pfSense is a free and open source firewall and router based on FreeBSD. Here’s everything you need to know about setting up your own OpenVPN server on pfSensepfSense is a popular firewall/router that offers a flexible alternative to the average consumer release. It comes with advanced capabilities compared to a typical router, and it is constantly updated with new firmware for increased security. A comprehensive GUI makes it easy to configure and manage whether it’s used with a home or office network. 

You can set up your own OpenVPN server with pfSense, allowing the user to access their home network securely with a Virtual Private Network (VPN). As such, your local machine will be accessible from anywhere, and you can use your home internet connection remotely via your device. 

We'll take you through the necessary steps to configure your own OpenVPN server on pfSense in this detailed guide. 

pfSense and authentication

To begin, you’ll need to select an authentication method, whether it’s password-based authentication, certificate-based authentication, or a combination of the two. If you decide to use only password-based authentication, you won’t need to generate a user certificate. In any case, you will need to generate a Certificate Authority and a server certificate.

Generating the Certificate Authority (CA)

Generating your Certificate Authority (CA) is necessary to validate the OpenVPN server’s identity and authenticate user certificates. 

  1. Within pfSense, select System, and then Cert. Manager.
  2. Click Add, and enter a name for your CA.
  3. Set the Method to Create an internal Certificate Authority.
  4. You’ll need to select your Key type (RSA, ECDSA).
  5. The Key length needs to be at least 2048.
  6. The Digest Algorithm needs to be at least sha256.
  7. You can pick a Common Name for your certificate. The default is internal-ca.
  8. Click Save to create your Certificate Authority.

Generating the server certificate

Here’s a step-by-step guide to generating your server certificate. 

  1. Within pfSense, select System, and then Cert. Manager.
  2. Open the Certificates sub-menu. Click the Add/Sign button.
  3. Set the Method to Create an internal Certificate.
  4. You’ll now need to enter a Descriptive name for the server certificate. 
  5. For the Key type, key length, and the Digest Algorithm, enter the same values used for the Certificate Authority.
  6. The Lifetime should be set to 365 days. 
  7. The Certificate Type should be Server Certificate.
  8. Click Save to create your server certificate.

Create your OpenVPN user and your user certificate

Next up, you’ll need to create a user for the OpenVPN server. This process can be replicated as many times as you’d like for multiple users. 

  1. From pfSense, select System, and then User Manager.
  2. Click Add, and enter a Username and Password for this user. Hit Save. 
  3. If you’re using certificate-based authentication or certificate and password-based authentication, open the Edit User window (pencil icon).
  4. Click the Add button under User Certificates. This will open the Certificate Manager. Input the parameters for your user certificate. 
  5. Set the Method to Create an internal Certificate.
  6. You’ll now need to enter a Descriptive name for the server certificate. 
  7. For the Key type, key length, and the Digest Algorithm, enter the same values used for the Certificate Authority.
  8. The Lifetime should be 365 days. 
  9. The Certificate Type should be User Certificate.
  10. Save, and click Save again when taken back to the User Manager menu. 

Create the OpenVPN server

It’s now time to create your OpenVPN server.

For the General Information fields:

  1. From the pfSense menu, select VPN, and OpenVPN. Click Add. 
  2. Select the Server mode, either Remote Access (SSL/TLS), Remote Access (User Auth), or Remote Access (SSL/TLS + User Auth).
  3. Change the Local port if necessary. Otherwise, the default is 1194. 
  4. Name your server in the Description section.

For the Cryptographic Settings fields:

  1. Check Use a TLS Key and Automatically generate a TLS Key.
  2. Match the Peer Certificate Authority to the CA created above. 
  3. Do the same for the Server certificate you’ve previously created. 
  4. The DH Parameter Length should be 4096.
  5. The Auth digest algorithm should be set to RSA-SHA512 (512-bit).

For the Tunnel Network fields:

  1. Enter a subnet in the IPv4 Tunnel Network. This is to be used as the OpenVPN network’s internal subnet, and it should not be present on your network already. For example: 192.168.1.0/24.
  2. You can also set your OpenVPN tunnel to support IPv6 within the IPv6 Tunnel Network field.
  3. Check the box for Redirect IPv4 Gateway. This works with all IPv4 traffic over the VPN tunnel. Do the same for Redirect IPv6 Gateway if applicable. 

In the Advanced Configuration fields:

  1. Make sure UDP Fast I/O is checked. 
  2. Within Gateway creation, select IPv4 only. If you’re also using IPv6, keep it set to Both.
  3. Click Save to finish creating your OpenVPN server. 
  4. It’s a good idea to make sure that everything is set up correctly. Open the Status menu in pfSense, and click System Logs. 
  5. Select OpenVPN, and take a look at the logs. It should say Initialization Sequence Completed.

Creating the firewall rules

Next up, you’ll need to create a firewall rule which will allow traffic to and from your server. Here's a step-by-step guide to get started:

Allowing outbound traffic

Firstly, we’ll focus on the rule to allow traffic from the OpenVPN subnet onto the internet.

  1. Select Firewall, and then Rules. 
  2. Click the OpenVPN sub-menu. 
  3. Next, click Add to create a new rule. 
  4. Choose between IPv4 and IPv4 + IPv6, depending on your setup. 
  5. The Protocol should be set to Any, and the Source set to Network.
  6. Enter the OpenVPN subnet information you created earlier in the Source Address field. Remove the last two digits. For example, 192.168.1.0 rather than 192.168.1.0/24.
  7. Select the Source Address, matching the last two digits. In the above example, it would be 24. 
  8. Name your rule in the Description section.
  9. Click Save, and Apply Changes. 

Connecting to the server from the internet 

If you want to connect to your newly created OpenVPN server from the internet, you’ll need to open your ports within the WAN interface. 

Here’s a quick guide detailing how to create a rule to allow client connections to the OpenVPN server via the internet. 

  1. Select Firewall, and then Rules. 
  2. Click the WAN sub-menu. 
  3. Next, click Add to create a new rule. 
  4. Choose between IPv4 and IPv4 + IPv6, depending on your setup. The default is IPv4. 
  5. The Protocol should be set to UDP, and the Source set to Any.
  6. The Destination Port Range should be set to the port your server runs on. 
  7. Name your rule in the Description section.
  8. Click Save, and Apply Changes to finish. 

Install the OpenVPN Client Export Utility

pfSense comes with an automated configuration generator for OpenVPN, although it requires manual installation. To do so:

  1. From the main menu, select System, and click Package Manager. 
  2. Click Available Packages, and find openvpn-client-export. Hit Install to open the Package Installer menu. 
  3. Click Confirm to install the package. Once complete, it should say Success. 

Export the OpenVPN client configuration

  1. From the pfSense menu, select VPN, and OpenVPN. 
  2. Open the Client Export menu.
  3. Double check that the Remote Access Server lists the right OpenVPN server. 
  4. For Dynamic DNS users, select Other in Host Name Resolution. Next, you’ll need to enter your hostname in the Host Name field. This works to access your WAN without the IP address. For non-Dynamic DNS users, leave the Host Name Resolution set to Interface IP Address.
  5. You’ll find a collection of generated configurations for a selection of apps and operating systems depending on the information you’ve provided. Pick the option that works with your device. 
  6. Download the configuration. You may be prompted to enter your username and password. You’ll then be free to connect to your OpenVPN server.
  7. Open Google, and type in ‘what is my IP’. Your public IP address should have changed to the WAN address of your home internet.

Summary

You now have a basic OpenVPN server in pfSense! You can remotely access your home devices and internet connection, and you should have a basic understanding of how to set and configure new rules within pfSense. It’s worth checking out add-ons, with features including split tunneling and the ability to block ads and malicious sites. There are multiple advanced options to pick from once you get the hang of things. 

You'll be able to route any client device as long as it's connected to the server. This is the case whether it's an office network or a mobile network. It's slightly more difficult to set up than your typical connection, but it's a valid option for any VPN users. If you're having issues while using a pfSense box with an OpenVPN connection,  make sure to check the firewall rules, as well as the OpenVPN logs and the network itself. 

Question mark icon

Did you know

The following information is available to any site you visit:

Your IP Address:

 

Your Location:

 

Your Internet Provider:

 

BLEEPINGCOMPUTER RECOMMENDS:

Using a VPN will hide these details and protect your privacy. We recommend using NordVPN - #1 VPN in our tests. It offers outstanding privacy features and is currently available with three months extra free.

Get NordVPN