PfSense Configuration

[Dannyzen]

Curious if anyone has any success with setting PfSense up to use an algo enabled server and if they wouldn't mind sharing how they went about applying their configuration.

[professoruss]

I'm working on getting this working with not so great of success so far.
My fork is located here: master...professoruss:pfsense_is_silly
It seems as if PFSense either only lists sha256 instead of sha2-256 even though the latter is available in the shell, just not exposed to the GUI so I added some lower algorithms to be able to establish the tunnel. Still having issues getting traffic routed.

[davidemyers]

I've got something that seems to work. It requires changing the Algo configuration in order to accommodate pfSense. Much more testing is needed.

I wrote up some instructions here.

Feedback on this approach is appreciated.

[professoruss]

Nice, that seems to mostly work but I'm getting a bunch of denies in the firewall logs. Some stuff works, some doesn't, I have an ipsec rule allowing all traffic. Not quite sure what's going on.

[Nnyan]

I'll give this a try when I get home tonight.

[bensyverson]

I spent all day on this with pfSense tech support… We followed the guide @davidemyers posted, to a T, and were able to get pfSense to connect to an Algo instance on Digital Ocean. However, once connected, local clients can no longer reach the internet. The connection comes back as soon as IPSec is toggled off. There are no denies on outgoing traffic, and I have an IPSec rule to allow everything. Any help would be greatly appreciated!

[davidemyers]

Are you using 2.4 like I am? Maybe that's the difference.

[bensyverson]

@davidemyers — Hmm, no, I'm on 2.3.3. I'll look at the changelog for 2.4.

[bensyverson]

Okay, I upgraded to 2.4, rebuilt the Algo instance, and everything is working! 🎉

I'm getting great throughput using Algo on Digital Ocean talking to a Netgear SG-2220. My native speed is about 90/11, and I'm measuring around 89/10 through IPSec.

I think my problem was in the vpn_network setting in config.cfg. It should match your pfSense network, and it should be specified in subnet format (10.0.1.0/24 rather than the router's address, e.g. 10.0.1.1). D'oh!

Huge thanks to @davidemyers for the guide!

[grimsbee]

@bensyverson did you need to do any particularly tuning (other than MSS clamping)? I'm using a machine a little more powerful than a SG-2220 and can't get past about 20Mbps (1/9th of native speed) on Digital Ocean. Nothing obvious showing up in packet captures or logs, so I'm hoping I've just missed something dumb.

[davidemyers]

@grimsbee Under System / Advanced / Miscellaneous does it help to select AES-NI for Cryptographic Hardware?

[grimsbee]

not at all, neither pro or con, and the cpu supports the instruction set

[bensyverson]

@grimsbee Hmm, I didn't adjust anything else, and my tunables should be set to the defaults. I wiped the stock pfSense entirely and installed 2.4.0.b.20170411.1439, if that helps.

If you download a file from your DO instance with IPSec turned off, are you getting above 20Mbps? I'm wondering if the throughput from your local ISP to that DO datacenter could be an issue.