Stay on the Servers tab, cause we want to create a server. Scroll to the bottom of the page and click the green Add button: Now that we have our certificates we are ready to create our VPN server. Now let’s add another one but here we will set the descriptive name to bb-client-SOMETHING and the certificate type to User Certificate, the digest remains sha256: Set the Digest to sha256, the type to Server Certificate and fill in the rest of the required fields as applicable: We don’t wan’t to import but rather create a new one, so let’s start by creating a server certificate. Give it a descriptive name, in my case it will be bb-server-SOMETHING, where SOMETHING is the remote locations name. The Add a New Certificate screen will appear: In my case I have a lot, so i scroll to the bottom to Add a new one:
At the very least there will be the webConfigurator present: Navigating to Certificates we will see our certificates.
In my case we will be using the one that starts with bb (it stands for Back-Bone): If you don’t already have a dedicated CA for site to site VPNs than I highly suggest setting up one here. The Certificate Manager screen will default to the CAs, where u can see your Certificate Authorities. Log in to pfSense and go to System -> Cert. Of course after applying the settings it will disconnect because of the network change: After we connect via winbox go to Quick Set:Īnd change the defaults to suit our needs: If you don’t know how to do that please refer to this tutorial to get you started. Let’s first connect to our router and set up the bare minimum. In my scenario the client’s local network will be 192.168.11.0/24 and the server’s 192.168.0.0/24. Out encryption will be AES with a key size of 256bit (the maximum that RouterOS supports on this router as of now). Only the local networks will be shared between the two sites, sharing the external address of the server with the client is out of scope of this tutorial. Our client will be a Routerboard RB2011 detailed in a earlier post that connects to a pfSense server. We’ll be taking advantage of pfSenses superb certificate management features to do SSL/TLS instead of just a pre-shared key. In this tutorial we will look at how to set up a site to site VPN between a pfSense server and a Mikrotik client using OpenVPN the proper way.
0 kommentar(er)
