set to Automatic outbound NAT rule generation, change it to Manual outbound NAT rule generation. Click Save.
3. Click + Add to create a new rule.
4. Configure the following:
   • Interface: WAN
   • Address Family: IPv4
   • Protocol: Any
   • Source: OpenVPN net
   • Destination: Any
   • Translation / Target: Interface address
   • Description: NAT OpenVPN to WAN
5. Click Save.
6. Click Apply Changes.

Configuring NAT (Network Address Translation) outbound rules is essential for enabling your OpenVPN clients to access the internet through your pfSense firewall. NAT allows multiple devices on a private network to share a single public IP address. In this case, we're configuring NAT to allow traffic from the OpenVPN tunnel network to be translated to the IP address of your WAN interface, which is the interface that connects to the internet. Without this NAT rule, traffic from your OpenVPN clients would not be able to reach the internet.

The Interface setting should be set to WAN to specify that the NAT rule applies to traffic going out through the WAN interface. The Address Family setting should be set to IPv4 to specify that the rule applies to IPv4 traffic. The Protocol setting should be set to Any to allow all types of traffic. The Source setting should be set to OpenVPN net to specify that the traffic is coming from the OpenVPN tunnel network. The Destination setting should be set to Any to allow access to any destination on the internet. The Translation / Target setting should be set to Interface address to specify that the traffic should be translated to the IP address of the WAN interface. Finally, the Description setting should be set to a descriptive name, such as NAT OpenVPN to WAN, to help you identify the rule later.

Step 6: Download Client Configuration

Now that the server is configured, let's download the client configuration.

1. Go to VPN > OpenVPN > Client Export.
2. Under Client Export Options:
   • Remote Access Server: Select the OpenVPN server you created.
   • Choose the appropriate client configuration type for your operating system (e.g., Inline Configurations for Windows, Archive for Viscosity, etc.).
3. Scroll down and find the client configuration for your user.
4. Click the appropriate download link.

Downloading the client configuration is the final step in setting up your OpenVPN connection. The client configuration file contains all the necessary information for your OpenVPN client to connect to the server, including the server's IP address, port number, encryption settings, and certificate information. The OpenVPN Client Export package provides various client configuration types to suit different operating systems and VPN clients. For example, the Inline Configurations option generates a single configuration file that can be imported directly into the OpenVPN client on Windows, macOS, or Linux. The Archive option creates a ZIP file containing the configuration file and any necessary certificates, which is useful for clients like Viscosity that require a separate certificate file.

It's important to choose the appropriate client configuration type for your operating system and VPN client. Once you've downloaded the client configuration file, you can import it into your OpenVPN client and connect to the server. You may need to enter your username and password to authenticate. Once connected, all your internet traffic will be routed through the VPN tunnel, providing you with a secure and private connection.

Step 7: Connect with Your OpenVPN Client

Install an OpenVPN client on your device (e.g., OpenVPN Connect for Windows, Tunnelblick for macOS, OpenVPN for Android/iOS).

Import the configuration file you downloaded in Step 6.

Connect to the VPN using your username and password (if configured).

Troubleshooting

• Connection Issues: Double-check your firewall rules and NAT settings. Ensure that the OpenVPN service is running on your pfSense box.
• DNS Resolution: If you can't access websites, verify that your DNS settings are correctly configured in the OpenVPN server settings.
• Certificate Errors: Ensure that the client certificate is valid and signed by the correct CA.

Conclusion

Congratulations! You've successfully configured OpenVPN on pfSense. You can now enjoy a secure and private connection to your network from anywhere in the world. Remember to regularly update your pfSense installation and OpenVPN software to ensure you have the latest security patches.