Using pfSense with Mullvad

ROUTERS

最終更新時刻: 6 7月 2023


This guide was verified with pfSense 2.7.0-RELEASE.

As you follow this guide, always click on any Apply or Save button as you make changes in order to reload your new settings.

This guide is using OpenVPN. For using WireGuard see the guide pfSense with WireGuard.

Get your ca.crt

  1. Go to the OpenVPN configuration file generator.
  2. Use Linux as Platform.
  3. Select a Location.
  4. Click on Download zip archive and save it to your computer.
  5. Extract the zip file.
     

Add the Ca.crt to the Certificate Manager

  1. Log in to your pfSense device click on "System" -> "Cert. manager"(pfSense 2.7.0 it's called "Certificates)  -> "CAs"(pfSense 2.7.0 it's called "Authorities") and then click on "+Add"
  2. Edit the descriptive name and name it Mullvad CA .
  3. Set the Method to Import an existing Certificate Authority
  4. Paste the certificates found in mullvad_ca.crt that was extracted earlier into the "Certificate data" field.
  5. Click on Save.


 

Add a VPN connection

This example will make use of se-got-ovpn-010.relays.mullvad.net. You can of course replace this server with any other country, region, or specific server that you wish to use. See our list of available servers.

Click on VPN -> OpenVPN -> Clients  and then click on +Add

  1. Set Description to: se-got-ovpn-010
  2. Set Server Mode to: Peer to Peer (SSL/TLS)
  3. Set Device mode to: tun Layer 3 Tunnel Mode
  4. Set Protocol to: UDP on IPV4 only
  5. Set Interface to: WAN
  6. Set Server host to: 185.213.154.140 (Which is se-got-ovpn-010.relays.mullvad.net)
  7. Set Server port to: 1301
  8. Under User Authentication Settings set Username to: <Mullvad account number> (Make sure it does not contain any spaces)
  9. Set Password to: M
  10. Set TLS Configuration to: Unchecked
  11. Set Peer Certificate Authority to: Mullvad CA
  12. Set Client Certificate to: None (Username or Password required)
  13. Set Data Encryption Negotiation to: Checked
  14. Set Data Encryption Algorithms to: AES-256-GCM
  15. Set Fallback Data Encryption Algorithm to AES-256-CBC
  16. Set Auth digest algorithm to: SHA384
  17. Set Allow Compression to: Decompress incoming, do not compress outgoing (Asymmetric)
  18. Set Compression to: Disable Compression [Omit Preference]
  19. In the Custom options field, paste:  remote-cert-tls server
  20. Set UDP Fast I/O to : Checked
  21. Set Send/Recieve Buffer to: 1.00 MiB
  22. Click Save

 

 

Add an Interface 

  1. Click on Interfaces -> Assignments
  2. Use the Drop-down menu for the Available network ports: and select ovpnc*  and then click on +Add
  3. Click on the New interface name, it is usually named OPT1 or OPT2.
  4. Set Enable:  Enable Interface to be checked
  5. Click on Save.
     

Add NAT rules

  1. Click on Firewall -> NAT -> Outbound and then select Mode: "Manual Outbound NAT rule Generation (AON) and then click on Save.
  2. Copy the entry that contains your local IP address (The one that does not contain port 500 nor 127.0.0.0 , In this example 172.17.1.0/24 is used, for you this will most like differ and will probably be 192.168.1.0/24)  by clicking on the Copy icon found under Actions to the right of the NAT entry (Add a new mapping based on this one)
  3. Click on the Pen icon (Edit mapping)  and change so that interface is the mullvad one and write a description.
  4. Make sure that both Disabled and do not NAT are unchecked
  5. Delete the other rules that contain your local IP that exists via WAN , (keep the 127.0.0.0) This will ensure that you can not reach the internet if the VPN tunnel is down from your clients behind the pfSense router.
  6. Click on Save.


 

DNS

  1. Click on Services
  2. Click on DHCP server
  3. Set DNS server 1 to: 10.8.0.1
  4. Click on Save

After you have completed these steps, click on Status -> OpenVPN -> and then click on the Restart openvpn Service to reload it all.
 

Easily check your online privacy with Am I Mullvad

While you're connected to Mullvad, your browser could still be leaking information and therefore jeopardizing your privacy. With our Connection check, you can now get a quick overview of your connection status.
 

Split-tunneling

In this example you will route 8.8.4.4 outside the VPN to the client 192.168.1.101

Adding a NAT rule

  1. Go to Firewall -> NAT -> Outbound -> Add
  2. Set Interface to WAN
  3. Set Address Family to IPv4
  4. Set Protocol to any
  5. Set Source type to Network and 192.168.1.101 / 32 for the client you wish to go outside the VPN.
  6. Set Destination type to Network and 8.8.4.4 / 32 for the Destination network
  7. Click on Save and Apply Changes, and make sure the new rule is higher than the VPN nat rule.

Add a static rule

  1. Go to System -> Routing -> Static Routes
  2. Click on "+Add"
  3. Set Destination network to 8.8.4.4
  4. Set Gateway to WAN_DHCP (or WAN)
  5. Click on Save and Apply Changes

Troubleshooting

I am running an older version of pfSense (2.3.x) and some things are not available or renamed. Where do I configure them?

TLS authentication is now called TLS Configuration.

UDP Fast I/O is not available as a checkbox icon on pfSense 2.3.x.

Send / Receive Buffers dropdown menu is not available on pfSense 2.3.x.