Search the Community
Showing results for tags 'openvpn'.
Found 2 results
techken posted a topic in PfsenseHey, You can set up Pfsense to use certain static IP addresses to connect to different VPN or WAN addresses. I have a openVPN set up locally and one for USA to watch netflix, I have each set up to be used on 10 IP slots, so to change VPN to USA I just change the static IP on the host PC and same with the WAN I can turn VPN off by switching static IP on PC.Create a Alias: To do this first head over to firewall / Aliases. Under IP click the add new alias Then fill in the info like so Name: Name it what ever for example "PIASydneyIP" (can named anything)Description: Not needed. Type: Host(s)Host(s): Click add entry and enter a IP you want to use for the static IP to use for VPN. Click add again to add another. Mine I added 10 IP addresses but you can add only one or how ever many you like. So mine is 192.168.1.130 - 192.168.1.139Then if you want to have several OpenVPN connections IE another to USA like I have repeat the original post to add a new OpenVPN on a different connection. Then repeat the above to set a new range of IP addresses I have 192.168.1.150 - 192.168.1.159 For the USA VPN. Create Pass threw Rule:Now you need to make a rule so that the aliases you set above over rule the WAN rule. So go into Firewall / Rules / LAN.Click Add New Rule. and change these.Protocol: ANYSource: Type in your alias name I made it "PIASydneyIP'Description: Give it a name like "Sydney VPN Passthrew" In advance features change this.Gateway: Your OpenVPN gateway you want to use Now save the rule. Repeat this if you want to set another VPN connection location for different IP addresses. Set Up WAN Addresses:Now you need to set a rule for WAN you could set it to connect to certain IP like the above rules, But I have it using all the rest of the available IP addresses left to do that this is how. In Firewall / Rules / LANadd new rule. change this settings. Protocol: anySource: LAN Net (from drop down box) Description: WAN PassthrewGateway: WAN (from drop down box)Click save. Change the order:Now back in Firewall / Rules you will need to put rearrange the order of the rules. It should but like this (the order of the OpenVPN rules do not matter as long as they are above WAN)LocalVPNUSAVPNWAN Passthrew Any rules left overAs the rules at the top over ride the rules underneath you want the VPN on top then any IP addresses the VPN rules are not using the WAN will use. On your desktop set the static IP like normal but change IP to the connection you want to access. Say I want just VPN I put 192.168.131 and it will be on local VPNSay I want to watch netflix from USA on my TV I change it to 192.168.1.151Say I want to use ISP IP on my tablet to play games I set it to 192.168.1.110Now you can have as many devices you want connected to any of the networks all at the same time and changing VPN connection on the fly on any device is easy just change your static IP. Another advantage of this if the VPN drops out it will not revert back to your WAN connection as its on a separate IP your internet will just fail to load pages so you will know when the VPN drops out. Set up website based fall back to WAN from VPN connection:You can also set a rule to exclude websites to use the VPN so it will bypass the VPN even when your connected to it. I do this with cloudflare as I have been banned from sites using cloudflare while I was on VPN. So I have put a rule in so I dont have to change to WAN when I access them. Here is how to setup for cloudflare but you can add alias like above for several sites if you like but you need to use the sites IP not address. First off go to Aliases / URLs as cloudflare have a text file to add as there is to many addresses to add manually. click add new aliases. Name: CloudFlareIPDescription: can be blankType: URL Table (IPs)URL Table (IPs): https://www.cloudflare.com/ips-v4put in the amount of days you want it to update, I am not sure if they do update it or not but I put 30.You can make your own rule for single sites the same as you made the aliases for the openVPN Go to firewall / Rules / LANAdd New Rule. Change theseProtocols: any Source: LAN Destination: CloudFlareIP (or any other alias you set) Description: ClourFlareBypassGateway: WAN Now save and back on the LAN page make sure this rule is at the very top above the VPN rules To check whether the CloudFlare bypass works go to iplocation.net as it uses CloudFlare. It should show your ISP address then go to https://www.privateinternetaccess.com/pages/whats-my-ip/ and it should show your VPN IP. Change static IP and check IP again to make sure its all working. Of course if you want only 1 VPN to not use the VPN for CloudFlare sites then change the order. So say we want CloudFlare to bypass LocalVPN but the USAVPN to be a closed VPN with no bypass your order will need to be like this. USAVPNCloudFlareIPLocalVPNWANhope that makes sense I am not real good at explaining things lol
techken posted a topic in PfsenseInstructions on how to route all traffic through HideMyAss via OpenVPN Preparation Please download the keys from https://www.hidemyass.com/vpn-config/keys/ You will need to locate 3 files: ca.crt, hmauser.crt, and hmauser.key. CA Manager Log into your pfSense installation and choose System - Cert Manager Click on the CAs Tab and hit the + button to insert a new CA Type a description (e.g. HMA CA), and paste the contents of the ca.crt file into the Certificate Data field. Then click Save. Now click on the Certificates tab, click +, type a description (e.g. HMA OVPN), and paste the contents of hmauser.crt into the Certificate Data field, then the contents of hmauser.key into the Private Key Data field. Click Save. Login File Click Diagnostics - Edit File Type your HMA username and password into the input box, one on it's own individual line. Type /conf/hmauser.conf into the Save/Loadfrom path box, then click Save. OpenVPN Client Click VPN - OpenVPN Select the Client tab Click the + icon and change the following settings, the rest can remain at the default: Protocol: TCP Server Host or Address: (The IP of the HMA VPN server you utilize, you can find them listed at bottom of each of the following .ovpn config files, http://hidemyass.com/vpn-config/vpn-configs.zip ) Server Port: 443 Check the Infinitely Resolve Server box. Enter a Description (e.g. HMA Pro VPN) UNcheck Enable Authentication of TLS Packets Peer Certificate Authority: HMA CA Client Certificate: HMA OVPN Encryption Algorithm: AES 256 Advanced: verb 3;ns-cert-type server;auth-user-pass /conf/hmauser.conf;persist-key;persist-tun; Click Save Click Status - OpenVPN. The status should be "up" with your IP information listed. It may take 15-30 seconds to establish the connection. Click Status - System Logs - OpenVPN to troubleshoot if the connection does not come up. Check the OpenVPN log for the line: Initialization Sequence Completed. If you do not see this, it means your settings are incorrect. Go back and start again. Interfaces Click Interfaces - Assign, click the + icon. A new interface should automatically populate with a network port of opvnc1, most likely with a name of OPT1. Click Interfaces - OPT1 Enable the interface by placing a check in the box. Enter a more apt description (e.g. change OPT1 to HMA) Click Save Firewall Click Firewall - Rules and select the LAN tab Click the e icon to edit your Default Allow LAN to Any rule. Gateway Click the Gateway - Advanced button and choose the interface you just created (e.g. HMA) Click Save If you would like to route only certain LAN IP addresses through HideMyAss via OpenVPN: Follow the instructions above, but instead of editing the Default Allow LAN to Any Rule, click the + icon to create a new rule. Protocol: Any Source, Type: LAN Address Address: IP of machine you want to route across your HMA VPN connection Description: HMA VPN Rule Gateway: Advanced, choose HMA Click Save Verify the rule you just created is listed ABOVE the Default Allow LAN to Any rule. Rules are processed from top to bottom. If necessary, move the rule to the top. General Setup Go to the General Setup Choose WAN for gateway of all DNS Servers. We suggest openDNS (126.96.36.199 + 188.8.131.52) or Google DNS (184.108.40.206 + 220.127.116.11). Hit Save. Wait about 5-10 seconds and then check your public IP at http://geoip.hidemyass.com - All your traffic should now be routed through HMA and your public IP should report as your HMA VPN IP, not your ISP's IP.