This guide uses pfSense version 2.8.0. The following is required for FastVPN to work with a pfSense router:
A secure FastVPN connection (Don’t have one? Sign up here);
Internet access on pfSense;
Access to your FastVPN Account Panel;
Admin access to pfSense web interface,
Access pfSense Web Interface
Connect to your local network.
Open a web browser.
Enter the pfSense router’s IP address (usually 192.168.1.1) in the address bar.
Log in with your admin credentials.
Note: If you’re not sure of the router IP or login, check your local network settings or ask your network administrator.
1. Create CA Certificate
In your pfSense Web Interface, click on System / Certificates / Authorities and then click on +Add.
In the Descriptive Name field, enter the CA name (it can be whatever you want, let's say “CA_NCVPN_CERT”).
In the Method field, choose to Import an existing Certificate Authority. Copy and paste the certificate from here into the Certificate data field.
Click on Save.
2. Add a VPN connection
In this example, we'll create the VPN connection to the New York server (nyc-c19.vpn.wlvpn.com). You can find domain names of other locations from your FastVPN Account Panel.
Click on VPN / OpenVPN / Clients / +Add & enter the following configuration:
General Information:
- Description: NYC VPN
- Disabled: leave unchecked
Mode Configuration:
- Server Mode: Peer to Peer (SSL/TLS)
- Device mode: tun - Layer 3 Tunnel Mode
Endpoint Configuration:
- Protocol: TCP on IPv4 only (you can also use UDP)
- Interface: WAN
- Local port: leave blank
- Server host or address: nyc-c19.vpn.wlvpn.com (pick any other server location from the FastVPN Account Panel)
- Server port: 443 (1194 for UDP)
- Proxy host or address: leave blank
- Proxy Authentication: none
User Authentication Settings:
- Enter your FastVPN Network Credentials, available from the FastVPN Account Panel, username & password
- Authentication Retry: leave unchecked
Cryptographic Settings:
- TLS Configuration: unchecked
- TLS keydir direction: Use default direction
- Peer certificate authority: CA_NCVPN_CERT (certificate we created at step1)
- Client Certificate: None
- Data Encryption Algorithms: [none] -> AES-128-GCM, AES-256-GCM, AES-256-CBC
- Fallback Data Encryption Algorithm: AES-256-CBC
- Auth digest algorithm: SHA512 (512-bit)
- Server Certificate Key Usage Validation: checked
Tunnel Settings:
- IPv4 Tunnel Network: leave blank
- IPv6 Tunnel Network: leave blank
- IPv4 Remote Network(s): leave blank
- IPv6 Remote Network(s): leave blank
- Limit outgoing bandwidth: leave blank
- Allow Compression: Refuse any non-stub compression (Most secure)
- Topology: Subnet – One IP-address per client in a common subnet
- Type-of-Service: Should not be selected
- Don't pull routes: Should not be selected
- Don't add/remove routes: Should not be selected
- Pull DNS: unchecked
Advanced configuration:
- Custom options (separate by a semicolon):
remote-cert-tls server;
auth SHA256;
data-ciphers AES-256-GCM:AES-256-CBC;
data-ciphers-fallback AES-256-CBC;
Persist-key;
redirect-gateway def1;
resolv-retry infinite;
route-delay 2;
route-metric 1;
topology subnet;
tun-mtu 1400;
verb 3;
- Send/Receive buffer: Default
- Gateway creation: IPv4 only
- Verbosity level: 3 (Recommended)
Click Save
3. Creating OpenVPN Interface
Navigate to the Interfaces
Select Assignments
Click on the + Add button
Click on “OPT1” toward the left side of the Interface Assignments screen
General Configuration
- Enable: check
- Description: VPN_NYC
- MTU: leave blank
- MSS: leave blank
- Scroll down to the bottom and click on the Save button
- Click Apply Changes to effect the changes made. You will get a confirmation message that the amendments are made.
4. Configuring NAT
Navigate to the "Firewall" tab and select "NAT".
Select the Outbound tab.
Check Hybrid Outbound NAT rule generation.
(Automatic Outbound NAT + rules below).
Save your changes and click the Apply Changes button.
The next step is to edit the existing rules.
Click on the Add button
Configurations:
Interface: VPN_NYC
Source: LAN subnets
Translation/Address: VPN_NYC address
Scroll down to the bottom and click on the Save button
Click on Apply Change
5. Firewall setup:
pfSense is a system with good security level; for this reason, you have to set some rules to enable users to connect with VPN and to the other systems in the LAN:
First Rule
Move to Firewall / Rules / LAN
Click on Add button
Edit Firewall Rule
- Action: Pass
- Disabled: unchecked
- Interface: LAN
- Address Family: IPv4
- Protocol: Any
Source
- LAN subnets
Destination
- Destination: Any
Extra options
- Description: Allow LAN to VPN
Advanced Options
- Gateway: VPN_NYC_VPNV4-172.21.86.1-Interface…
Scroll down to the bottom and click on the Save button
Click on Apply Change
Second Rule
Move to Firewall / Rules / LAN
Click on Add button
Edit Firewall Rule
- Action: Block
- Disabled: unchecked
- Interface: LAN
- Address Family: IPv4
- Protocol: Any
Source
- LAN subnets
Destination
- Destination: Any
Extra options
- Description: Block LAN to WAN if VPN fails
Advanced Options
- Gateway: Default
Scroll down to the bottom and click on the Save button
Click on Apply Change
Firewall rules must be ordered correctly: the ‘Pass to VPN’ rule should be placed above the ‘Block to WAN’ rule. pfSense processes rules top-down, so order matters.
That’s it! pfSense VPN setup is complete, and you should now have a FastVPN connection
If you need any further assistance, please contact our Support Team.