# OpenVPN in pfSense on VK Cloud

> Configure OpenVPN server on pfSense in VK Cloud - certificate generation, tunnel setup, firewall rules, and remote client access to your private network

Source: https://opennix.org/en/docs/vk/vk-cloud-pfsense/openvpn-setup/


Configuring OpenVPN for access to the private network segment.

1. The first step is to install the openvpn-client-export package. Open the web interface and navigate to "System --> Package Manager --> Available Package"s. In the search bar enter openvpn-client-export package and click “Install”. 
   
The user must wait for the installation to complete (see Figure 1). 

![Installing openvpn-client-export package in pfSense](/img/openvpn-client-export.webp)
<p style="text-align: center;">Figure 1. OpenVPN-client-export Installation</p>

2. Once the package is installed, the user can proceed with the configuration. Navigate to "VPN --> OpenVPN" and select "Wizards". In this example, "Local User Access" will be selected for authentication  (see Figure 2). 

![OpenVPN wizard setup in pfSense](/img/openvpn-server-st1.webp)
<p style="text-align: center;">Figure 2. Setting up Openvpn-client-export</p>

The user should click the “Next” button and, on the following screen, create a Certification authority (see Table 1). 

|     Name                |        Description                                                |
|---------------------|--------------------------------------------------------|
| Descriptive name    | Common name                                            |
| Common Name         | Internal name, if empty, Descriptive name will be used |
| Country Code        | Two-letter country code                                |
| State or Province   | Full name of the state/province                        |
| City                | City Name                                              |
| Organization        | Name of organization                                   |
| Organizational Unit | Division/Department Name                               |

<p style="text-align: center;">Table 1. Certification authority</p>

After entering all the required data, click the “Add new CA” button and repeat the same steps for the "Server Certificate".

3. Once the certificates are created, the user can move on to configuring the OpenVPN server.
   
The first step is to fill in the "Description" field (see Figure 3). 

![OpenVPN server general information](/img/openvpn-server-st2.webp)
<p style="text-align: center;">Figure 3. Enter the General Server Information </p>

4. The next step is to select the Protocol, Interface, and Local Port for the server (see Figure 4). 

![OpenVPN server protocol and port selection](/img/openvpn-server-st3.webp)
<p style="text-align: center;">Figure 4. Protocol, Interface, and Port Information</p>

5. The user needs to configure the tunnel (see Figure 5).

![OpenVPN tunnel configuration settings](/img/openvpn-server-st4.webp)
<p style="text-align: center;">Figure 5. Tunnel Configuration</p>

The following parameters must be completed:

- **IPv4 Tunnel Network**: Specifies the network range allocated to the clients. Ensure that it does not overlap with the user's existing networks.
- **IPv4 Local Network**: Defines the network that will be accessible from the VPN network.

All other settings can be customized as needed. Once all required settings are configured, click the Next button to proceed.

6. The next step is to select the Firewall Rule and OpenVPN rule (see Figure 6). 

![Firewall and OpenVPN rule configuration](/img/openvpn-server-st5.webp)
<p style="text-align: center;">Figure 6. Configuring Firewall and OpenVPN</p>

Click “Next” and then “Finish”. After these steps, the new server should appear in the list (see Figure 7). 

![OpenVPN servers list in pfSense](/img/openvpn-servers.webp)
<p style="text-align: center;">Figure 7. OpenVPN Servers Window</p>

7. Navigate to "System → User Manager → Users" and click the "Add" button. Enter the desired username and password for the new user (see Figure 8).

![Adding a new VPN user in pfSense](/img/vpnuser.webp)
<p style="text-align: center;">Figure 8. Adding a new User</p>

8. It is necessary to configure the certificate. To do this, fill in all fields in the Create Certificate for Users window and select the Certificate Authority that was created during the OpenVPN server configuration (see Figure 9). 

![Creating a certificate for OpenVPN user](/img/certificate.webp)
<p style="text-align: center;">Figure 9. Creating a Certificate</p>

After completing all the fields, the user must click the Save button.

To continue with the configuration, navigate to "VPN → OpenVPN" and open the "Client Export" tab. In the "Client Connection Behavior" section, select "Other" and enter the public IP address or domain name, if available (see Figure 10).

![OpenVPN client connection behavior configuration](/img/hostname.webp)
<p style="text-align: center;">Figure 10. Configuring Connection Behavior for Clients</p>

Next, select our user and export the configuration.

9. In the OpenVPN Clients window, the user must select the newly created user and export the configuration (see Figure 11).

![OpenVPN client configuration export](/img/export.webp)
<p style="text-align: center;">Figure 11. OpenVPN clients Window</p>

The client is configured according to the user's OS.


