.:: Pfsense : How To Setup VPN (OpenVPN) : Part 3 ::.

Configuring Remote Access OpenVPN

You already install the OpenVPN client on your PC. Previously, we have create Site To Site Tunnelling between Pfsense. Now we will create the tunnel between Pfsense and the users.

We will use Pfsense2 as our Server to allow VPN user accessing the Pfsense. Remember, we can’t use the port 80 because it already used for Site To Site Tunnelling between Pfsense.

1. Login to Pfsense2
2. Go to VPN (OpenVPN)
3. Click On Server Tab
4. Click the little + sign to create a new VPN tunnel

Now we have some setting like this :

Pfsense2
Protocol : UDP
Dynamic IP : Tick This Option
Local Port : 81
Address Pool : 10.20.200.0/24
Local Network : 10.20.20.0/24
Client-to-client VPN : Tick This Option
Cryptography : BF-CBC (128 bit)
Authentication Method : PKI (Public Key Infrastructure)
CA Certificate : (Paste Your CA certificate That You Already Create It Before)
Server Certificate : (Paste Your Server certificate That You Already Create It Before)
Server Key : (Paste Your Server key That You Already Create It Before)
DH Parameters : (Paste Your DH Parameters That You Already Create It Before)
LZO Compression : Tick This Option
Description : (Put Some Description Here)

5. Click Save to finish configure Pfsense2 as a Server.

After we create the tunneling between Pfsense and users, we have to create a new network interface and named it as “ovpn”

1. Change to C:\Program Files\OpenVPN\bin directory
2. Type “addtap.bat” command

Example Output

C:\Program Files\OpenVPN\bin>addtap.bat
C:\Program Files\OpenVPN\bin>rem Add a new TAP-Win32 virtual ethernet adapter
C:\Program Files\OpenVPN\bin>"C:\Program Files\OpenVPN\bin\tapinstall.exe" install "C:\Program Files\OpenVPN\driver\OemWin2k.inf" tap0801
Device node created. Install is complete when drivers are updated...
Updating drivers for tap0801 from C:\Program Files\OpenVPN\driver\OemWin2k.inf.
Drivers updated successfully.

C:\Program Files\OpenVPN\bin>pause
Press any key to continue . . .

3. Rename a new connection that you just created it as “ovpn”


Figure3 : Creating a New Connection For OpenVPN Client

Now, create a new text file in “c:\program files\openvpn\config folder” (or wherever you installed it) named it as “pfsense.ovpn” (you may change pfsense to whatever you like to describe the tunnel, but keep the ending). Copy and paste the following configuration:

float
port 81
dev tun
dev-node ovpn
proto tcp-client
remote pfsense2 81
ping 10
persist-tun
persist-key
tls-client
ca ca.crt
cert aslahuddin.crt
key aslahuddin.key
ns-cert-type server
comp-lzo
pull
verb 4

** dev-node ovpn must match the name of the renamed new interface,
** pfsense2 is the ip-address of your pfsense box

Remember the client certificates. We need to copy some them over to the “c:\program files\openvpn\config folder”.

In this example we will copy “ca.crt”, “aslahuddin.crt” and “aslahuddin.key” in that folder. You always need “ca.crt” and the proper client files.

Now we are finish configure the remote access for the client. Try this remote access by right click the OpenVPN GUI icon at the right bottom on your PC. The client will try connecting to your pfsense box.

Remote access OpenVPN will show connected if everything perfect. Now the tunnel should now be ready to serve.


Figure4 : Copy the Certificates and Keys at The Folder


Figure5 : Connect Remote Access OpenVPN


Figure6 : Remote Access OpenVPN Connected