BlackVault pfSense OpenVPN Tutorial – nmr (revised. 10-09-2008)

This tutorial will teach you how to setup OpenVPN on pfSense completely.

Your current network architecture should look like the network architecture in Fig 1.1, or something similar to that. The private network IP 192.168.1.0 and the pfSense box IP 192.168.1.1 can be different depending on your setup.

1. Login into your pfSense router by opening a web browser and typing in the IP address of your pfSense box. For example http://192.168.1.1

2. The first step in building an OpenVPN configuration is to establish a PKI (public key infrastructure). The PKI consists of:

• a separate certificate (also known as a public key) and private key for the server and each client, and

• a master Certificate Authority (CA) certificate and key which is used to sign each of the server and client certificates.

OpenVPN supports bidirectional authentication based on certificates, meaning that the client must authenticate the server certificate and the server must authenticate the client certificate before mutual trust is established.

Both server and client will authenticate the other by first verifying that the presented certificate was signed by the master certificate authority (CA), and then by testing information in the now-authenticated certificate header, such as the certificate common name or certificate type (client or server).

Generate the master Certificate Authority (CA) certificate & key

WindowsIn this section we will generate a master CA certificate/key, a server certificate/key, and certificates/keys for 3 separate clients.

For PKI management, we will use a set of scripts bundled with OpenVPN.

Open up a Command Prompt window and cd to \Program Files\OpenVPN\easy-rsa. Run the following batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files):

cd c:\Program Files\OpenVPN\easy-rsa

init-config.bat

Now edit the vars file (called vars.bat on Windows) and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don't leave any of these parameters blank.

vars.bat

clean-all.bat

build-ca.bat

The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command:

C:\Program Files\OpenVPN\easy-rsa>build-ca.bat

Loading 'screen' into random state - done

Generating a 1024 bit RSA private key

.........................++++++

...................++++++

writing new private key to 'keys\ca.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [US]:

State or Province Name (full name) [NY]:

Locality Name (eg, city) [New York]:

Organization Name (eg, company) [johndoe]:

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:nsa

Email Address [johndoe@nsa.us.gov]:

Note that in the above sequence, most queried parameters were defaulted to the values set in the vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the example above, I used "nsa".

Generate certificate & key for server

build-key-server.bat server

As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter "server". Two other queries require positive responses, "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]".

Generate certificates & keys for 3 clients

build-key.bat client1

build-key.bat client2

build-key.bat client3

If you would like to password-protect your client keys, substitute the build-key-pass script.

Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. "client1", "client2", or "client3". Always use a unique common name for each client.

Generate Diffie Hellman parameters

Diffie Hellman parameters must be generated for the OpenVPN server.

build-dh.bat

Output:

C:\Program Files\OpenVPN\easy-rsa>build-dh.bat

Loading 'screen' into random state - done

Generating DH parameters, 1024 bit long safe prime, generator 2

This is going to take a long time

............+............+......+...............................................

.....................................+..........................................

.......................................................+........................

..+.........................+...................................................

Key Files

Now we will find our newly-generated keys and certificates in the keys subdirectory. Here is an explanation of the relevant files:

Filename Needed By Purpose Secretca.crt server + all clients Root CA certificate NO

ca.key key signing machine only Root CA key YES

dh{n}.pem server only Diffie Hellman parameters NO

server.crt server only Server Certificate NO

server.key server only Server Key YES

client1.crt client1 only Client1 Certificate NO

client1.key client1 only Client1 Key YES

client2.crt client2 only Client2 Certificate NO

client2.key client2 only Client2 Key YES

client3.crt client3 only Client3 Certificate NO

client3.key client3 only Client3 Key YES

Setting up OpenVPN service and firewall4. Go to the OpenVPN settings page.

5. Setup your OpenVPN to look like Fig 1.3 below

Protocol Use TCP for this, although more overhead, it works on all occasions. We have gotten UDP to work with Shared Key but not PKI for now.

Dynamic IPLocal port 1194 is the universal port for OpenVPN. For more security use

another port.Address pool This is the network address from where OpenVPN clients will be

assigned addresses. Your local network address must be different from your OpenVPN network address pool. For example we have to use a network address besides 192.168.1.0/24 here, we chose 10.0.1.0/24.

Use static IPsLocal network The address of your local network you want to be able to share or

access over your VPN connection. For example here our local network is 192.168.1.0. Set this to your network address.

Client-to-client VPN Check this to enable you to access to another OpenVPN client which is connected. We suggest you check this after your OpenVPN connection is working properly.

Cryptography Algorithm used. Use BF-CBC (128bit) for nowAuthentication Method

Shared or PKI (Public Key Infrastructure). Shared, if you want everyone to have the same key. PKI, each client has its own unique key.

Shared Key Leave it blank for PKI

CA certificate Paste your CA certificate from the BEGIN and END CERTIFICATE

Server certificate Paste your server certificate from the BEGIN and END CERTIFICATE

Server key Paste your server key from BEGIN and END RSA PRIVATE KEY

DH parameters Paste your Diffie Hellman parameters from the BEGIN and END DH PARAMETERS

CRL

DHCP-Opt.: DNS-DomainnameDHCP-Opt.: DNS-Server

Enter you DNS server IP address.

DHCP-Opt.: WINS-ServerDHCP-Opt.: NBDD-ServerDHCP-Opt.: NTP-ServerDHCP-Opt.: NetBIOS node type

none

DHCP-Opt.: NetBIOS ScopeDHCP-Opt.: Disable

NetBIOSLZO compression Enabling LZO compression makes VPN faster but uses slightly

more processing power. Enable this after everything works fine.Custom options push “redirect-gateway def1” -- to automatically setup your default

gateway to go through VPN. Using this option will enable you client to automatically use the VPN connection for all network traffic eg. internet, e-mail, etc.

Description Descriptive name for the VPN settings

6. Setup your firewall rule. Go to Firewall > Rules > WAN. Add a new firewall rule by clicking on

7. Once you hit 'Save' the rule below should be added

8. Go to Firewall > NAT > Outbound. Select 'Manual Outbound NAT rule generation (Advanced Outbound NAT (AON))'. Hit 'Save'. Then add a new mapping according to the VPN network address pool like below. Hit 'Save' again and you're done. This enables your VPN address pool to go beyond the firewall.

VPN Client settings road warrior configuration for Windows

1. Download and install the latest OpenVPN client from http://openvpn.net

2. After installing the Windows OpenVPN client, you should see a new network connection that uses the TAP-Win32 Adapter. Rename the network connection to tap0.

3. Create a new text file with the extension '.ovpn' for example 'blackvaultbox.ovpn' in the path 'c:\program files\openvpn\config' or where you installed the OpenVPN client in the 'config' directory. Make sure the new text file has the extension '.ovpn' else it will not be detected. Setup the new .ovpn file like below. Remove the # in front of comp-lzo if you enabled LZO compression when setting up the OpenVPN server.

floatport 1194dev tundev-node tap0proto tcp-clientremote blackvaultbox_ip_domain 1194ping 10persist-tunpersist-keytls-clientclientca ca.crtcert client1.crtkey client1.keyns-cert-type server#comp-lzoverb 4

4. Copy the ca.crt, client1.crt, client1.key files to the 'c:\program files\openvpn\config' or where you installed the OpenVPN client in the 'config' directory.

5. To test your OpenVPN setup. Connect to the internet from another source besides the network where the server is setup. Launch your OpenVPN client. Right click on the OpenVPN icon on the system tray, hover over 'blackvaultbox' or whatever name you gave your .ovpn file and click on connect. A window should pop up with the connection log and the OpenVPN icon in the system tray should finally turn green. Point your web browser to http://www.copymyiptoclipboard.com and it should show and copy the IP address of the network your server is behind.