pfsense and OpenVPN for road warriors

It is relatively simple to create a VPN connection with pfsense, for example using OpenVPN which is built into the software. Once the installation is complete and validated pfsense must follow several steps which are detailed later in this article. This VPN is configured to allow access to mobile users such as sales people have laptops and want to connect remotely to the company's internal network securely.

The first thing to do is download OpenVPN GUI and install (the following describes an installation on Windows XP). Installation can be performed using the default options (note that it must be a local administrator). In addition to installing the software itself, an additional network connection is created and it will rename it, eg VPN.

Open a DOS console and go to C: \ Program Files \ OpenVPN \ easy-rsa then type init-config. This will create (or replace the files already exist) and vars.bat openssl.cnf files located in that directory.

Edit the file vars.bat that contains default settings that will be used when creating the different encryption keys. Define parameters KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, and KEY_ORG KEY_EMAIL (do not leave blank).

In the DOS window, run commands vars, then clean-all build-ca. This has the effect of loading the default settings, delete all files in the \ OpenVPN \ easy-rsa \ keys and create the CA certificate (certificate authority) ca.key. Most requested parameters will already be filled through the file and it will vars.bat just fill in the Common Name, for example with VPN_CA.

Once created CA must generate the encryption keys associated with the server itself. To do this, still in the DOS console, type the command build-key-server server and leave the defaults. For the Common Name parameter, enter server. Answer two questions in there "Sign the certificate? "And" 1 out of 1 Certificate Requests certified, commit? "This creates the files server.crt, server.key and server.csr in the \ OpenVPN \ easy-rsa \ keys.

To complete the key generation system are necessary, then type build-dh, dh1024.pem file is created.

It remains to create encryption keys for customers. Type the command build-key and enter FirstNameLastName example FirstNameLastName as Common Name. Be careful to type exactly the same name as the command build-key and use a unique name for each customer. PrenomNom.crt files, and PrenomNom.csr PrenomNom.key are created, always in \ OpenVPN \ easy-rsa \ keys.

Attention of all these files are certain to keep confidential: ca.key, server.key, PrenomNom.key, Prenom2Nom2.key, etc..

In the interface of pfsense, click VPN> OpenVPN then click the "+" icon to add a VPN tunnel. Here are the parameters to enter:

• select UDP
• Dynamic IP check box to enable the client to connect from anywhere in the world
• define a local port (eg 1284)
• define a pool of different local IPs of all local subnets (eg 192.168.192.0/24 )
• indicate the local network that is accessible to the client workstations connected in VPN (eg 192.168.1.0/24 )
• select BF-CBC (128 bit) encryption method as
• select PKI as an authentication method
• copy and paste the contents of the file ca.crt between - BEGIN CERTIFICATE - and - END CERTIFICATE - CA certificate in the field
• copy and paste the contents of the file server.crt between - BEGIN CERTIFICATE - and - END CERTIFICATE - in the Server Certificate
• copy and paste the contents of the file server.key between - BEGIN CERTIFICATE - and - END CERTIFICATE - key in the Server
• copy and paste the file contents dh1024.pem between - BEGIN CERTIFICATE - and - END CERTIFICATE - DH parameters in the field
• check the LZO compression
• Custom options in the box to enter the options to be passed to the customers during the connection example

push "dhcp-option DOMAIN corp.com" push "dhcp-option DNS 192.168.1.1"; push "dhcp-option WINS 192.168.1.1"

This has the effect of defining the local domain, the DNS server and WINS server by default. You can also add a routing entry to another subnet with the command "route 192.168.2.0 255.255.255.0" for example.

In the Firewall menu> Rules of pfsense, select the WAN tab and click the "+" icon to add a new rule and enter the following parameters:

• Action: Pass
• Interface: WAN
• Protocol: UDP
• Source: Type: any
• Destination: Type: any
• Destination port range: from (other) 1284 to (other) 1284 (careful to enter the port number defined above)
• Gateway: default
• Description: VPN

Then click Save and then Apply.

Create a file in VPN.ovpn \ OpenVPN \ easy-rsa \ keys that will contain the connection parameters for the client, especially the router's IP and port to use. Here is a sample file ovpn:

float
port 1284
dev tun
dev-node VPN
proto udp
remote IP_du_Routeur 1284
ping 10
persist-tun
persist-key
tls-client
ca ca.crt
cert PrenomNom.crt
key PrenomNom.key
ns-cert-type server
sweater
comp-lzo
verb 4

Change the port setting according to the port to use, dev-node based on the name of the network connection, remote depending on the router's external IP and port to use and the cert and key lines depending on the user .
The installation on the client is extremely simple and can be performed by users without special training. Simply install the OpenVPN client GUI downloaded at the beginning of this article, install with all default options and then rename the connection created by the VPN installation. It should then provide four files to the client to be deposited in the C: \ Program Files \ OpenVPN \ config: ca.crt NomPrenom.crt, and NomPrenom.key VPN.ovpn. We must of course provide namePrénom files corresponding to the user on an individual basis.

To connect the customer will only have to right click on the OpenVPN icon in the notification bar, then click Connect. A window opens then recording the various ongoing operations and allowing debuguage. The client can then access the local network of the company securely.