Jump to content



Photo

Setting up a VPN

pfsense firewall vpn remote

  • Please log in to reply
37 replies to this topic

#16 OP Lilrich

Lilrich

    Apple Fan-Boi

  • Joined: 31-October 06

Posted 31 July 2012 - 18:16

Okay i have set the server page up, is this right?

vpn1.png
vpn2.png
vpn3.png

I have also added a user to the user manager screen

Screen Shot 2012-07-31 at 19.15.35.png

and added a certificate

cert1.png


#17 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 75
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 31 July 2012 - 19:03

that is a CA your showing not a certificate, the user your logging in with should have a cert. But my quick looks and should work, you don't have netbios enabled so you want be able to broadcast for names. But should be able to get logged in, if you have a cert on the user account signed by your CA.

Your also asking for userauth, which I personally don't see the need for - user has to have the CERT to login, but sure you can also ask for password. I just think its more overhead for no real reason. Only person that would have my cert is ME, and if I lost it I would just revoke it, etc.

#18 OP Lilrich

Lilrich

    Apple Fan-Boi

  • Joined: 31-October 06

Posted 31 July 2012 - 22:39

that is a CA your showing not a certificate, the user your logging in with should have a cert. But my quick looks and should work, you don't have netbios enabled so you want be able to broadcast for names. But should be able to get logged in, if you have a cert on the user account signed by your CA. Your also asking for userauth, which I personally don't see the need for - user has to have the CERT to login, but sure you can also ask for password. I just think its more overhead for no real reason. Only person that would have my cert is ME, and if I lost it I would just revoke it, etc.


What settings should i change then to set this up properly?

#19 MtnDewCodeRedFreak

MtnDewCodeRedFreak

    Since May 2001

  • Joined: 04-August 03
  • Location: In a place where Code Red flows ...
  • OS: Windows 7 Ultimate SP1 x64
  • Phone: iPhone 5S

Posted 31 July 2012 - 22:53

Oh man - if I only knew abt this when I was in HS...!

Damn it.

#20 OP Lilrich

Lilrich

    Apple Fan-Boi

  • Joined: 31-October 06

Posted 01 August 2012 - 10:08

I must be doing something wrong as i can't seem to connect to the VPN from outside the network, any ideas?

#21 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 75
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 01 August 2012 - 12:35

Is your pfsense wan interface actually on the public? Or is there some device in front of it?

Are you making connection and just not getting authed?

Can you send me your export stuff and I can try to connect. Tell you what if you set pfsense to be remote admin, I can remote in and set it up for you, and then even test it from my box.

Can't seem to connect, the way I read that is port is not even open - or your pfsense is not listening, or you have something blocking you before you pfsense. So for sure your pfsense is directly connected to the internet - you don't have some modem/router doing nat in front of it? I will PM you my email, send me your openvpn export packet with the connection info in it and I will try and connect.

#22 OP Lilrich

Lilrich

    Apple Fan-Boi

  • Joined: 31-October 06

Posted 01 August 2012 - 12:43

Is your pfsense wan interface actually on the public? Or is there some device in front of it?


Their is a netgear router in front of my Pfsense box BUT it is in modem mode my pfsense box connects to the internet via that.

Are you making connection and just not getting authed?


I would appear to be making a connection as i get prompted for a username and password but then as soon as i hit return the connection drops.

Can you send me your export stuff and I can try to connect. Tell you what if you set pfsense to be remote admin, I can remote in and set it up for you, and then even test it from my box.


Okay i can do this later :)

Can't seem to connect, the way I read that is port is not even open - or your pfsense is not listening, or you have something blocking you before you pfsense. So for sure your pfsense is directly connected to the internet - you don't have some modem/router doing nat in front of it? I will PM you my email, send me your openvpn export packet with the connection info in it and I will try and connect.


Will email now

#23 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 75
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 01 August 2012 - 12:59

Not seeing any email? You going to email me what? The config file? If your getting prompted then that tells your connecting, port is open.

What does the status of your openvpn client say - can you pm me the logs of the connection.

Are you sure your putting in the correct username and password? That you setup for your account your wanting to use for access. Did you install the export package - what are you grabbing? It would not list your user for export if you don't have a cert on the account.

edit:
You say your on a mac right? Are you using http://www.thesparklabs.com/viscosity/ as your client, did you download the viscosity bundle from the export package?

#24 OP Lilrich

Lilrich

    Apple Fan-Boi

  • Joined: 31-October 06

Posted 01 August 2012 - 13:01

Budman i have emailed you login details for the pfsense box.

#25 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 75
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 01 August 2012 - 13:25

Im in!

So saw your weatherstation on .250

C:\Windows\System32>ping 192.168.33.250

Pinging 192.168.33.250 with 32 bytes of data:
Reply from 192.168.33.250: bytes=32 time=143ms TTL=127
Reply from 192.168.33.250: bytes=32 time=144ms TTL=127

I set it to just tls vs + userauth.. You can set it back if you want. I just didn't want to have to deal with username/password.

There is no way you were ever getting asked for auth, that must of been just teh setting in the client. Your firewall rule was for udp 1194, the default openvpn port. I changed it to your setting of 443 tcp. Popped right in!

Feel free to delete my account, thanks that made it so much quicker in figuring out what was wrong. Or if you want you can leave it until you have connected in, etc. Or just disable it for now, if you ever want me to get back in.

edit: Hey so what are the details of this weatherstation? I have been interested in setting one up, but just never pulled the trigger. On your network, so assume your reporting info to somewhere, or just logging it?

#26 OP Lilrich

Lilrich

    Apple Fan-Boi

  • Joined: 31-October 06

Posted 01 August 2012 - 14:16

Budman - Thanks for doing that for me, i have disabled your account for now, always handy to have it there just incase i need any help in the future.

I am just trying to find a client to use for the Mac and then i will give it a go.

Next job once i verify that the connection works is to setup the shares i require, when i am connected via VPN i am right in thinking that i should be able to Remote into computers on my network?

#27 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 75
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 01 August 2012 - 15:02

Yes once your in, you should be able to access anything on your network just like you were there, just a bit slower. You might have to use IP, or fqdn to access - you didn't have netbios enabled.

check out that http://www.thesparklabs.com/viscosity/ client - its for mac. I don't think its free though.

You might have to change your lan rules to be able to access stuff? I didn't look at them, I pinged your .250 box see my post with output of that, it answered. So sure you should be able to remote desktop to anything.

You might have to set any host firewalls to allow access from your vpn network that 10.0.200.

#28 OP Lilrich

Lilrich

    Apple Fan-Boi

  • Joined: 31-October 06

Posted 01 August 2012 - 15:12

Budman, am i being totally retarded where do i get the CA from to import into my software?

#29 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 75
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 01 August 2012 - 15:20

the ca can be exported via the export package, if you grab the archive it will have all the keys you need, and the ca - if you grab the inline it will be imbedded into the .opvn file Or you can download it from your Certificate manager on pfsense - but I would suggest you just grab it with the archive off the export package.

I would have to double check, but I believe the .p12 file in the archive is what your talking about.

edit: I am going to have to refresh my memory on need of the ca key, are you using it for the viscosity client? If you grab the viscisity bundle off the export, I just checked downloading that from mine and it includes ca.crt

edit2: Ok I just grabbed the inline off of mine, and yeah CA is there

<ca>
-----BEGIN CERTIFICATE-----
MIIEQTCCAymgAwIBAgIBADANBgkqhkiG9w0BAQUFADB4MQswCQYDVQQGEwJVUzER
MA8GA1UECBMISWxsaW5vaXMxEzARBgNVBAcTClNjaGF1bWJ1cmcxDTALBgNVBAoT
BGhvbWUxIDAeBgkqhkiG9w0BCQEWEWpvaG5wb3pAZ21haWwuY29tMRAwDgYDVQQD
<snipped>
7QG5X5kQj05axywyl61SO3RDYkphMT3NwKU3tn2irVEo3JrF7pTCgAn1MqdXk4Di
ilERPsVaWREzJRQEl2jFQify+ttvNg6BGhlJDtKu9IxkOanoBUI8VNRXFs7QxSYs
vI2JufYfxGbw7SSAw3r0r8DGjLbVbhaz9/98RcNOvz9yThPAuA==
-----END CERTIFICATE-----
</ca>

edit: Yeah just double checked that .p12 file has all the crts in it, the CA is in there. Which is why you don't see a ca.crt it defaults to using that - I think you can change that setting though.. let me look

edit: ok from quick look from the gui it doesn't look like you can change that setting for openvpn - but that .p12 file has the private key, the local cert and the ca cert in it.

#30 OP Lilrich

Lilrich

    Apple Fan-Boi

  • Joined: 31-October 06

Posted 01 August 2012 - 15:33

YES!

I finally have it working, i have managed to remote into the network from my laptop, i have just attempted to remote into my weather station .250 which also worked.

Need to setup my shares and see if i can get them to work next, might need some help with firewall rules though if you would be so kind.



Click here to login or here to register to remove this ad, it's free!