BlackVault pfSense OpenVPN Tutorial – nmr (revised.

10-09-2008)

This tutorial will teach you how to setup OpenVPN on pfSense completely.
Your current network architecture should look like the network architecture in Fig 1.1, or something
similar to that. The private network IP 192.168.1.0 and the pfSense box IP 192.168.1.1 can be different
depending on your setup.

1. Login into your pfSense router by opening a web browser and typing in the IP address of your
pfSense box. For example http://192.168.1.1

2. The first step in building an OpenVPN configuration is to establish a PKI (public key infrastructure).
The PKI consists of:
• a separate certificate (also known as a public key) and private key for the server and each client,
and
• a master Certificate Authority (CA) certificate and key which is used to sign each of the server
and client certificates.
OpenVPN supports bidirectional authentication based on certificates, meaning that the client must
authenticate the server certificate and the server must authenticate the client certificate before mutual
trust is established.
Both server and client will authenticate the other by first verifying that the presented certificate was
signed by the master certificate authority (CA), and then by testing information in the now-
authenticated certificate header, such as the certificate common name or certificate type (client or
server).
Generate the master Certificate Authority (CA) certificate & key

Windows
In this section we will generate a master CA certificate/key, a server certificate/key, and
certificates/keys for 3 separate clients.
For PKI management, we will use a set of scripts bundled with OpenVPN.
Open up a Command Prompt window and cd to \Program Files\OpenVPN\easy-rsa. Run the following
batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and
openssl.cnf files):

cd c:\Program Files\OpenVPN\easy-rsa
init-config.bat

Now edit the vars file (called vars.bat on Windows) and set the KEY_COUNTRY, KEY_PROVINCE,
KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don't leave any of these parameters blank.

vars.bat
clean-all.bat
build-ca.bat

The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking
the interactive openssl command:

C:\Program Files\OpenVPN\easy-rsa>build-ca.bat
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.........................++++++
...................++++++
writing new private key to 'keys\ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:
State or Province Name (full name) [NY]:
Locality Name (eg, city) [New York]:
Organization Name (eg, company) [johndoe]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:nsa
Email Address [johndoe@nsa.us.gov]:

Note that in the above sequence, most queried parameters were defaulted to the values set in the
vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the
example above, I used "nsa".

Generate certificate & key for server

build-key-server.bat server

As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter
"server". Two other queries require positive responses, "Sign the certificate? [y/n]" and "1 out of 1
certificate requests certified, commit? [y/n]".

Generate certificates & keys for 3 clients

build-key.bat client1
build-key.bat client2
build-key.bat client3

If you would like to password-protect your client keys, substitute the build-key-pass script.
Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e.
"client1", "client2", or "client3". Always use a unique common name for each client.

Generate Diffie Hellman parameters

Diffie Hellman parameters must be generated for the OpenVPN server.

 build-dh.bat

Output:

C:\Program Files\OpenVPN\easy-rsa>build-dh.bat
Loading 'screen' into random state - done
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
............+............+......+...............................................
.....................................+..........................................
.......................................................+........................
..+.........................+...................................................

Key Files

Now we will find our newly-generated keys and certificates in the keys subdirectory. Here is an
explanation of the relevant files:

Filename Needed By Purpose Secret

ca.crt server + all clients Root CA certificate NO
ca.key key signing machine only Root CA key YES
dh{n}.pem server only Diffie Hellman parameters NO
server.crt server only Server Certificate NO
server.key server only Server Key YES
client1.crt client1 only Client1 Certificate NO
client1.key client1 only Client1 Key YES
client2.crt client2 only Client2 Certificate NO
client2.key client2 only Client2 Key YES
client3.crt client3 only Client3 Certificate NO
client3.key client3 only Client3 Key YES

Setting up OpenVPN service and firewall

4. Go to the OpenVPN settings page.
5. Setup your OpenVPN to look like Fig 1.3 below
Protocol Use TCP for this, although more overhead, it works on all
occasions. We have gotten UDP to work with Shared Key but not
PKI for now.
Dynamic IP
Local port 1194 is the universal port for OpenVPN. For more security use
another port.
Address pool This is the network address from where OpenVPN clients will be
assigned addresses. Your local network address must be different
from your OpenVPN network address pool. For example we
have to use a network address besides 192.168.1.0/24 here, we
chose 10.0.1.0/24.
Use static IPs
Local network The address of your local network you want to be able to share or
access over your VPN connection. For example here our local
network is 192.168.1.0. Set this to your network address.
Client-to-client VPN Check this to enable you to access to another OpenVPN client
which is connected. We suggest you check this after your
OpenVPN connection is working properly.
Cryptography Algorithm used. Use BF-CBC (128bit) for now
Authentication Shared or PKI (Public Key Infrastructure). Shared, if you want
Method everyone to have the same key. PKI, each client has its own
unique key.
Shared Key Leave it blank for PKI
CA certificate Paste your CA certificate from the BEGIN and END
CERTIFICATE
Server certificate Paste your server certificate from the BEGIN and END
CERTIFICATE
Server key Paste your server key from BEGIN and END RSA PRIVATE
KEY
DH parameters Paste your Diffie Hellman parameters from the BEGIN and END
DH PARAMETERS
CRL
DHCP-Opt.: DNS-
Domainname
DHCP-Opt.: DNS- Enter you DNS server IP address.
Server
DHCP-Opt.: WINS-
Server
DHCP-Opt.: NBDD-
Server
DHCP-Opt.: NTP-
Server
DHCP-Opt.: none
NetBIOS node type
DHCP-Opt.:
NetBIOS Scope
DHCP-Opt.: Disable
 NetBIOS
LZO compression Enabling LZO compression makes VPN faster but uses slightly
more processing power. Enable this after everything works fine.
Custom options push “redirect-gateway def1” -- to automatically setup your default
gateway to go through VPN. Using this option will enable you
client to automatically use the VPN connection for all network
traffic eg. internet, e-mail, etc.
Description Descriptive name for the VPN settings

6. Setup your firewall rule. Go to Firewall > Rules > WAN. Add a new firewall rule by clicking on
7. Once you hit 'Save' the rule below should be added
8. Go to Firewall > NAT > Outbound. Select 'Manual Outbound NAT rule generation (Advanced
Outbound NAT (AON))'. Hit 'Save'. Then add a new mapping according to the VPN network address
pool like below. Hit 'Save' again and you're done. This enables your VPN address pool to go beyond
the firewall.

VPN Client settings road warrior configuration for Windows

1. Download and install the latest OpenVPN client from http://openvpn.net

2. After installing the Windows OpenVPN client, you should see a new network connection that uses
the TAP-Win32 Adapter. Rename the network connection to tap0.
3. Create a new text file with the extension '.ovpn' for example 'blackvaultbox.ovpn' in the path
'c:\program files\openvpn\config' or where you installed the OpenVPN client in the 'config' directory.
Make sure the new text file has the extension '.ovpn' else it will not be detected. Setup the new .ovpn
file like below. Remove the # in front of comp-lzo if you enabled LZO compression when setting up
the OpenVPN server.

float
port 1194
dev tun
dev-node tap0
proto tcp-client
remote blackvaultbox_ip_domain 1194
ping 10
persist-tun
persist-key
tls-client
client
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
#comp-lzo
verb 4

4. Copy the ca.crt, client1.crt, client1.key files to the 'c:\program files\openvpn\config' or where you
installed the OpenVPN client in the 'config' directory.

5. To test your OpenVPN setup. Connect to the internet from another source besides the network where
the server is setup. Launch your OpenVPN client. Right click on the OpenVPN icon on the system tray,
hover over 'blackvaultbox' or whatever name you gave your .ovpn file and click on connect. A window
should pop up with the connection log and the OpenVPN icon in the system tray should finally turn
green. Point your web browser to http://www.copymyiptoclipboard.com and it should show and copy
the IP address of the network your server is behind.