How to configure OpenVPN shared key tunnels using pfSense and OpenWRT.

Ver. 1.0 (11.1.2006)

Author: Ville Leinonen

Intro
In this document I try to explain how to configure ssl-based site-to-site tunnels using pfSense /1/ and
OpenWRT /2/. In this example I use shared key, because it’s easiest way to set up site-to-site
tunnel. Bad thing for this is that I can use only one tunnel/key, but it’s enough for me. This document
assume that reader have some experience how to use pfSense and OpenWRT.

Enviroment

Bellow is picture for this document example environment. WAN address for pfSense is picked up in
my head.

Picture 1. Example network environment.

Home office: LAN: 10.0.0.0/24

WAN: dhcp
Tun0: 10.0.8.2

pfSense: LAN: 192.168.0.0/24

WAN: 212.212.212.1
Tun0: 10.0.8.1

Generating key

You must generate shared static key.

Step 1. Take ssh session to your pfSense firewall.

Step 2. Select 8 and press enter.

pfSense console setup

***********************
0) Logout (SSH only)
1) Assign Interfaces
2) Set LAN IP address
3) Reset webConfigurator password
4) Reset to factory defaults
5) Reboot system
6) Halt system
7) Ping host
8) Shell
9) PFtop
10) Filter Logs
11) Restart webConfigurator

Enter an option: 8
 Step 3. Generate key
# openvpn --genkey --secret /tmp/myshared.key

Example key:
# more /tmp/myshared.key
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
ef9b9f0bff2268eb3966d6a408398db1
f7e6f9823402c76560d1ce25b8d46be4
1c58e656d2e7633d2481e74b9e328618
3c9e6a7528a46b2474bc08838ae19a4c
7f19878bd381cf8cfb0c4dc14fa52622
7360921e50710d0af689476388df0a25
54e1e86b2c9fcc4139dba763b97861bc
36cd477c6f293e8ca07e1bffaba697bf
948b65c213c5747cf0645fb7886bac4b
893953f697640dff961b95cfd8d2c0f3
ef976540e9c004ed72494648462496be
969a70e7d53910f3415f8d829bdb192e
b4aad90e91baec25cac0b260205823e9
e945938896fdd9d33a56c44b90cbd5ce
0d0373923e2cdd33192fdfb4d06399fd
9eb0321402aadb116004721c5249ce61
-----END OpenVPN Static key V1-----

Step 4. Copy key into your computer.

Step 5. Delete generated key file.
# rm /tmp/myshared.key
Step 6. Logout
# exit
Step 7. Choose 0 and press enter.

Setup pfSense

This document assumes that you have existing and working pfSense environment.

Step 1. Select OpenVPN link.

Step 2. Select add “new server button”.

…

Step 3. Create OpenVPN server.

- Protocol : TCP (this is communication protocol)

- Local port 1194 (server listens this port)
- Address pool: 10.0.8.0/24 (client takes tun0 address from this pool)
- Cryptography: BF-CBC (128-bit) (we use this cryptography cipher algorithm)
- Authentication method: Share key (paste here your generated key)
- LZO compression (put mark for this)
- Description: OPTIONAL Insert tunnel description
- Click Save.
Step 4. Select Rules.

Step 5. Select “Add new rule”.

Step 6. Add rule to allow OpenVPN tunnel traffic.

- Action: Pass (allow traffic)

- Interface: WAN (select WAN interface if your client connects this interface/address)
- Protocol: TCP
- Log: Put mark here (Yes we want to log this traffic)
- Destination port range: 1194 (allow OpenVPN tunnel connections)
- Description: OPTIONAL Insert rule description
- Click Save
Setup OpenWRT

This document assumes that you have working OpenWRT environment.

This document assumes that you have update your OpenWRT packages list access to backports.

Step 1. Take ssh session to your OpenWRT box.

Step 2. Paste your key file /etc/openvpn directory. (OpenWRT use vi editor. vi help /3/)
# vi /etc/openvpn/myshared.key
- Inside vi press Esc and then i
- Paste your key
- Press Esc
- Write :wq! and press enter
Step 3. Generate configuration file to /etc/config/ directory

dev tun0 # Generate/use tunnel 0

proto tcp-client # Use tcp
keepalive 10 60 # Some ping like messages
persist-tun # Some persist options
persist-key # Some persist options
ifconfig 10.0.8.2 10.0.8.1 # Tun0 ip-address
route 192.168.0.0 255.255.255.0 # Route for corporate network
remote 212.212.212.1 1194 # OpenVPN server address
resolv-retry infinite # Some Road warrior stuff
nobind # We don’t need to specific port number
mute-replay-warnings # Some WLAN stuff
secret /etc/openvpn/myshared.key # Where our secret file is located
comp-lzo # Enable compression
verb 3 # Log verbosity

Example. myopenvpn.cfg file

Step 4. Generate startup script for /etc/init.d directory.

# Make sure that tun module is loaded

insmod tun
# Start OpenVPN daemon
openvpn --daemon --config /etc/config/openvpn.oma --ifconfig-nowarn
# Allow traffic to tunnel /4/
iptables -A INPUT -i tun+ -j ACCEPT
# Allow forwarding traffic from tunnel
iptables -A FORWARD -i tun+ -j ACCEPT
# Allow forwarding traffic from br0 interface to tunnel
iptables -A FORWARD -i br0 -o tun+ -j ACCEPT

Example. S98openvpn file

Step 5. Restart your OpenWRT box and watch your pfSense firewall and OpenVPN logs.

There should be something like this

Jan 11 12:52:47 openvpn[9494]: Initialization Sequence Completed
Jan 11 12:52:46 openvpn[9494]: Peer Connection Initiated with xxx.xxx.xxx.xxx:4356
Jan 11 12:52:46 openvpn[9494]: TCPv4_SERVER link remote: xxx.xxx.xxx.xxx:4356
Jan 11 12:52:46 openvpn[9494]: TCPv4_SERVER link local (bound): [undef]:1194
Jan 11 12:52:46 openvpn[9494]: TCP connection established with xxx.xxx.xxx.xxx:4356

Links
/1/ http://www.pfsense.com
/2/ http://www.openwrt.org
/3/ http://unixhelp.ed.ac.uk/vi/index.html
/4/ http://www.netfilter.org