{"id":6,"date":"2021-04-13T16:22:00","date_gmt":"2021-04-13T15:22:00","guid":{"rendered":""},"modified":"2021-06-08T18:50:58","modified_gmt":"2021-06-08T17:50:58","slug":"pfsense-and-vpn-tunnels","status":"publish","type":"post","link":"https:\/\/blog.hslracing.com\/myhome\/2021\/04\/pfsense-and-vpn-tunnels.html","title":{"rendered":"pfSense and VPN Tunnels"},"content":{"rendered":"

I have used Private Internet Access<\/a> (PIA) Virtual Private Network (VPN) tunnels for a number of years now and was keen to find out what else I could do with them.<\/p>\n

<\/a><\/div>\n<\/p>\n

I setup a couple of VPN tunnels using OpenVPN<\/a> on my pfSense<\/a> firewall, one to PIA<\/a>‘s London gateway and one to their Southampton gateway.<\/p>\n

The setup was performed partly by following the Tom Lawrence<\/a>‘s YouTube<\/a> video, partly by reading the PIA documentation<\/a> and partly guesswork and investigation.<\/p>\n

The reason I could not follow any of the guides directly is because they are based on pfSense<\/a> 2.4.5 and I am running 2.5, which seems to be significantly different in many ways, to the point that people who had working OpenVPN<\/a> tunnels under 2.4.5 had broken OpenVPN<\/a> tunnels after upgrading to 2.5!<\/p>\n

After finally persuading the OpenVPN<\/a> tunnels to start and adding the firewall rules, I discovered my first issue – despite having a rule that supposedly only places one device behind the firewall (my desktop), all devices are making use of the OpenVPN<\/a> tunnel and appearing to have the same IP as far as the tunnel is concerned.<\/p>\n

Previously I was using the PIA<\/a> app on my iMac or iPad to provide a VPN tunnel and so the tunnel was private to that device.<\/p>\n

Now because I have set up the VPN tunnel on the pfSense<\/a> device, I now seem to have a ‘whole house’ VPN since this is a gateway device, it does not seem to differentiate between different devices.<\/p>\n

An additional drawback I discovered was the bandwidth penalty from using the OpenVPN<\/a> tunnel on the firewall.<\/p>\n

I am used to losing a small amount of bandwidth to the VPN, but these figures were just unacceptable.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Test Case<\/th>\nDown<\/th>\nUp<\/th>\n<\/tr>\n
iMac No VPN<\/td>\n386<\/td>\n20.8<\/td>\n<\/tr>\n
iMac pfSense OpenVPN<\/a> to London<\/td>\n152<\/td>\n19.8<\/td>\n<\/tr>\n
iMac pfSense OpenVPN<\/a> to Southampton<\/td>\n205<\/td>\n19.4<\/td>\n<\/tr>\n
iMac PIA app WireGuard<\/a> to London<\/td>\n303<\/td>\n19.5<\/td>\n<\/tr>\n
iMac PIA app WireGuard<\/a> to Southampton<\/td>\n293<\/td>\n19.6<\/td>\n<\/tr>\n
iMac No VPN (CLI)<\/td>\n317<\/td>\n21.2<\/td>\n<\/tr>\n
iMac PIA app WireGuard<\/a> to London (CLI)<\/td>\n234<\/td>\n19.5<\/td>\n<\/tr>\n
Media Server No VPN (CLI)<\/td>\n322<\/td>\n21.0<\/td>\n<\/tr>\n
Media Server PIA WireGuard<\/a> to London (CLI)<\/td>\n317<\/td>\n19.6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The first 5 tests listed above were all performed on my iMac desktop using the Ookla<\/a> Speedtest desktop app for MacOS. <\/p>\n

All the Command Line (CLI) tests were performed using a python script that can be obtained from the following location<\/a>.<\/p>\n

The WireGuard<\/a> PIA<\/a> connection on the media server was setup using the scripts available from the PIA<\/a> GitHub<\/a> repository and are presented for comparison. <\/p>\n

The current PIA<\/a> apps make use of WireGuard<\/a> rather than OpenVPN<\/a>, although until recently it also used OpenVPN<\/a> and even with that option, I rarely lost more than 50-60 Mb\/s.<\/p>\n

I tried to setup a WireGuard<\/a> connection from my pfSense<\/a> firewall using the settings obtained from setting up the media server, however the VPN tunnel would not establish.<\/p>\n

Looks like for now at least I will continue to use the local PIA<\/a> VPN apps for both speed and ease of segregation.<\/p>\n

I did also set up a Radius based VPN tunnel using OpenVPN<\/a> for remote access to my servers by following another one of Tom Lawrence<\/a>‘s Youtube<\/a> videos.<\/p>\n

This one works as expected and I can remotely connect to my servers from my iPad, iPhone or MacBook.<\/p>\n

Throughput bandwitdh is not really a concern for this connection, although I may also see if I can work out how to set it up with WireGuard<\/a>, although all my attempts so far have failed to connect.<\/p>\n","protected":false},"excerpt":{"rendered":"

I have used Private Internet Access (PIA) Virtual Private Network (VPN) tunnels for a number of years now and was keen to find out what else I could do with them. I setup a couple of VPN tunnels using OpenVPN on my pfSense firewall, one to PIA‘s London gateway and one to their Southampton gateway.…<\/p>\n","protected":false},"author":1,"featured_media":91,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[5,3],"class_list":["post-6","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorised","tag-homelab","tag-networking"],"_links":{"self":[{"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/posts\/6","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/comments?post=6"}],"version-history":[{"count":2,"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/posts\/6\/revisions"}],"predecessor-version":[{"id":261,"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/posts\/6\/revisions\/261"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/media\/91"}],"wp:attachment":[{"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/media?parent=6"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/categories?post=6"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.hslracing.com\/myhome\/wp-json\/wp\/v2\/tags?post=6"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}