Voir la source de Linux:Configuration d'un client VPN sur un pfSense

== But ==
Installer et configurer un client VPN avec [https://openvpn.net OpenVPN] sur un dispositif [https://www.pfsense.org pfSense].

== Étape préliminaire ==
Avant de commencer:
* il est impératif de disposer d'un [[Linux:Configuration d'un serveur VPN sur un VPS hébergé|serveur VPN]];
* et assurez-vous que votre dispositif pfSense répond bien au PING.

== Installation ==
Sur PfSense, OpenVPN est installé par défaut.

== Configuration ==
* Commencer par [[Commandes:Génération de certificats SSL client|créer la clé et le certificat SSL de votre client]] en vous assurant d'avoir:
** un CN correspondant au nom ou à l'adresse IP du client vue par le serveur VPN (en principe il s'agit de l'adresse publique - dans notre exemple ce sera [[Linux:Configuration d'un serveur VPN sur un VPS hébergé#But|siteA.minetti.org]]);
** un '''keyUsage''' avec <u>uniquement</u> digitalSignature et/ou keyAgreement;
** un '''extendedKeyUsage''' avec clientAuth (TLS Web Client Authentication);
** et un '''nsCertType''' avec client.
* Récupérer le certificat CA ayant servi à la certification du certificat client et l'enregistrer dans pfSense dans les '''CAs''' (menu '''System''' / '''Certificate Manager''') en cliquant sur le bouton '''Add''' et en renseignant les champs suivants:
** Descriptive name: ''le nom que vous voulez donner à votre CA (par exemple: cacert)'';
** Method: Import an existing Certificate Authority;
** Certificate data: ''tous le contenu de votre certificat'';
** Private key data: ''le contenu de votre clé comprenant BEGIN CERTIFICATE et END CERTIFICATE'';
* Mettre la clé et le certificat SSL précédemment créé dans pfSense dans les '''Certificates''' (menu '''System''' / '''Certificate Manager''') en cliquant sur le bouton '''Add/Sign''' et en renseignant les champs suivants:
** Method: Import an existing Certificate;
** Descriptive name: ''le nom que vous voulez donner à votre certificat (par exemple: siteA)'';
** Certificate data: ''le contenu de votre CA comprenant BEGIN CERTIFICATE et END CERTIFICATE'';
* Afficher la liste des clients OpenVPN (onglet '''Clients''' du menu '''VPN''' / '''OpenVPN''') et cliquer sur le bouton '''Add''';
* Renseigner les champs suivants:
** Server mode: Peer to Peer (SSL/TLS);
** Protocol: UDP on IPv4 only;
** Device mode: tun - Layer 3 Tunnel mode;
** Interface: WAN;
** Server host or address: ''l'adresse IP du serveur VPN (par exemple: vps.minetti.org)'';
** Server port: 1194;
** Description: ''la description du serveur VPN'';
** TLS Configuration: ''cocher la case à cocher'' Use a TLS Key;
** TLS Key: ''récupérer la clé du HMAC firewall, '''ta.key''', sur le serveur et mettre son contenu ici'';
** TLS Key Usage Mode: TLS Authentication;
** Peer Certificate Authority: ''votre CA (par exemple: cacert)'';
** Client Certificate: ''votre certificat (par exemple: siteA)'';
** Encryption Algorithm: BF-CBC (128 bit key by default, 64 bit block);
** Enable NCP: ''non coché'';
** Auth digest algorithm: SHA1 (160-bit);
** Hardware Crypto: No Hardware Crypto Acceleration;
** Compression: LZO Compression [compress lzo, equivalent to comp-lzo yes for compatibility];
** Topology: Subnet - One IP address per client in a common subnet;
** Custom options:
 remote-cert-tls server

== Test ==
* Une fois le client VPN créé, vérifier que les logs ressemblent à ceci (onglet '''OpenVPN''' du menu '''Status''' / '''System Logs'''):
 Dec 29 13:38:57 	openvpn 	30851 	OpenVPN 2.4.4 amd64-portbld-freebsd11.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Nov 16 2017
 Dec 29 13:38:57 	openvpn 	30851 	library versions: OpenSSL 1.0.2m-freebsd 2 Nov 2017, LZO 2.10
 Dec 29 13:38:57 	openvpn 	31054 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
 Dec 29 13:38:57 	openvpn 	31054 	TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
 Dec 29 13:38:57 	openvpn 	31054 	UDPv4 link local (bound): [AF_INET]y.y.y.y:0
 Dec 29 13:38:57 	openvpn 	31054 	UDPv4 link remote: [AF_INET]x.x.x.x:1194
 Dec 29 13:38:57 	openvpn 	31054 	[vps.minetti.org] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
 Dec 29 13:38:58 	openvpn 	31054 	WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
 Dec 29 13:38:58 	openvpn 	31054 	WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
 Dec 29 13:38:58 	openvpn 	31054 	WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.
 Dec 29 13:38:58 	openvpn 	31054 	TUN/TAP device ovpnc1 exists previously, keep at program end
 Dec 29 13:38:58 	openvpn 	31054 	TUN/TAP device /dev/tun1 opened
 Dec 29 13:38:58 	openvpn 	31054 	do_ifconfig, tt->did_ifconfig_ipv6_setup=0
 Dec 29 13:38:58 	openvpn 	31054 	/sbin/ifconfig ovpnc1 10.8.0.10 10.8.0.1 mtu 1500 netmask 255.255.255.0 up
 Dec 29 13:38:58 	openvpn 	31054 	/usr/local/sbin/ovpn-linkup ovpnc1 1500 1542 10.8.0.10 255.255.255.0 init 
 Dec 29 13:38:58 	openvpn 	31054 	WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
 Dec 29 13:38:58 	openvpn 	31054 	Initialization Sequence Completed
* Du côté du '''serveur''', les logs doivent ressembler à ceci:
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 TLS: Initial packet from [AF_INET]y.y.y.y:3013, sid=1aa82210 f0ed027b
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 <span style="color:red">'''VERIFY OK'''</span>: depth=1, C=FR, ST=Herault, L=Saint-Jean-de-Vedas, O=Minetti, CN=MINETTI CA, emailAddress=jp@minetti.org
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 <span style="color:red">'''VERIFY OK'''</span>: depth=0, C=FR, ST=Herault, L=Saint-Jean-de-Vedas, O=Minetti, OU=siteA (client), CN=siteA.minetti.org, emailAddress=root@minetti.org
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
 Tue Apr 12 17:23:35 2016 y.y.y.y:3013 [siteA.minetti.org] Peer Connection Initiated with [AF_INET]y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 OPTIONS IMPORT: reading client specific options from: '''ccd/siteA.minetti.org'''
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 10.8.0.10 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: primary virtual IP for siteA.minetti.org/y.y.y.y:3013: 10.8.0.10
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: internal route 192.168.3.0/24 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.3.0/24 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: internal route 192.168.2.0/24 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.2.0/24 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: internal route 192.168.1.0/24 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.1.0/24 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: internal route 192.168.0.0/24 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.0.0/24 -> siteA.minetti.org/y.y.y.y:3013
 Tue Apr 12 17:23:38 2016 siteA.minetti.org/y.y.y.y:3013 PUSH: Received control message: 'PUSH_REQUEST'
 Tue Apr 12 17:23:38 2016 siteA.minetti.org/y.y.y.y:3013 send_push_reply(): safe_cap=940
 Tue Apr 12 17:23:38 2016 siteA.minetti.org/y.y.y.y:3013 SENT CONTROL [siteA.minetti.org]: 'PUSH_REPLY,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,route 192.168.5.0 255.255.255.0 10.8.0.1,ifconfig 10.8.0.10 255.255.255.0' (status=1)
 Tue Apr 12 17:24:01 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.0.229 -> siteA.minetti.org/y.y.y.y:3013
* Vérifier le routage ('''Diagnostics''' / '''Routes'''):
 Destination	 Gateway	Flags	Use	Mtu	Netif	Expire
 default         88.127.168.254	UGS	499905	1500	igb1	
 10.8.0.0/24     10.8.0.1	UGS	0	1500	ovpnc1	
 10.8.0.1        link#8	        UH	20454	1500	ovpnc1	
 10.8.0.10       link#8	        UHS	3	16384	lo0	
 88.127.168.0/24 link#2	        U	19642	1500	igb1	
 88.127.168.146  link#2	        UHS	0	16384	lo0	
 127.0.0.1       link#4	        UH	301	16384	lo0	
 192.168.0.0/24  link#3	        U	908469	1500	igb2	
 192.168.0.254   link#3	        UHS	0	16384	lo0	
 192.168.1.0/24  10.8.0.1	UGS	26	1500	ovpnc1	
 192.168.5.0/24  10.8.0.1	UGS	1247	1500	ovpnc1	
 192.168.11.0/24 link#1	        U	0	1500	igb0	
 192.168.11.254  link#1	        UHS	0	16384	lo0
* Faire un ping vers le serveur VPN ('''Diagnostics''' / '''Ping'''):
 PING 10.8.0.1 (10.8.0.1): 56 data bytes
 64 bytes from 10.8.0.1: icmp_seq=0 ttl=64 time=104.899 ms
 64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=105.345 ms
 64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=107.325 ms
 
 --- 10.8.0.1 ping statistics ---
 3 packets transmitted, 3 packets received, 0.0% packet loss
 round-trip min/avg/max/stddev = 104.899/105.856/107.325/1.054 ms