OpenVPN is a robust open-source VPN system that is commonly used for secure remote access and site-to-site connectivity. pfSense, on the other hand, is a sophisticated open-source firewall and routing platform that provides a wide range of network security capabilities. It delivers a robust and flexible VPN solution when paired with pfSense.
This post will lead you through establishing OpenVPN on pfSense, allowing you to establish secure connections and safeguard your network.
Prerequisites:
Before proceeding with the OpenVPN configuration, ensure you have the following:
- A working pfSense installation: Set up and configure pfSense as your firewall and router solution.
- Access to the pfSense web interface: Connect to the web interface using a web browser.
- A basic understanding of networking concepts: Familiarity with IP addressing, subnetting, and firewall rules will be helpful.
Step-by-Step Guide to pfSense OpenVPN Configuration
The OpenVPN wizard is the simplest way to get started with OpenVPN. It will walk you through the majority of the steps that are involved.
1. OpenVPN Server Setup
First Open a web browser and enter the IP address of your pfSense device to access the Login page. Log in with your administrative credentials to gain access to the web interface.
Once you are logged in, navigate to the “VPN” section in the main menu and select “OpenVPN.” This will take you to the OpenVPN configuration page.
On the OpenVPN configuration page, click on the “Wizard” tab. The wizard will guide you through the necessary steps to configure OpenVPN.
Keep the Type of Server as Local User Access and then select Next.
OpenVPN will necessitate the establishment of its own Certificate Authority. Select Add new CA and name the certificate on the next screen. Fill in the location details if desired.
Next, we’ll create a server certificate. Give the certificate a name and like the last step, populate the location information if you’d like.
Next, provide a description for the OpenVPN server. Maintain the default interface, protocol, and local port (WAN, UDP on IPv4 only, 1194). Note you can change the local port if you have already used the default.
The cryptographic settings can be left alone, and under the Tunnel Settings, make sure to choose a subnet that is not already in use. Enter your LAN subnet in the Local Network section to make your local network available via OpenVPN. If you want to specify a maximum number of concurrent connections, you can do so here. The remainder of the settings can be left alone. It is not necessary to modify any other settings, but if you want to utilize a specific DNS server, you can do so under Client Settings. When you’ve finished everything, click Next.
On the following screen, check the boxes to create the Firewall Rule and the OpenVPN Rule, then click Next.
On the next step Click Finish and the server setup is now complete!
2. User Accounts
Make sure a user account is configured and a user certificate is produced. Selecting System > User Manager > Add will enable you to finish this. Once you’ve chosen your username and password, click to create a user certificate. Be sure to choose the OpenVPN_CA that we previously produced and give the certificate a name (usually, Username + OpenVPN Certificate). Save your changes while leaving the remainder as-is.
3. Client Export Package
Before proceeding with the client export, you need to ascertain of one prerequisite.
Make sure to install the OpenVPN-client-export package from the Package Manager (System > Package Manager > Available) Packages).
Once you have both the client export and the User created you can now proceed in exporting the client configuration file.
Navigate to VPN>OpenVPN and choose Client Export. From here, you can scroll down/search and retrieve the user’s client configuration.
4. OpenVPN Client
As for accessibility you will need an OpenVPN client software application. These clients allow users or devices to access resources on a remote network securely. Here are some commonly used OpenVPN clients:
OpenVPN GUI: OpenVPN provides a graphical user interface (GUI) client for Windows called OpenVPN GUI. It is widely used and supports easy configuration and management of OpenVPN connections on Windows operating systems.
OpenVPN Connect: OpenVPN Connect is the official OpenVPN client for mobile devices. It is available for both iOS and Android platforms and allows users to connect to OpenVPN servers using a user-friendly mobile application.
Tunnelblick: Tunnelblick is an OpenVPN client for macOS. It provides a simple and intuitive interface for managing OpenVPN connections on Mac computers.
Network Manager: Network Manager is a network management tool used in various Linux distributions. It includes built-in support for OpenVPN, allowing Linux users to configure and manage OpenVPN connections directly from their desktop environment.
Third-Party VPN Clients: Apart from the official OpenVPN clients, many third-party VPN clients exist that support OpenVPN. These clients may offer additional features, customization options, or integration with specific operating systems or devices.
Conclusion
Configuring OpenVPN on pfSense empowers you with a secure and flexible VPN solution to meet your remote access and site-to-site connectivity needs. By following this step-by-step guide, you can easily set up OpenVPN on pfSense, enabling you to establish encrypted connections and safeguard your network.
- Connecting to Serial Console on Netgate SG pfSense Appliance
- How To Install and Configure OPNSense Firewall
