Editing PF Sense Firewall Implementation at GIPL (section)

= Configuring OpenVPN  =
A VPN (virtual private network) allows us to connect directly to our home private network over the internet

The certificate authority or CA will sign the certificates that we will be creating for the server and client side when we configure OpenVPN. You can access the certificate configuration by going over to System–>Cert Manager.

[[Image:Gpil-051.jpg]]


Under the CAs tab you might already have a CA created if you followed one of my previous articles as we needed to created one in order to sign an internal certificate to be used for securing the pfSense web interface.


=== Certificate Authority ===
Fill in the fields to '''create a new Certificate Authority''' 

* '''Descriptive Name''' - Used as the Common Name (CN) for the CA. Do not spaces, punctuation or special characters (ex: ''VPN Server CA'') 
* '''Key Length''' - Default is OK, the higher the better but will use more CPU. 
* '''Lifetime''' - Default is OK, but can be lowered if it must be changed out more often. 
* '''Country Code''', '''State/Province''', '''City''', '''Organization''' - Enter values for this location/company. 
* '''E-mail''' - Used as a reference on the certificate, does not receive any mail from the system. 

Click '''Add New CA''' 


[[Image:Gpil-052.jpg]]


After you finished setting up the CA the next step is to create some certificates that the recently created CA will sign for us. Since these are self-signed certificates most browsers will give you a warning


=== Server Certificate ===
Fill in the fields to create a new '''Server Certificate'''. Similar Fields as CA entry, most of the fields carry over and do not need changed. 

Click '''Create new Certificate''' 


[[Image:Gpil-053.jpg]]


Now that we have all the components in place we can configure OpenVPN. Head over to VPN–>OpenVPN.

.

[[Image:Gpil-054.jpeg]]


Select “Wizards” from the tab at the top which will guide us step by step to configure OpenVPN


[[Image:Gpil-055.jpeg]]


[[Image:Gpil-056.jpeg]]

We will select the local user access database provided by pfSense

In the next step we will be selecting the CA that we created at the beginning of this article.

[[Image:Gpil-057.jpg]]


Following is the Server Certificate that we will be using which is the Certificate that we recently created.


[[Image:Gpil-058.jpg]]

'''OpenVPN Server Configuration'''

* '''TLS Authentication''' -- Leave this checked, along with the box underneath to generate a new key. Using a TLS key is technically optional, but ''highly'' recommended
* '''Tunnel Network''' -- Should be a new, unique network that does not exist anywhere in the current network or routing table. 

[[Image:Gpil-059.jpg]]

[[Image:Gpil-060.jpg]]

[[Image:Gpil-061.jpg]]

Click '''Next''' 

=== Firewall Rules ===
The next screen offers the choice to add firewall rules automatically. For convenience, check both unless the rules will be managed manually. 

Click '''Next''' 

=== End of the Wizard ===
Click '''Finish''' to exit the wizard and the new settings will be saved and applied automatically. 

== Adding a User with a Certificate ==
Navigate to '''System > User Manager'''

Click "+" To add a '''user'''

Fill in '''Username'''

Fill in '''Password / Confirm password'''

Check Click to create a '''user certificate.'''

Fill in the Descriptive Name as the username

[[Image:Gpil-062.jpeg]]

[[Image:Gpil-063.jpg]]


The OpenVPN Client Export Package allows exporting configurations formatted for a wide variety of platforms. It also allows exporting a pre-packaged Windows installer executable which includes the configuration bundled inside for a painly client installation. 

=== Installing the OpenVPN Client Export Package ===
To Install the OpenVPN Client Export Package 

* Navigate to '''System > Packages''', '''Available Packages''' tab 
* Find '''OpenVPN Client Export Package''' in the list 

=== Exporting a Configuration ===
* Navigate to '''VPN > OpenVPN''' on the '''Client Export''' tab 
* Choose the VPN from the '''Remote Access Server''' drop-down list 
* Find the user in the list at the bottom of the page and select the appropriate configuration type to export. 

[[Image:Gpil-064.jpg]]


[[Image:Gpil-065.jpg]]


Multiple instance of VPN server can be created with different tunnel network 

[[Image:Gpil-066.jpg]]


Firewall Rules are applied as per the requirement on tunnel network .


[[Image:Gpil-067.jpeg]]