{"id":1187,"date":"2022-04-27T19:17:04","date_gmt":"2022-04-27T17:17:04","guid":{"rendered":"https:\/\/www.delixirpro.com\/blog\/?p=1187"},"modified":"2022-04-27T19:20:09","modified_gmt":"2022-04-27T17:20:09","slug":"vpn-site-to-site-avec-openvpn-sur-pfsense","status":"publish","type":"post","link":"https:\/\/www.delixirpro.com\/blog\/2022\/04\/27\/vpn-site-to-site-avec-openvpn-sur-pfsense\/","title":{"rendered":"VPN Site-to-Site avec OpenVPN sur pfSense"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">OpenVPN permet de monter un VPN site-\u00e0-site de mani\u00e8re tr\u00e8s simple et efficace.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">L&rsquo;un des sites est configur\u00e9 comme&nbsp;<em>client<\/em>&nbsp;et l&rsquo;autre site comme&nbsp;<em>serveur<\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pour monter notre VPN, nous utiliserons ici le syst\u00e8me de cl\u00e9s partag\u00e9es, id\u00e9al si vous avez peu de liens VPN site-\u00e0-site \u00e0 monter. Au del\u00e0 de 5 \u00e0 6 liens VPN site-\u00e0-site, il peut \u00eatre judicieux d&rsquo;utiliser la&nbsp;gestion de certificat (SSL\/TLS &#8211; PKI)&nbsp;par simplicit\u00e9 d&rsquo;administration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">OpenVPN Client &amp; Serveur<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">OpenVPN est bas\u00e9 sur un mode de fonctionnement client-serveur. Qu&rsquo;un pfSense soit d\u00e9fini comme client ou comme serveur ne changera strictement rien d&rsquo;un point de vue r\u00e9seau. Cependant, si vous souhaitez connecter plusieurs sites distants sur un site principal, le plus logique est bien-s\u00fbr de d\u00e9finir le site principal comme \u00ab\u00a0serveur\u00a0\u00bb et les sites distants comme \u00ab\u00a0clients\u00a0\u00bb.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dans cet article, nous prendrons l&rsquo;exemple de configuration suivant&nbsp;:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.provya.net\/img\/02\/schema-reseau-open-vpn-pfsense-provya.png\" alt=\"Sch\u00e9ma r\u00e9seau OpenVPN pfSense - Provya\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Le pfSense du&nbsp;<strong>site A<\/strong>&nbsp;sera configur\u00e9 comme&nbsp;<strong>serveur<\/strong>&nbsp;OpenVPN. Le pfSense du&nbsp;<strong>site B<\/strong>&nbsp;sera configur\u00e9 comme&nbsp;<strong>client<\/strong>&nbsp;OpenVPN.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configurer OpenVPN c\u00f4t\u00e9 \u00ab\u00a0serveur\u00a0\u00bb (site A)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">1. VPN &gt; OpenVPN &gt; Server<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">2. Bouton +Add<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">3. Param\u00e9trer ainsi :<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Description : stock (ou tout autre description identifiant votre lien)<\/li><li>Server mode : Peer to Peer (shared key)<\/li><li>Device Mode : tun &#8211; Layer 3 tunnel mode<\/li><li>Protocol : UDP On IPv4 only<\/li><li>Interface : WAN<\/li><li>Local port : 1195 (choisi ici car on a d\u00e9j\u00e0 un VPN User sur le 1194 mais on peut y mettre autre chose)<\/li><li>Shared key : Automatically generate a shared key<\/li><li>Data Encryption Negotiation : Enable Data Encryption Negotiation coch\u00e9<\/li><li>Data Encryption Algorithms : AES-256-GCM + AES-128-GCM<\/li><li>Fallback Data Encryption Algorithm : AES-256-CBC<\/li><li>Auth digest algorithm : SHA256<\/li><li>Hardware Crypto : Au choix si votre mat\u00e9riel le permet sinon None<\/li><li>IPv4 Tunnel Network : 10.0.11.0\/30<\/li><li>IPv4 Local network(s) : 192.168.13.0\/24 (r\u00e9seau \u00e0 atteindre, ici le r\u00e9seau de notre stock)<\/li><li>Concurrent connections : 1<\/li><li>Gateway creation : IPv4 only<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Sauvegarder pour obtenir ceci :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"379\" src=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-1024x379.png\" alt=\"\" class=\"wp-image-1188\" srcset=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-1024x379.png 1024w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-300x111.png 300w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-768x284.png 768w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image.png 1173w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"555\" src=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-1-1024x555.png\" alt=\"\" class=\"wp-image-1189\" srcset=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-1-1024x555.png 1024w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-1-300x163.png 300w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-1-768x416.png 768w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-1.png 1155w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"715\" src=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-2-1024x715.png\" alt=\"\" class=\"wp-image-1190\" srcset=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-2-1024x715.png 1024w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-2-300x210.png 300w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-2-768x537.png 768w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-2.png 1155w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"672\" src=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-3-1024x672.png\" alt=\"\" class=\"wp-image-1191\" srcset=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-3-1024x672.png 1024w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-3-300x197.png 300w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-3-768x504.png 768w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-3.png 1155w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>Note : les r\u00e9seaux peuvent \u00eatre diff\u00e9rents, surtout sur IPv4 remote network<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"743\" src=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-4-1024x743.png\" alt=\"\" class=\"wp-image-1192\" srcset=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-4-1024x743.png 1024w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-4-300x218.png 300w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-4-768x558.png 768w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-4.png 1146w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">4. Copier\/coller la shared key dans un fichier texte que vous conserverez. Nous en aurons besoin plus tard pour la configuration du client.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Notons \u00e9galement que la cr\u00e9ation de ce serveur aura ouvert notre port sur la patte WAN du serveur, comme ceci :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"303\" src=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-5-1024x303.png\" alt=\"\" class=\"wp-image-1193\" srcset=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-5-1024x303.png 1024w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-5-300x89.png 300w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-5-768x227.png 768w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-5.png 1162w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Si ce n&rsquo;est pas le cas, vous devrez cr\u00e9er cette r\u00e8gle pour laisser passer le traffic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configurer OpenVPN c\u00f4t\u00e9 \u00ab\u00a0client\u00a0\u00bb (site B)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">1. VPN &gt; OpenVPN &gt; Client<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">2. Bouton +Add<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">3. Param\u00e9trer ainsi :<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Description : si\u00e8ge (ou tout autre description identifiant votre lien)<\/li><li>Server mode : Peer to Peer (shared key)<\/li><li>Device Mode : tun &#8211; Layer 3 tunnel mode<\/li><li>Protocol : UDP On IPv4 only<\/li><li>Interface : WAN<\/li><li>Local port : laiss\u00e9 blanc<\/li><li>Server host or adress : adresse IP du serveur distant<\/li><li>Server port : 1195 (port sp\u00e9cifi\u00e9e sur notre serveur distant)<\/li><li>Auto generate : d\u00e9coch\u00e9 et <strong>coller la shared key que nous avons pr\u00e9c\u00e9demment sauvegard\u00e9e<\/strong><\/li><li>Data Encryption Negotiation : Enable Data Encryption Negotiation coch\u00e9<\/li><li>Data Encryption Algorithms : AES-256-GCM + AES-128-GCM<\/li><li>Fallback Data Encryption Algorithm : AES-256-CBC<\/li><li>Auth digest algorithm : SHA256<\/li><li>Hardware Crypto : Au choix si votre mat\u00e9riel le permet sinon None<\/li><li>IPv4 Tunnel Network : 10.0.11.0\/30<\/li><li>IPv4 Local network(s) : 192.168.12.0\/24 (r\u00e9seau \u00e0 atteindre, ici le r\u00e9seau de notre si\u00e8ge)<\/li><li>Limit outgoing bandwidth : \u00e0 d\u00e9finir si vous souhaitez limiter la bande passante entre les 2 sites<\/li><li>Gateway creation : IPv4 only<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">4. Sauvegarder.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">5. Cr\u00e9er la r\u00e8gle suivante si vous souhaitez permettre le traffic du si\u00e8ge vers le stock (serveur vers client) :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"266\" src=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-6-1024x266.png\" alt=\"\" class=\"wp-image-1194\" srcset=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-6-1024x266.png 1024w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-6-300x78.png 300w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-6-768x200.png 768w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-6.png 1162w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>La r\u00e8gle est \u00e0 cr\u00e9er dans Firewall &gt; Rules &gt; OpenVPN<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">V\u00e9rification<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Allez dans Status &gt; OpenVPN pour vois les connexions Peer to peer :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"129\" src=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-7-1024x129.png\" alt=\"\" class=\"wp-image-1195\" srcset=\"https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-7-1024x129.png 1024w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-7-300x38.png 300w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-7-768x97.png 768w, https:\/\/www.delixirpro.com\/blog\/wp-content\/uploads\/2022\/04\/image-7.png 1169w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Source : <a href=\"https:\/\/www.provya.net\/?d=2014\/06\/15\/15\/20\/04-pfsense-monter-un-acces-openvpn-site-a-site\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.provya.net\/?d=2014\/06\/15\/15\/20\/04-pfsense-monter-un-acces-openvpn-site-a-site<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>OpenVPN permet de monter un VPN site-\u00e0-site de mani\u00e8re tr\u00e8s simple et efficace. L&rsquo;un des sites est configur\u00e9 comme&nbsp;client&nbsp;et l&rsquo;autre site comme&nbsp;serveur. Pour monter notre VPN, nous utiliserons ici le syst\u00e8me de cl\u00e9s partag\u00e9es,&#46;&#46;&#46;<\/p>\n","protected":false},"author":1,"featured_media":1196,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,40],"tags":[39,27,82],"class_list":["post-1187","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech-tips","category-tutoriel","tag-openvpn","tag-pfsense","tag-vpn"],"_links":{"self":[{"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/posts\/1187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/comments?post=1187"}],"version-history":[{"count":2,"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/posts\/1187\/revisions"}],"predecessor-version":[{"id":1198,"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/posts\/1187\/revisions\/1198"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/media\/1196"}],"wp:attachment":[{"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/media?parent=1187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/categories?post=1187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.delixirpro.com\/blog\/wp-json\/wp\/v2\/tags?post=1187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}