In this guide we will be setting up an openvpn network between two sites (assuming they both have static IPs). We will be creating a tunnel network between the two sites that allows traffic to pass.

This guide is for bridging two separate subnets with no overlap across two public IP interfaces.

We will be using Netgate PfSense devices on both sides of the tunnel.

Notes:

  • The main office will be on 192.168.100.0/24
    • The main office is getting its public IP address on the WAN interface
  • The remote site will be on 192.168.200.0/24
    • The remote office is getting its public IP address on the WAN interface

Setting Up the Server

This is for the Main Office location

  1. Go to OpenVPN -> Servers -> Add

General Information

  1. Disabled: Uncheck
  2. Server mode: Peer to Peer (Shared Key)
  3. Protocol: UDP on IPv4 only
  4. Device mode: tun - Layer 3 Tunnel Mode
  5. Interface: WAN
  6. Local port: 1195
  7. Description: OpenVPN Server for Remote Site

Cryptographic Settings

  1. Shared Key: # 2048 bit OpenVPN static key (You may need to generate one)
  2. Encryption Algorithm: AES-128-CBC (128 bit key, 128 bit block)
  3. Enable NCP: Uncheck
  4. NCP Algorithms: AES-128-GCM, AES-256-GCM
  5. Auth digest algorithm: SHA256 (256-bit)
  6. Hardware Crypto: No Hardware Crypto Acceleration

Tunnel Settings

  1. IPv4 Tunnel Network: 10.13.37.0/30
  2. IPv6 Tunnel Network: Blank
  3. IPv4 Remote Network(s): 192.168.200.0/24
  4. IPv6 Remote Network(s): Blank
  5. Concurrent connections: 2
  6. Compression: Omit Preference (Use OpenVPN Default)
  7. Type-of-Service: Uncheck

Advanced Configuration

  1. Custom options: Blank
  2. UDP Fast I/O: Uncheck
  3. Send/Receive Buffer: Default
  4. Gateway creation: IPv4 only
  5. Verbosity Level: 5

Setting Up the Client

This is for the Remote Office

  1. Go to OpenVPN -> Clients -> Add

General Information

  1. Disabled: Uncheck
  2. Server mode: Peer to Peer (Shared Key)
  3. Protocol: UDP on IPv4 only
  4. Device mode: tun - Layer 3 Tunnel Mode
  5. Interface: WAN
  6. Local port: Blank
  7. Server host or address: Public IP of Main Site
  8. Server port: 1195
  9. Proxy host or address: Blank
  10. Proxy port: Blank
  11. Proxy Authentication: none
  12. Description: OpenVPN Client for Main Site

Cryptographic Settings

  1. Peer Certificate Authority: No Certificate Authorities defined
  2. Auto generate: Uncheck
  3. Shared Key: # 2048 bit OpenVPN static key (Copy and paste generated key from server)
  4. Encryption Algorithm: AES-128-CBC (128 bit key, 128 bit block)
  5. Enable NCP: Uncheck
  6. NCP Algorithms: AES-128-GCM, AES-256-GCM
  7. Auth digest algorithm: SHA256 (256-bit)
  8. Hardware Crypto: No Hardware Crypto Acceleration

Tunnel Settings

  1. IPv4 Tunnel Network: 10.13.37.0/30
  2. IPv6 Tunnel Network: Blank
  3. IPv4 Remote Network(s): 192.168.100.0/24
  4. IPv6 Remote Network(s): Blank
  5. Limit outgoing bandwidth: Blank
  6. Compression: Omit Preference (Use OpenVPN Default)
  7. Type-of-Service: Uncheck
  8. Don’t add/remove routes: Uncheck

Advanced Configuration

  1. Custom options: Blank
  2. UDP Fast I/O: Uncheck
  3. Send/Receive Buffer: Default
  4. Gateway creation: IPv4 only
  5. Verbosity Level: 5

Enabling the New Interface on the Server

This is for the Main Site

  1. Go to Interfaces -> Assignments

OPT5

We will assume the next available interface is OPT5.

  1. Click add to add the interface to the available network port (ovpns1)
  2. Click the interface

General Configuration

  1. Enable: Check
  2. Description: OPT5OPENVPN
  3. IPv4 Configuration Type: None
  4. IPv6 Configuration Type: None
  5. MAC Address: Blank
  6. MTU: Blank
  7. MSS: Blank

Reserved Networks

  1. Block private networks and loopback addresses: Uncheck
  2. Block bogon networks: Uncheck

Enabling the New Interface on the Client

This is for the Remote Site

  1. Go to Interfaces -> Assignments

OPT5

We will assume the next available interface is OPT5.

  1. Click add to add the interface to the available network port (ovpnc1)
  2. Click the interface

General Configuration

  1. Enable: Check
  2. Description: OPT5OPENVPN
  3. IPv4 Configuration Type: None
  4. IPv6 Configuration Type: None
  5. MAC Address: Blank
  6. MTU: Blank
  7. MSS: Blank

Reserved Networks

  1. Block private networks and loopback addresses: Uncheck
  2. Block bogon networks: Uncheck

Configuring Firewall Rules on the Server

This is for the Main Office

  1. Go to Firewall -> Rules

WAN Firewall Rules

  1. Go to WAN

Block WAN SSH Traffic

  • Click Add (to bottom)
    1. Action: Block
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Destination Port Range: From: SSH(22) To: SSH(22)
    9. Log: Uncheck
    10. Description: Block SSH WAN
    11. No Advanced Options

Block WAN HTTPS Traffic

  • Click Add (to bottom)
    1. Action: Block
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Destination Port Range: From: HTTPS(443) To: HTTPS(443)
    9. Log: Uncheck
    10. Description: Block HTTPS WAN
    11. No Advanced Options

Block WAN HTTP Traffic

  • Click Add (to bottom)
    1. Action: Block
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Destination Port Range: From: HTTP(80) To: HTTP(80)
    9. Log: Uncheck
    10. Description: Block HTTP WAN
    11. No Advanced Options

Allow ANY Traffic

  • Click Add (to bottom)
    1. Action: Pass
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Log: Uncheck
    9. Description: Allow any and all IPv4
    10. No Advanced Options

NOTE: Firewall Rules are evaluated from top -> bottom, so ensure the allow rule is on the bottom in order for the first three rules we made to actually do anything

LAN Firewall Rules

Allow ANY Traffic

  • Click Add (to bottom)
    1. Action: Pass
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Log: Uncheck
    9. Description: Allow any and all IPv4
    10. No Advanced Options

OPT5OPENVPN Firewall Rules

Allow ANY Traffic

  • Click Add (to bottom)
    1. Action: Pass
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Log: Uncheck
    9. Description: Allow any and all IPv4
    10. No Advanced Options

OpenVPN Firewall Rules

Block DHCP Traffic

  • Click Add (to bottom)
    1. Action: Block
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: UDP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Destination Port Range: From: (other) Custom: 67, To: (other) Custom: 68
    9. Log: Uncheck
    10. Description: Block UDP 67 68 DHCP
    11. No Advanced Options

Allow ANY Traffic

  • Click Add (to bottom)
    1. Action: Pass
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Log: Uncheck
    9. Description: Allow any and all IPv4
    10. No Advanced Options

Configuring Firewall Rules on the Client

This is for the Remote Office

  1. Go to Firewall -> Rules

WAN Firewall Rules

  1. Go to WAN

Block WAN SSH Traffic

  • Click Add (to bottom)
    1. Action: Block
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Destination Port Range: From: SSH(22) To: SSH(22)
    9. Log: Uncheck
    10. Description: Block SSH WAN
    11. No Advanced Options

Block WAN HTTPS Traffic

  • Click Add (to bottom)
    1. Action: Block
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Destination Port Range: From: HTTPS(443) To: HTTPS(443)
    9. Log: Uncheck
    10. Description: Block HTTPS WAN
    11. No Advanced Options

Block WAN HTTP Traffic

  • Click Add (to bottom)
    1. Action: Block
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Destination Port Range: From: HTTP(80) To: HTTP(80)
    9. Log: Uncheck
    10. Description: Block HTTP WAN
    11. No Advanced Options

Allow ANY Traffic

  • Click Add (to bottom)
    1. Action: Pass
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Log: Uncheck
    9. Description: Allow any and all IPv4
    10. No Advanced Options

NOTE: Firewall Rules are evaluated from top -> bottom, so ensure the allow rule is on the bottom in order for the first three rules we made to actually do anything

LAN Firewall Rules

Allow ANY Traffic

  • Click Add (to bottom)
    1. Action: Pass
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Log: Uncheck
    9. Description: Allow any and all IPv4
    10. No Advanced Options

OPT5OPENVPN Firewall Rules

Allow ANY Traffic

  • Click Add (to bottom)
    1. Action: Pass
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Log: Uncheck
    9. Description: Allow any and all IPv4
    10. No Advanced Options

OpenVPN Firewall Rules

Block DHCP Traffic

  • Click Add (to bottom)
    1. Action: Block
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: UDP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Destination Port Range: From: (other) Custom: 67, To: (other) Custom: 68
    9. Log: Uncheck
    10. Description: Block UDP 67 68 DHCP
    11. No Advanced Options

Allow ANY Traffic

  • Click Add (to bottom)
    1. Action: Pass
    2. Disabled: Uncheck
    3. Interface: WAN
    4. Address Family: IPv4
    5. Protocol: TCP
    6. Source: Uncheck, any
    7. Destination: Uncheck, any
    8. Log: Uncheck
    9. Description: Allow any and all IPv4
    10. No Advanced Options

Restart the OpenVPN Service

  1. Go to Status -> OpenVPN
  2. Restart the Service