Building a decent PC for VPN - Is this any good ?

[BarQ]

Not only that, usually it's deployed to keep networks separate, so say that a companies accounting department can't access the systems for the R&D department, and R&D can not access the production network and vice-versa.

Yep, I thought that one was obvious but thanks for explaining.

Even if you set VLANs up on a managed switch it's still on the same hardware and therefore the result of the switches software. Vlan tagging is VLAN tagging, regardless on if you set it up through PFsense (and the PFsense software sets it), or if you set it up on a managed switch (and the switches software sets it), VLAN tagging is VLAN tagging.

So what managed switch is used then ? I know I think that it can provide, IDS/IPS etc but wouldn't be cheaper for business to just use PfSense as it can provide similar capabilities and features but for free ?

When I had my issue with improper shutdown I had just bought my gateway and thought there was something wrong with the device and called NetGate. They are the ones that told me what I was experiencing was because the device was shutdown improperly. The first question out of the guy was to ask me if it had lost power or just gotten unplugged. That's when they said that if it got shutdown wrong it could not only lock you out of the web configuration, but it could create other anomalous behaviors as well.

So, how did you get back into it and fixed it ? When Web Interface is locked I imagine there's no other way to get into the box than either tunnel to it via SSH or do a factory reset and restore the configuration file ?

You can do it that way. Just make sure that you set the network IPs in the routers first. So say the PFsense is 192.168.1.1, you set one router as 192.168.2.1, and the second router as 192.168.3.1. You don't need to setup VLANs to configure it like that and keep network separation.

I'm a bit confused by it, I won't be getting another two routers but rather Wi-Fi access point which I would need to pin via Ethernet Port to the PfSense box. Also, I don't think that changing IP addresses like [PFsense 192.168.1.1 / Access Point 192.168.2.1] would do any good because the Access Point is plugged under PfSense and the users under this AP can for example still run scan PfSense IP and discover various devices connected under PfSense box as well as access it's web configuration page. At least that was the case when I was playing around with normal router without VLANs which then had another router connected on the LAN side. I don't know if I have explained it the right way but I have tried my best to do so.

Also a Zotec box should come with a WIFI card, it'll take some configuration on your part (or so I've read) but you can set it up for wireless too.

In the recent days I have done more research about Intel processors and their security and it looks like I would rather build my own mini box using AMD Ryzen processor because there are new vulnerabilities in Intel's micro chips which affects most of the Intel processors. I know there will be fixes coming down in a couple of weeks but I think until they appear in PfSense it might take some time. COming back to those vulnerabilities, they are called Meltdown and Spectre. There are no cases in the wild but PoC was released and I would rather not risk anything as it's the matter of time until someone figures it out and start attacking various targets.

Now, to the build itself, I just need to look for AMD Ryzen processor which supports AES-NI and it should work fine I presume ?

The last link will show you how to configure VLANs
Helpful links
https://www.techhelpguides.com/2017/06/12/ultimate-pfsense-openvpn-guide/
https://www.infotechwerx.com/blog/Policy-Routing-Certain-Traffic-Through-OpenVPN-Client-Connection
http://supratim-sanyal.blogspot.com/2017/04/pfsense-pfblockerng-ultimate-list-of-ip.html
https://nettb.com/blog/2015/03/pfsense-dns-leak-when-connected-to-vpn-fix/
https://nguvu.org/pfsense/pfsense-baseline-setup/

My main use case is Selective Routing. pfBlocker allows me to create IPv4 lists. I then use the Firewall-Rules-Lan to use the list to route the traffic to the appropriate WAN or VPN interface.

Thanks for providing links. I'm a bit confused about selective routing, why do you need to use it ? Sorry, I'm kindda new to PfSense as it's my first time using it. Also, I have find some security issues with some VPN's and I was wondering when deploying OpenVPN via PfSense I would be vulnerable to it ?

Massive security issue:certain VPN providers on OE. Even tho that it looks like the issue is with a VPN Provider as well as the specificly mentioned "OS", I was wondering if this could expose any internal servers, other computers or simply my my PfSense services like SSH in my network to the internet aka WAN side by just using VPN Provider + OpenVPN ?

It might be a stupid question but I would like to ask to make sure I have the right information, when using OpenVPN on the router level, does that mean we as user's give the VPN provider access to all our network and computers since PfSense is our main router which handles our network and its devices, or does VPN only applies to internet packets when travelling from one location to another ?

 

[Xentrk]

Thanks for providing links. I'm a bit confused about selective routing, why do you need to use it ? Sorry, I'm kindda new to PfSense as it's my first time using it.

As an expat, my use case for selective routing is for streaming media and getting around geo restrictions. For example, I can route one streaming media services to a major market area to get a better selection of channels. I can route two other streaming media services to my private VPN server to get around their VPN blocks.

Massive security issue:certain VPN providers on OE. Even tho that it looks like the issue is with a VPN Provider as well as the specificly mentioned "OS", I was wondering if this could expose any internal servers, other computers or simply my my PfSense services like SSH in my network to the internet aka WAN side by just using VPN Provider + OpenVPN ?

Just don't expose services to the WAN, especially SSH. If you host a web server or need to have ports open, then Snort or Suricata will be of help.

It might be a stupid question but I would like to ask to make sure I have the right information, when using OpenVPN on the router level, does that mean we as user's give the VPN provider access to all our network and computers since PfSense is our main router which handles our network and its devices, or does VPN only applies to internet packets when travelling from one location to another ?

The VPN provider does not get access to your network or devices on the network when connected to their VPN server. pfSense firewall blocks access attempts when connected to the VPN server.

 

[BarQ]

I can route two other streaming media services to my private VPN server to get around their VPN blocks.

Does that means you can use one VPN Account and set it to different countries and then route a specific network device to a choice of the country instead of routing every device via one country ?

Just don't expose services to the WAN

You mean, no port forwarding ? Doesn't having any type of server on LAN expose it to a VPN Provider anyway when you have a standard router ?

The VPN provider does not get access to your network or devices on the network when connected to their VPN server. pfSense firewall blocks access attempts when connected to the VPN server.

Is that the case for a non pfSense routers as well ?

 

[Xentrk]

Does that means you can use one VPN Account and set it to different countries and then route a specific network device to a choice of the country instead of routing every device via one country ?

Yes, one VPN account. I have three OpenVPN clients active. My provider allows up to five concurrent connections. But I run three on my pfSense and three on my Asus router at the same time with no issue.

You mean, no port forwarding ? Doesn't having any type of server on LAN expose it to a VPN Provider anyway when you have a standard router ?

With pfSense, you can specify what clients use the VPN and which ones use the WAN via the LAN firewall rules page. If you have groups of clients that need to use the WAN, you can create an alias which lists their LAN IP addresses. Then, create one rule for these clients and refer to the Firewall Alias name that you created. Do the same for the VPN clients. The selective routing link I posted earlier will show how you how to do it.

I don't have a use case for port forwarding so I can't speak to it from personal experience. I did a google search on "port forward pfsense" and a lot of instructions come up. Port Forwarding thru a VPN tunnel requires a different setup. I use Torguard. Here is a snip from their FAQ.

Answer: Yes we do, port forwarding is limited to ports above 2048 and through openvpn, we do not support port forwarding through the following protocols PPTP/L2TP/SSTP. To open a port, login to your client area dashboard and next to your service click the menu option Management Actions >> Request Port Forward next to your VPN service. That will then be processed instantly, you will then receive an activation email with instructions on how to use it within the TG Client. Once thats processed login to your client area dashboard and next to your service click the menu option Management Actions >> Port Management next to your VPN service to manage your ports.

If you have a client that does not need to go thru the VPN tunnel that you need to port forward, you don't need to coordinate with the VPN provider. A web search will give you many helpful instructions. Here are two from pfSense.

https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting
https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

Is that the case for a non pfSense routers as well ?

The technique differs depending on the firmware.

Hope this helps. Please keep us posted on your build. I will soon receive a computer with an i5 chip that supports AES-NI and has a NIC card with many ports. I plan to turn it into a pfSense box. I am curious to see how much improvement I can get with the OpenVPN performance.

 

[BarQ]

Yes, one VPN account. I have three OpenVPN clients active. My provider allows up to five concurrent connections. But I run three on my pfSense and three on my Asus router at the same time with no issue.

Wow, that's pretty cool ! I even didn't knew you could do it on the router level .

With pfSense, you can specify what clients use the VPN and which ones use the WAN via the LAN firewall rules page.

What do you mean by client using WAN ? I'm a bit confused here, you mean that the client doesn't go through VPN connection if they use WAN ? I think there wouldn't be any connection to a device if they didn't use WAN ? I know that for example Modems or Routers uses WAN's because they are directly connected to the internet.

I don't have a use case for port forwarding so I can't speak to it from personal experience.

When I said about port forwarding, I was referring more to the bit when you said about exposing devices to WAN, especially SSH. In my mind it was Port Forwarding such devices because to expose them you first need to port forward for example SSH/FTP server in the router via LAN IP or put it in the DMZ zone which is not secure.

Hope this helps. Please keep us posted on your build. I will soon receive a computer with an i5 chip that supports AES-NI and has a NIC card with many ports. I plan to turn it into a pfSense box. I am curious to see how much improvement I can get with the OpenVPN performance.

Are you going to wait when PfSense releases Meltdown & Spectre patches or you just don't care because there is nothing in the wild yet ?

 

[JJQuin]

pfSense has a lot of benefits, but if the ONLY reason your doing a PC/pfSense router over a standard router is to get faster VPN speeds you could go cheaper with a $200 ASUS RT-AC86U. It has hardware encryption in the CPU (aes-ni). I recently purchased one and I get great VPN speeds.

No VPN - 118mbps
PIA VPN - 114mbps
NordVPN - 114mbps
ExpressVPN - 65mbps

All three VPN services would be faster than the 50mbps you are looking for.

ASUS RT-AC86U - Merlin 382.2_beta2

 

[Xentrk]

What do you mean by client using WAN ? I'm a bit confused here, you mean that the client doesn't go through VPN connection if they use WAN ? I think there wouldn't be any connection to a device if they didn't use WAN ? I know that for example Modems or Routers uses WAN's because they are directly connected to the internet.

By default, your router is connect to the WAN via your ISP. You can configure pfSense to route all traffic to the VPN tunnel. My provider only provides instructions for this scenario. But one of the links I posted will show you how to configure selective routing for clients so you can choose what clients use the WAN and what devices use the OpenVPN Clients.

Are you going to wait when PfSense releases Meltdown & Spectre patches or you just don't care because there is nothing in the wild yet ?

Once the computer is freed up next month, I plan to turn it into a pfSense appliance. There is an update on pfsense.org regarding the patches. I will apply the patches once they are available. No need to put the project on hold.

 

[BarQ]

pfSense has a lot of benefits, but if the ONLY reason your doing a PC/pfSense router over a standard router is to get faster VPN speeds you could go cheaper with a $200 ASUS RT-AC86U. It has hardware encryption in the CPU (aes-ni). I recently purchased one and I get great VPN speeds.

No VPN - 118mbps
PIA VPN - 114mbps
NordVPN - 114mbps
ExpressVPN - 65mbps

All three VPN services would be faster than the 50mbps you are looking for.

ASUS RT-AC86U - Merlin 382.2_beta2

At the beginning it was like that but when I saw what I can do with pfSense it would actually benefit me more than normal router as it has more advanced functionality which I would like to use

P.S I have tried to look for ASUS RT-AC86U a long time ago but as far as I know, it's unfortunately not available in my region until I import it from abroad but that doesn't matter now as I want to set-up pfSense.

 

[BarQ]

I actually linked the wrong one I should have given you a link to the C1527.

Do you think that CI527 box is able to handle Snort/Suricata while handling multiple devices in the network or is it too weak to do it ?

 

[FatherLandDescendant]

Do you think that CI527 box is able to handle Snort/Suricata while handling multiple devices in the network or is it too weak to do it ?

Should do fine.

 

[sfx2000]

pfSense has a lot of benefits, but if the ONLY reason your doing a PC/pfSense router over a standard router is to get faster VPN speeds you could go cheaper with a $200 ASUS RT-AC86U. It has hardware encryption in the CPU (aes-ni). I recently purchased one and I get great VPN speeds.

Comparing pfSense to AsusWRT is like Apples and Oranges - far more capability with pfSense (and accordingly, more challenges to configure perhaps).

 

[sfx2000]

Do you think that CI527 box is able to handle Snort/Suricata while handling multiple devices in the network or is it too weak to do it ?

Should be fine - one challenge could be the realtek ethernet chips - should be ok, but pfSense does tend to prefer Intel there...

 

[RMerlin]

Apples and Oranges

Are you implying that iPhones don't work on Orange's network?

 

[Xentrk]

@BarQ,

Here are the links to the pfBlockerNG articles I used to help me configure my firewall.

http://benoliver999.com/technology/2016/02/27/howtoblockadswithpfblocker/
https://www.malwarepatrol.net/pfblockerng-configuration-guide/
May not be working: https://www.fredmerc.com/2016/07/pfsense-adblock-using-pfblockerng-guide/
http://supratim-sanyal.blogspot.com/2017/04/pfsense-pfblockerng-ultimate-list-of-ip.html

Create an account in the pfSense forum site and maybe I'll see you there. I tend to spend more time on this forum site though.

 

[FatherLandDescendant]

Here are the links to the pfBlockerNG articles I used to help me configure my firewall.

Only the first and last link worked for me...

 

[BarQ]

@BarQ,

Here are the links to the pfBlockerNG articles I used to help me configure my firewall.

http://benoliver999.com/technology/2016/02/27/howtoblockadswithpfblocker/

http://www.malware.com.br/howto_pfBlockerNG.shtml

https://www.fredmerc.com/2016/07/pfsense-adblock-using-pfblockerng-guide/

http://supratim-sanyal.blogspot.com/2017/04/pfsense-pfblockerng-ultimate-list-of-ip.html

Create an account in the pfSense forum site and maybe I'll see you there. I tend to spend more time on this forum site though.

Thanks for the links, I will take a look at them.
Tho, I just have one question regarding pfBlockerNG, could that tool conflict with a DNS service which blocks various malicious or spam websites ?
I'm asking since pfBlockerNG is using DNS Black listing which will probably conflicts with the DNS services I was talking about above.

 

[Xentrk]

Only the first and last link worked for me...

I updated the second link. The third one appears to be down. I get hits when doing a web search though. The last link is probably the best one. But still good to look at other sources. There may be newer references available. It has been a little over one year since I last researched pfBlockerNG. I really like the features. But it takes some getting used to.

 

[Xentrk]

pfBlockerNG setup video from Lawrence Systems

 

[FatherLandDescendant]

I updated the second link. The third one appears to be down. I get hits when doing a web search though. The last link is probably the best one. But still good to look at other sources. There may be newer references available. It has been a little over one year since I last researched pfBlockerNG. I really like the features. But it takes some getting used to.

I need to do some more tinkering with it, I think I have something configured wrong, CRON looks like it is stuck in updating on the update tab, my CPU usage has spiked from under 20%+- with no network load and 30%+- with an active torrent, to staying at a consistent 60% with no load and when I have an active torrent it hits 100%. Is this normal? Since I put this package in it has affected my speed test results too cutting them in half. I have PIA set up on this gateway as well as Snort, but even with just those two my speed test readings were around 116Mbps down, now they are 60ish Mbps. I even have it disabled and CRON is still spinning on the update tab???

 

[charlieminty]

There is no way to achieve the same speed with VPN as without VPN. If that is your goal you're wasting your money. There is always going to be VPN overhead no matter how fast the processor.