In this article, we will show you how to configure pfSense to use OpenVPN. The goal of this VPN is to connect to our Clouding servers using their private IP addresses. This is useful because, for example, we can restrict SSH or RDP access to our servers so that they can only be accessed from the private range 10.20.10.0/24. If you have trouble accessing pfSense, check that the pfSense firewall rules are configured correctly.
Configure the Clouding firewall
In Clouding, both servers must be connected to the same VPC to communicate with each other.
To connect to the OpenVPN server, we need to open UDP port 1194 in our firewall. It should look like the following screenshot:
Add the LAN interface
Go to Interfaces > Assignments and add the vtnet1 interface by clicking the Add button:
Once added, edit it under Interfaces > LAN, enable it, and configure DHCP as shown in the screenshot:
OpenVPN configuration exporter
Next, install the OpenVPN configuration exporter. In the top menu, go to System > Package Manager > Available Packages, search for “openvpn-client-export”, and install it.
OpenVPN configuration wizard
We are now ready to configure OpenVPN. In the top menu, go to VPN > OpenVPN and open Wizard. Select “Local User Access” as the server type and click “Next”.
In this step, we will create a certificate authority. Fill in all the required fields and click “Add new CA”. Next, create a certificate by filling in the required fields and clicking “Create a new Certificate”.
Now configure the OpenVPN service. Leave the default values, enter 10.0.8.0/24 in “Tunnel Network” and 10.20.10.0/24 in “Local Network”, then click “Next”.
Select the “Firewall Rule” and “OpenVPN rule” checkboxes to configure the firewall rules automatically, then finish the setup. The following screenshots show the process:
Certificate configuration
Since we used the wizard, our certificate and CA are already configured. We just need to configure certificate revocation. In the top menu, go to System > Certificate Manager > Certificate Revocation and click “Add or Import CRL”.
Leave the fields as they appear. The important thing is to select the authority we created in the previous step under “Certificate Authority”. Click “Save” to save the changes.
Create users for OpenVPN
Now create the users who will access our VPN. In the top menu, go to System > User Manager and click the green “+ add” button. Fill in all the fields and select “Click to create a user certificate”.
OpenVPN configuration
Finally, configure the OpenVPN server to authenticate users with both a certificate and user credentials. In the top menu, go to VPN > OpenVPN and edit the server listed there.
Under “Server mode”, select “Remote Access (SSL/TLS + User Auth)” and save the changes. Our OpenVPN server is now configured.
Export OpenVPN user profiles
In the top menu, go to VPN > OpenVPN, then open Client Export. Here you can download the files needed to configure the OpenVPN client.
Configure the OpenVPN client
Open your OpenVPN client and import the ovpn configuration file downloaded in the previous step. Once imported, you can connect using the username and password configured earlier.
By default, the “default” profile of the Clouding firewall allows traffic for the networks involved in this article, so you do not need to modify it. If you have configured other networks or a different profile, check the rules.
Also remember to add a route to the VPN network on the servers you want to access through it:
For Windows:
route add -p 10.0.8.0 mask 255.255.255.0 pfsense_private_ipFor Linux, as root:
# ip route add 10.0.8.0/24 via pfsense_private_ipRemember, if you have any questions about this or any other matter related to your servers at Clouding, feel free to email soporte@clouding.io We’re here for whatever you need. Just ask us!