{"id":18612,"date":"2020-03-25T15:55:11","date_gmt":"2020-03-25T15:55:11","guid":{"rendered":"https:\/\/made4it.com.br\/blog\/creating-vpn-using-pfsense-and-openvpn\/"},"modified":"2026-06-29T19:40:13","modified_gmt":"2026-06-29T19:40:13","slug":"creating-vpn-using-pfsense-and-openvpn","status":"publish","type":"post","link":"https:\/\/made4it.com.br\/en\/blog\/creating-vpn-using-pfsense-and-openvpn\/","title":{"rendered":"Creating VPN using PFSense and OpenVPN"},"content":{"rendered":"\n

Hello everyone! <\/p>\n

In our last article<\/a> we learned how to install and configure PFSense, to be used as the Gateway of your network, allowing it to act with several functionalities for the network. Today we will introduce you to creating a VPN with OpenVPN, so you can access your entire internal infrastructure from anywhere you need to. <\/p>\n\n

What is a VPN?<\/h2>\n\n

Basically, VPN stands for Virtual Private Network, and it serves as a tunnel between two connection points.<\/p>\n

When you set up a VPN between a computer at your home and a PFsense at your company, for example, the tunnel created allows your computer to act as if it were \u201cinside\u201d your company\u2019s local network, granting access to servers and equipment, provided that the PFsense is reachable from your home computer.<\/p>\n

Now that we understand what VPN is all about, let’s learn how to set it up using PFSense to establish the connection between your different networks.<\/p>\n\n

\"\"<\/a><\/figure>\n\n

Configuring the VPN<\/h2>\n\n

We’ll use PFSense’s built-in “Wizard” for this configuration. To do this, go to the VPN > OpenVPN<\/strong><\/em>. Then, click the Wizards<\/strong><\/em>tab: <\/p>\n\n

\"\"
To create the VPN, go to VPN > OpenVPN > Wizards.<\/figcaption><\/figure>\n\n

When we access the Wizard, we will select the‘Type of Server<\/strong>‘, as‘Local User Access<\/strong>‘, and we can click on ‘\n Next<\/strong>\n<\/em>‘.<\/p>\n\n

\"\"
Here we change the Type of Server and move on.<\/figcaption><\/figure>\n\n

On the next screen you need to create a new Certificate Authority (Cerfificate Authority, or CA), by filling out the following fields:<\/p>\n\n

\"\"
Remember to change the location fields to suit your needs.<\/figcaption><\/figure>\n\n

We will use the name: VPN_CA<\/strong><\/em>, indicating that this CA is used for the VPN. Next, we\u2019ll specify the size of the encryption key that will be generated. A value of 2048<\/strong><\/em> bits is sufficient.The rest can be filled in according to your Country, State, City, and Organization<\/strong><\/em> (or company). <\/p>\n\n

\"\"The next step is to create a server certificate. To do this, simply select the option to create a new certificate and fill in the fields as shown in the image (changing the location values again): <\/figure>\n\n
\"\"
Very similar to the previous one, this is the Server Certificate, not the Certificate Authority, but the settings will remain the same.<\/figcaption><\/figure>\n\n

Now that we’ve finished setting up the server certificate, let’s configure the VPN access settings. To do this, we’ll select the access interface\u2014in our case, the WAN<\/strong><\/em>. Then, we\u2019ll fill in the rest of the information. I\u2019ll be using the UDP only<\/strong><\/em>, on port 1194<\/strong><\/em> and with the description ‘VPN<\/strong><\/em>‘. <\/p>\n\n

\"\"
Configuration that we will use, related to the port and protocol of our tunnel.<\/figcaption><\/figure>\n\n

On the same screen, you’ll find the encryption settings. In these options, we’ll enable TLS authentication and the automatic creation of a shared TLS key for authentication<\/strong><\/em>.We can set the ‘DH<\/strong><\/em>‘ to 2048<\/strong><\/em>, as is the default, and change the Encryption Algorithm<\/strong><\/em> to AES-256-CBC<\/strong><\/em>. Let\u2019s choose the Authentication Algorithm ‘SHA1 (160-bit)’<\/strong><\/em>. It is important that this setting be the same on both the server (PFsense) and the client (your machine).
We have our configurations as follows:<\/p>\n\n

\"\"
Encryption Settings.<\/figcaption><\/figure>\n\n

In the next part we have the Tunnel settings.
The first field refers to the IP pool that pfSense will use for its clients\u2014that is, the IP addresses that PCs connecting to the VPN will be assigned within the virtual network. In our case, we selected a \/24 block (256 IP addresses, with 254 hosts), which should be plenty. We chose the block 10.20.50.0\/24<\/strong><\/em>.Let\u2019s fill in the \u201cLocal Network ‘ field<\/strong><\/em>‘ field to specify the LAN network we\u2019re trying to access, so that pfSense can automatically create a route to that network. In our example, the network is 192.168.1.0\/24<\/strong><\/em>.We use the ‘Omit Preference<\/strong><\/em>‘ compression, and enable the ‘Inter-Client Communication<\/strong><\/em>‘ option if you want machines connected to the VPN to communicate with each other.Currently, our settings are as follows: <\/p>\n\n

\"\"
Network settings of our VPN tunnel.<\/figcaption><\/figure>\n\n

To complete the configuration, in the ‘Client Settings<\/strong><\/em>‘ field, you have the option to Dynamic IP enabled<\/strong><\/em>so that the connected IP addresses can change dynamically. In Topology<\/strong><\/em>, we select the Subnet<\/strong><\/em>option to have a \/24 subnet with IPs distributed within the block. If you want to isolate each client\u2019s subnet, you can use the net30 option, which assigns each client a separate \/30 subnet. Some older client versions require the \u201cnet30\u201d option to be selected, while others require \u201cSubnet.\u201d It\u2019s important to adapt your configuration to the client you\u2019ll be using.After that, you have the option to choose the DNS server for this VPN connection. We\u2019ll leave the default Google\u2019s<\/strong><\/em> from Google and PFSense itself as the DNS servers.The final settings are as shown in the image: <\/p>\n\n

\"\"
Final configurations of our Client.<\/figcaption><\/figure>\n\n

On the next screen, we have the option to set up a firewall rule to allow connections from anywhere on the VPN, which we can enable<\/strong><\/em>, since OpenVPN uses certificates for the connection; without the certificate (which must be provided directly to the person connecting) and a username\/password, it is impossible to gain access to this network.Just below that, the ‘OpenVPN rule<\/strong><\/em>‘ option, we can enable<\/strong><\/em>to allow all traffic from connected clients to pass through the VPN tunnel.<\/p>\n\n

\"\"
Firewall Configuration. Allowing all connections is not a problem, by having certificate and user authentication with password. <\/figcaption><\/figure>\n\n

Finally, we finish the configuration and have the VPN ready.
Now we need to create the users that will have access to the tunnel.<\/p>\n\n

Creating user with certificate for VPN<\/h2>\n\n

To create our users, go to \n System<\/strong>\n<\/em> >\n User Manager<\/strong>\n<\/em>and then go to ‘\n + Add<\/strong>\n<\/em>just below the panel with your PFSense users.<\/p>\n\n

\"\"
PFSense user screen.<\/figcaption><\/figure>\n\n

When creating a user, we add User<\/strong><\/em>, Password<\/strong><\/em> and fill in the rest with the user’s information. In this case, I’ll create a user named ‘made4it<\/strong><\/em>‘ that we’ll use to connect to the network. <\/p>\n

Below the group selection, there is a ‘Certificate<\/strong><\/em>‘ button. You must click ‘check<\/strong><\/em>‘ to create user certificates. <\/p>\n\n

\"\"
You must select the Certificate option in order to generate the user certificate.<\/figcaption><\/figure>\n\n

Under the user settings, we’ll create the certificate for our user. To do this, we’ll create a description. We’ll use ‘made4it_cert<\/strong><\/em>‘ in our example. We select the CA created earlier and specify the same 2048<\/strong> bits<\/strong><\/em> as we used when creating it. <\/p>\n\n

\"\"
Creating a Certificate for the User.<\/figcaption><\/figure>\n\n

Once that’s done, we can save our user.To access the VPN, we need to export our certificate using the ‘OpenVPN Client Export<\/strong><\/em>‘ package.<\/p>\n\n

Client Export Installation<\/h2>\n\n

Let’s go to \n System<\/strong>\n<\/em> >\n Package Manager<\/strong>\n<\/em> >\n Available Packages<\/strong>\n<\/em> and then, search for the package ‘\n openvpn-client-export<\/strong>\n<\/em>and give it a ‘\n + Install<\/strong>\n<\/em>on it, then wait for the installation to finish:<\/p>\n\n

\"\"
Path to the Package Installer.<\/figcaption><\/figure>\n\n
\"\"
Package search and installation.<\/figcaption><\/figure>\n\n
\"\"
Properly installed package.<\/figcaption><\/figure>\n\n

Once the installation is complete, simply go to VPN<\/strong><\/em>>OpenVPN<\/em><\/strong>>Client Export Utility<\/strong><\/em>, to begin exporting the certificate.On this screen, we will leave the ‘Host Name Resolution<\/strong><\/em>‘ option as ‘Interface IP Address<\/strong><\/em>‘. In ‘\n Verify Server CN<\/strong>\n<\/em>we can leave it at ‘\n Automatic<\/strong>\n<\/em>‘.<\/p>\n

The rest can be left unchecked, so we click on ‘\n Save as Default<\/strong>\n<\/em>to apply the changes.<\/p>\n\n

\"\"<\/figure>\n\n
\"\"
Options for exporting the certificate.<\/figcaption><\/figure>\n\n

With the changes applied, we go to the bottom of the screen, to the user we created, and select the certificate\/client that we will export.<\/p>\n

In my specific case, I’ll download the ‘Most Clients<\/strong><\/em>‘ from ‘Inline Configurations<\/strong><\/em>‘, since I already have a client set up. If you’re going to use a Windows client, Viscosity (Windows or macOS), or another client, just choose the appropriate file. <\/p>\n\n

\"\"
Download the certificate for connection.<\/figcaption><\/figure>\n\n

In my case, I’ll use the ‘Tunnelblick<\/strong><\/em>‘ on macOS<\/strong><\/em>to connect to the VPN. To connect, simply add the configuration files to your client; then, when you connect, you\u2019ll be prompted for the VPN username and password, which will be for the user created earlier\u2014in our case, the user ‘made4it<\/strong><\/em>‘: <\/p>\n\n

\"\"
Enter the user and password you created in PFSense earlier.<\/figcaption><\/figure>\n\n
\"\"
Client trying to connect to the VPN.<\/figcaption><\/figure>\n\n
\"\"
Successfully connected!<\/figcaption><\/figure>\n\n

Setting up VPN in Windows<\/h2>\n\n

To connect to our VPN, which is already configured on Windows, we need a client. We can install the OpenVPN client using the files provided by PFsense itself.To do this, go to VPN > OpenVPN > Client Export<\/strong><\/em>, and download the most appropriate file. In this case, since I\u2019ll be using the OpenVPN client, we can select the version under Current Windows Installer<\/strong><\/em> (for Windows 7\/8 or Windows 10). <\/p>\n\n

\"\"
Remember to choose the correct version when downloading.<\/figcaption><\/figure>\n\n

Once the file is downloaded, we can run it and proceed with the normal installation. The File we downloaded will start the OpenVPN configuration and install our VPN connection directly, with no further configuration required. <\/p>\n

When the installers are finished, we can open OpenVPN by clicking on the shortcut created on the desktop, then right-click on the icon in the Toolbar (Next to the Clock), and finally click Connect and provide the user\/password data created in PFSense.<\/p>\n\n

\"\"
The First icon on the left is the OpenVPN Client.<\/figcaption><\/figure>\n\n
\"\"
Just right-click and“Connect<\/strong><\/figcaption><\/figure>\n\n
\"\"
Now just enter your username and password, and we’re on the VPN!<\/figcaption><\/figure>\n\n

So, that’s it, folks. This was our guide to setting up OpenVPN using pfSense and configuring a connection to it using the OpenVPN Client, with the files provided by pfSense itself.If you need help or support<\/strong> with pfSense maintenance, please contact us<\/a> \u2014we’re here to help!Thanks, and see you next time!<\/p>\n","protected":false},"excerpt":{"rendered":"

Basically, VPN stands for Virtual Private Network, and it serves as a tunnel between two connection points. When you set up a VPN between a computer at your home and a PFsense at your company, for example, the tunnel created allows your computer to act as if it were \u201cinside\u201d your company\u2019s local network, granting access to servers and equipment, provided that the PFsense is reachable from your home computer. Now that we understand what VPN is all about, let’s learn how to set it up using PFSense to establish the connection between your different networks. Configuring the VPN We’ll use PFSense’s built-in “Wizard” for this configuration. To do this, go to the VPN > OpenVPN. Then, click the Wizardstab: So, that’s it, folks. This was our guide to setting up OpenVPN using pfSense and configuring a connection to it using the OpenVPN Client, with the files provided by pfSense itself.If you need help or support with pfSense maintenance, please contact us \u2014we’re here to help!Thanks, and see you next time!<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[869,1041,1042],"tags":[1048,1044,1072,1043],"class_list":["post-18612","post","type-post","status-publish","format-standard","hentry","category-network","category-pfsense","category-servers","tag-pfsense","tag-pfsense-basics","tag-pfsense-vpn","tag-servers"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t