pages:howtos:pfsense:simple-site-to-site-vpn-with-pfsense-and-openvpn
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| pages:howtos:pfsense:simple-site-to-site-vpn-with-pfsense-and-openvpn [2021/03/14 17:28] – mischerh | pages:howtos:pfsense:simple-site-to-site-vpn-with-pfsense-and-openvpn [2021/12/09 23:28] (current) – rokkitlawnchair | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | {{tag> | + | {{tag>howto openvpn pfsense sitetosite vpn apu1c4 pcengines}} |
| ====== simple site to site VPN with pfSense and OpenVPN ====== | ====== simple site to site VPN with pfSense and OpenVPN ====== | ||
| I just had to set up a simple site to site VPN between a site with a fixed IP (SITE-B) and a site with a dynamic IP (SITE-A). Both routers are running the ‘Community Edition’ of [[https:// | I just had to set up a simple site to site VPN between a site with a fixed IP (SITE-B) and a site with a dynamic IP (SITE-A). Both routers are running the ‘Community Edition’ of [[https:// | ||
| Line 23: | Line 23: | ||
| * In the ‘**General Information**‘-section: | * In the ‘**General Information**‘-section: | ||
| - | ^ Setting | + | |
| - | | | | | + | * **Server mode:** Peer to Peer (Shared Key) |
| - | | + | * **Protocol:** UDP |
| - | * **Server mode**: Peer to Peer (Shared Key) | + | * **Device Mode:** tun |
| - | * **Protocol**: UDP | + | * **Interface:** set it to whatever external interface you want to have your OpenVPN server listening on. In my case this is ‘//WAN//‘. |
| - | * **Device Mode**: tun | + | * **Local port:** set it to the port you want the local OpenVPN server to listen on. Default is ‘//1194//‘. |
| - | * **Interface**: set it to whatever external interface you want to have your OpenVPN server listening on. In my case this is ‘WAN‘. | + | * **Description:** Set an appropriate |
| - | * **Local port**: set it to the port you want the local OpenVPN server to listen on. Default is ‘1194‘. | + | * In the ‘**Cryptographic Settings**‘-section: |
| - | * **Description**: Set an appropriate | + | |
| - | * In the ‘Cryptographic Settings‘-section: | + | |
| - | * Automatically generate a shared key: ???? | + | |
| - | * Encryption Algorithm: AES-256-CBC (256 bit key, 128 bit block) | + | |
| - | * Auth digest algorithm: RSA-SHA512 (512-bit) | + | * In the ‘**Tunnel Settings**‘-Section: |
| - | * Hardware Crypto: No Hardware Crypto Acceleration (this is PC Engines APU specific, if your hardware has crypto support – enable it) | + | |
| - | * In the ‘Tunnel Settings‘-Section: | + | |
| - | * IPv4 Tunnel Network: 10.4.10.0/ | + | |
| - | * IPv6 Tunnel Network: leave empty | + | |
| - | * IPv4 Remote network(s): 10.3.2.0/24 (this is a comma separated list for all the networks you want to connect to on the client side (SITE A)) | + | |
| - | * IPv6 Remote network(s): leave empty | + | |
| - | * Concurrent connections: | + | |
| - | * Compression: | + | |
| - | * Type-of-Service: | + | |
| - | * Duplicate Connection: ☐ Allow multiple concurrent connections from clients using the same Common Name | + | * In the ‘**Advanced Configuration**‘-section: |
| - | * Disable IPv6: ???? Don’t forward IPv6 traffic | + | |
| - | * In the ‘Advanced Configuration‘-section: | + | |
| - | * Custom options: leave empty | + | * Click on ‘**Save**‘-button |
| - | * Verbosity Level: default | + | |
| - | * Click on ‘Save‘-button | + | |
| - | You should now be forwarded to the list with your configured OpenVPN servers under ‘VPN – OpenVPN‘ on the ‘Servers‘-tab | + | You should now be forwarded to the list with your configured OpenVPN servers under ‘**VPN – OpenVPN**‘ on the ‘**Servers**‘-tab |
| + | {{ : | ||
| + | * Click on the ‘**Edit**‘-button (the pencil) and leave this window open because we will need to copy the ‘**Shared Key**‘ from this form later. | ||
| + | ===== Configure the OpenVPN client on SITE-A router ===== | ||
| + | * Navigate to ‘**VPN – OpenVPN**‘ | ||
| + | {{ : | ||
| + | |||
| + | * Click the ‘**Clients**‘-tab | ||
| + | * On the ‘**Clients**‘-tab click the ‘**+ Add**‘-button to add a new OpenVPN client | ||
| + | {{ : | ||
| + | |||
| + | |||
| + | *In the ‘**General Information**’-section: | ||
| + | * Disable this client: ☐ | ||
| + | * Server mode: Peer to Peer (Shared Key) | ||
| + | * Protocol: UDP | ||
| + | * Device mode: tun | ||
| + | * Interface: Set to whatever external interface you want your OpenVPN client connect to the OpenVPN server at SITE-B. In my case this is ‘WAN‘. | ||
| + | * Local port: leave empty | ||
| + | * Server host or address: Set to the FQDN or IP address of the external SITE-B Interface. In this example it is ‘site-b.site-b.de‘. | ||
| + | * Server port: Set to the same port you have set in the server setup at SITE-B. Default is ‘1194‘. | ||
| + | Proxy host or address: leave empty | ||
| + | Proxy port: leave empty | ||
| + | Proxy Auth. – Extra options: none | ||
| + | Infinitely resolve server: ???? | ||
| + | Description: | ||
| + | In the ‘Cryptographic Settings‘-section: | ||
| + | Peer Certificate Authority: nothing to do here | ||
| + | Peer Certificate Revocation list: nothing to do here | ||
| + | Automatically generate a shared key: ☐ – This will display a form field in which you can paste the key from the SITE-B server configuration. | ||
| + | |||
| + | Go back to SITE-B router. If you haven’t left the window open, navigate to ‘VPN – OpenVPN‘ and select the ‘Servers‘-tab, | ||
| + | |||
| + | ---- | ||
| + | ~~DISCUSSION~~ | ||
pages/howtos/pfsense/simple-site-to-site-vpn-with-pfsense-and-openvpn.1615742899.txt.gz · Last modified: 2021/03/14 17:28 by mischerh