Tag: PFSense

[How-to] PFSense OpenVPN Site-to-Site with (DHCP) Dynamic Internet Address

Setting up an OpenVPN site to site connection when one side is using DHCP to acquire an Internet IP Address in 5 minutes or less.

 

Here is the 5 minutes How-to on setting up 2 PFSense devices with a site to site VPN. For this example I will be using 2 Netgate m1n1wall systems that utilizes PC Engines ALIX 2D13 network boards with 3 LANs. Both are connected directly to the Internet via the WAN port and have assigned Internet IP addressing, they also have a private LAN segment that will be routed over the VPN so that site A and site B can see each other.

 

OpenVPN is a Client/Server type of process where 1 device acts as the server and the other acts as a client.  Servers provide a service and clients connect to that service. If a server is using DHCP to get a Internet IP address then it must have a host name that is always resolvable or you risk dropping the tunnel between clients and this server. For this example we are assuming that the server device has a static IP address and that the client is using DHCP to obtain it’s Internet address.

First we build the server (Device A)

1. Go to the VPN tab and select OpenVPN, Select the server tab and then click the [+] symbol to start the process to create a new server instance.

server-start

2.  Next we will fill out the information as it fits our network. The highlighted areas are required to create a successful VPN server.

server-first-save

  • Server Mode = Peer to Peer(Shared Key)
  • Protocol = UDP
  • Interface = WAN
  • Local Port = 1194
  • Description = Friendly Name (Anything)
  • Tunnel Network = 10.10.0.0/24 (Must be a new private network not currently in use)
  • Local Network = Server’s LAN subnet (You may have multiple LAN Networks so select the Network this VPN applies to)
  • Remote Network = Client’s LAN Subnet

3. Once saved you should have a new server listed under you OpenVPN server tab.

server-after-first-save

4. Select the [e] to edit this VPN, we will be copying the newly created “Shared Key” from the configurations to use when we create the client. In the middle of the configuration will be the shared key. Copy this key.

server-GetSharedKey

5. Next we need to create a WAN firewall rule on the server to allow UDP port 1194 to pass.

openvpn-firewall-rule

6. We will now have a new firewall rules tab called [OpenVPN], we will need to add an allow rule to pass traffic across the VPN tunnels. For the purpose of this how-to we will use a full allow rule to get all traffic to pass. You can firewall this tab as needed once we have verified traffic flows.

allow-tunnel-firewall-rule

 

 

Now let’s build the client (Device B)

1. On the client device (DHCP Enabled) from the VPN menu select OpenVPN, find the client tab and select the [+] to create a new client configuration.

client-start

2.  Next we will fill out the information as it fits our network. The highlighted areas are required to create a successful VPN client.

client-first-save

  • Server Mode = Peer to Peer (Shared Key)
  • Protocol = UDP
  • Device Mode = tun
  • Interface = WAN
  • Server Host = Internet IP of OpenVPN Server
  • Server Port = 1194
  • Description = Friendly Name (Anything)
  • Tunnel Network = 10.10.0.0/24 (Same as the server side)
    *note both side should have same network with no host
    IP provided, The server and client will auto-negotiate
    the actual ending address (example 10.10.0.1 & 10.10.0.2).
  • Remote Network = Servers LAN subnet

 

3. Save configuration, return to the client tab under OpenVPN and select the [e] under the new client VPN configuration.

client-edit

4. Copy the Shared Key from the server to this box, overwrite any key that may currently exist in box.

client-edit-share-key

5. Add a firewall rule under WAN of client (Not really required) to allow UDP port 1194.

openvpn-firewall-rule

6. We will now have a new firewall rules tab called [OpenVPN], we will need to add an allow rule to pass traffic across the VPN tunnels. For the purpose of this how-to we will use a full allow rule to get all traffic to pass. You can firewall this tab as needed once we have verified traffic flows.

allow-tunnel-firewall-rule

VPN is now ready to use

Once the configurations are complete the tunnel should automatically start up and you should no be able to see the status of the VPN. Under the [Status] main menu select OpenVPN to see all active VPNs.

Tunnel-is-up

As you can see from the image the tunnel is up, the Virtual Addr did auto negotiate an IP address of 10.10.0.1 and bytes are being sent across tunnel. If you have issues passing traffic (ping) from one network to another and you show an active VPN running under status then most likely a simple reboot of each firewall will clear any routing issues and the tunnels will start working fine afterwards.

Good luck and Happy VPNing!!

Cubert 😎

Quick guide to upgrading Netgate FW-7541 and FW-7535 firewalls to PFSense 2.0.+ without any special process.

I just recently ordered a new Netgate FW-7541 for our COLO that I will be using in a fail over setup. The Netgate nanoBSD build is not bad but has a few limits on packages that we wanted to overcome and also Netgate does not keep up with the PFSense updates as quickly so they are still at PFSense 2.0.1. We want our box to be running PFSense 2.0.2 so how do you do this when the it says it has the “Latest” updates from NetGate?

 

The trick is to change the update package location selecting the default i386 path for updates under the Firmware menu in PFSense. To do this go to the [System] menu and scroll down to [Firmware].  Now select the [Updater Settings] tab and then select from the dropdown list [Default Auto Update URLs] the (pfSense i386 Stable Updates) from the list. This will then automatically change the base URL to the new firmware location.  Now save it and then retest to see if updates are available. It should now report a new version is available for install. Select the update firmware button and wait as it updates your Netgate to a full version of PFSense.

PFSense firmware URL Select

 

Once your system reboots you should be able to login and see your new version running.

pfsense version info

*Note, the system may flip web admin themes on you after upgrades. To get back to the old tried and true pfSence default theme go to [System] -> [General Setup] and select pfSense_ng from the themes list and save. This will return you to the standard theme.

 

Enjoy,

Cubert  😎

 

 

PFSense 2.0 – Limiting users Upload and Download Speeds by Limiting Bandwidth.

Manage your Bandwidth

PFSense is by far one of the best gateway solutions out there in my opinion.  I am going to show you one of the many reasons why I think this product is best of breed and that is the Bandwidth limiter. PFSense uses Free BSD as it base, it has included the DummyNet software project which allows you to  simulate/enforce queues and bandwidth limitations, delays, packet losses, and multipath effects, it also implements a variant of Weighted Fair Queueing called WF2Q+. Now that may sound like a lot of reading to get up to speed with but I assure you it is quite easy to set up and maintain, let me show you how.

 

First off I will take a bandwidth test  to see what I get as unregulated bandwidth. I have a cable service from Brighthouse that is 50Mb download and 5 Mb upload.

The image tells the tale, I am getting 50/5 as and result of my speed test using Brighthouse’s Speed test. Now let’s get started with our limiting, we will need to create a Upload and a Download limit we want to apply to each system on the LAN then create one Firewall rule to force the systems on the LAN to follow the limits.

 

Lets get started:

First we need to find our Limiter Web GUI area in PFSense.   This is located under the Firewall Tab -> Traffic Shaper, the 3rd tab is called Limiter.

Next we are going to select Create new limiter , Let’s call it LimitUPLan

  1. Click Enable
  2. Set name to LimitUpLan
  3. Set Bandwidth allowed  (1mb)
  4. Mask Source Address
  5. Give a description
  6. Save
Now lets create another Limiter, Let’s call it LimitDownLAN
  1. Click Enable
  2. Set name to LimitDownLan
  3. Set Bandwidth allowed (3Mb)
  4. Mask Source Addresses
  5. Add Description
  6. Save
Now we should have 2 Limiters available to us when we go to make the Firewall rule. We set in the limiters to mask the source address. This tells PFSense to create a unique queue for each Source address on the LAN side. If we left this set to none then we would have just 1 queue limited to 3Mb for all users on the LAN thus taking a 50Mb service and making it a 3Mb service. That is not what we want here, we want to limit each user to 3 MB each so no one person can abuse our 50 Mb service. We could have 10 users all streaming 3Mb each for a total of 30 Mb of download per second and giving us 20 Mb still available.
Now lets start limiting our LAN systems.
We need to make this rule above any allow rule that allows TCP and/or UDP. If we place it below an allow rule then that rule will take precedence over the rule we want to force our limits on. In this example I have placed rule on my LAN tab as rule #2 above the bottom rule which allows all my traffic out.
Let’s add a new rule:
  1. Action Pass
  2. Interface LAN
  3. Protocol Any
  4. Source LAN Subnet
  5. Destination Any
  6. Description
Now edit the advanced section:

Select the Advance button under the In/Out feature, from the drop down menus select the 2 queues you created (In = Uploads) and (Out = Download). Save and apply the firewall rule and re-test your bandwidth usage.

Bandwidth Now Limited

 

That’s the whole process from start to finish. At this point you should have a rate limit of 3mb per LAN user downstream and 1 MB per LAN user upstream.

 

That is part of the power built-in to PFSense and the BSD platform. Now go off and limit someone today!

 

Cubert  😎