-
Installed pfsense again, setup WAN and LAN ports correctly, still nothing on 192.168.1.1 or 192.168.0.141
So installed new pfsense between the NBN modem and the router hoping it would "just work", but nothing again on either of those address. -
Install worked correctly, rebooted, running.
192.168.1.1 it told me to use does not work.
Screw this, I wasted best part of a day on this, I'm out.
And you are connecting from a PC (or switch) connected directly to the fwall lan-port ?
Do you get a 192.168.1.x DHCP ip addy ??
Wan would NOT answer (show any login webpage) on any ip's as default (it's a firewall)
I think the default login on pfSense is :
admin/pfsense
-
@EEVblog if you have or can obtain a KVM over IP device i'd be happy to schedule a time to help you get this setup.
Ie: https://pikvm.org/
Otherwise you really need a good understanding of networking to do what you want here, this is not trivial. -
@EEVblog if you have or can obtain a KVM over IP device i'd be happy to schedule a time to help you get this setup.
Ie: https://pikvm.org/
Otherwise you really need a good understanding of networking to do what you want here, this is not trivial.
Thanks, so I'm begining to realise.
What's the easy option then, apart from installing the usual Surfshark/Express/whatevershill VPN software on every machine? -
This is basically it.
I could preconfigure a box that put whatever is behind it onto a VPN for you, but you'd need to source a device and provide the VPN details for the service you want to use. This though would result in double nat which ideally you want to avoid if possible. -
What's the easy option then, apart from installing the usual Surfshark/Express/whatevershill VPN software on every machine?
It's Network and Security.
If doing it right : There is unfortunately no "easy option"
Btw:
These KVM's seems to be popular ATM - Get the full version.
https://www.aliexpress.com/item/1005004825413332.html?
DON'T connect them directly to the internet ....
-
What's the easy option then, apart from installing the usual Surfshark/Express/whatevershill VPN software on every machine?
It's Network and Security.
If doing it right There is unfortunately no "easy option"
Millions of people just use Surfshark etc. Am I just dumb for thinking it would be at least relatively easy to do this with a router that supports said VPN service so it automatically does the whole house/lab? -
Surfshark support both wireguard and oepnvpn clients, if you configure a router correctly that supports these, yes it is possible. I can't start enough though how bad an idea this is. Those "millions of people" just connect each PC directly, not via a router.
Another thing to note... Contrary to what providers say, pretty much everything you do today is encrypted with "military grade encryption". With a decent gateway you can enforce encrypted DNS too, making your activity on the Internet completely illegegable to an attacker. VPN services are overrated. -
Millions of people just use Surfshark etc. Am I just dumb for thinking it would be at least relatively easy to do this with a router that supports said VPN service so it automatically does the whole house/lab?
That might be easier doable, but is just one of your requirements/wishes.
Doing it right would be (according to your statements):
Increase security w. a 'sense firewall - Well not a statement ... But imho needed
Making a L2L VPN between House & Lab
Making a "secure dial-in" VPN from "anywhere" to House & Lab
Making a VLAN & WiFi SSID, that when connected to - Would exit "somewhere" in the world using the VPN provider you subscribe to.
-
I'm tempted to just give up, it likely isn't worth my time.
Find a networking geek and offer to solder up their Arduino gadget for them in exchange for them setting up a VPN for you? :-).
I do think the Beelink is the problem though, they've been tested to work with all the OSes around, Windows 10 20H1, Windows 10 20H2, Windows 10 21H1, Windows 10 21H2, Windows 10 22H2, Windows 11 21H2, Windows 11 22H2, and Windows 11 23H2, so it's not surprising that an OS that doesn't even exist because it's not Windows won't run on it. -
i use private internet access, (torrent optimized) i do rotate the given location once in a while, they do give you time delay/access times on each locations
and i was checking pfsense thingies you can create with dedicated routers or some small pc's,
my company use Fortinet hardware stuff, now they have began aggressive email checks since we are Office 365, all unknown sources pass thru a release request, all goes thru the IT guy, once checked he release it ... and validate the source and add it to the white list .. he check all who knocks on the company doors .... he says lots of bots ..
As for websites like eevblog, i think recently there was some changes / stories ... because some of my vpn regions does not go thru, simply does not open ? many chineses sites does that too, behind a vpn they simply stall
-
As a followup, for hardware to run it on the go-to used to be the Alix APU2, three NICs, entirely solid-state, and built to run Linux or FreeBSD rather than Windows, but sadly they've been EOL'd. Current go-to is the ODroid H4, also entirely solid-state and FLOSS-targeted. You just need to either get an H4+ for the extra NIC or add the 4-port NIC card to the standard H4.
-
Surfshark support both wireguard and oepnvpn clients, if you configure a router correctly that supports these, yes it is possible. I can't start enough though how bad an idea this is.
I don't get it, why is that bad idea compared with installing on every PC?
As I see it, it's just doing the exact same thing, but inside the router so all downstream PC's get the benefit.
What am I missing?QuoteThose "millions of people" just connect each PC directly, not via a router.
Doesn't practically everyone have modem -> wifi router -> PC(with VPN software)
Why can't the VPN software be on the router instead?QuoteAnother thing to note... Contrary to what providers say, pretty much everything you do today is encrypted with "military grade encryption". With a decent gateway you can enforce encrypted DNS too, making your activity on the Internet completely illegegable to an attacker. VPN services are overrated.
How else do you make your PC appear to be in aother country without a VPN server in that country? -
As for websites like eevblog, i think recently there was some changes / stories ... because some of my vpn regions does not go thru, simply does not open ? many chineses sites does that too, behind a vpn they simply stall
This thread has nothing to do with the EEVblog server. On the forum we have to block some IP ranges and also hosts because they forum would be ruined by spam within a day if we didn't. -
Millions of people just use Surfshark etc. Am I just dumb for thinking it would be at least relatively easy to do this with a router that supports said VPN service so it automatically does the whole house/lab?
That might be easier doable, but is just one of your requirements/wishes.
Doing it right would be (according to your statements):
Increase security w. a 'sense firewall - Well not a statement ... But imho needed
Making a L2L VPN between House & Lab
Making a "secure dial-in" VPN from "anywhere" to House & Lab
Making a VLAN & WiFi SSID, that when connected to - Would exit "somewhere" in the world using the VPN provider you subscribe to.
The only real thing I'm trying to do is add a VPN so all my computer appear to be in another country.
Anything else is bonus.
I have no real need to access the lab or home remotely. I don't currently have that and I get by fine without it. -
The only real thing I'm trying to do is add a VPN so all my computer appear to be in another country.
Easiest way i can imagine.
Would be to get a new VPN capable WiFi router, make a SSID called ie. DaveVpn , and set that WiFi router up to permanently VPN connect to your select VPN provider/exit-destination.
Whenever you want to exit abroad , connect to the VPN SSID.
Else connect to the "Normal/Old ssid".
If you have cabled devices needing VPN , connect the cable to the VPN router's lan port.
That way you don't need to bother about policy routing or other complicated stuff .....
Anything connected to the VPN router goes out via VPN.
Ie. something like this - I haven't tried this, bit it doesn't look to complicated.
https://www.linuxscrew.com/openwrt-openvpn-luci
Ought to work w. the el-cheapo's (Converted to latest openWRT), where el-cheapo wan is just connected to "house/lab lan"
https://www.eevblog.com/forum/security/hardware-router-vpn/msg5967529/#msg5967529
Verify the VPN exit
This
https://www.dnsleaktest.com/
Or This
https://dnsleaktest.org/dns-leak-test
Are excellent sites, to check where your internet exit are located , and if you "leak" your aussie location via DNS.
-
The only real thing I'm trying to do is add a VPN so all my computer appear to be in another country.
Easiest way i can imagine.
Would be to get a new VPN capable WiFi router, make a SSID called ie. DaveVpn , and set that WiFi router up to permanently VPN connect to your select VPN provider/exit-destination.
Whenever you want to exit abroad , connect to the VPN SSID.
Else connect to the "Normal/Old ssid".
If you have cabled devices needing VPN , connect the cable to the VPN router's lan port.
That way you don't need to bother about policy routing or other complicated stuff .....
Anything connected to the VPN router goes out via VPN.
Ie. something like this - I haven't tried this, bit it doesn't look to complicated.
https://www.linuxscrew.com/openwrt-openvpn-luci
That's exactly what I was saying, and a ton of people on X said, just get a router that supports a VPN service (wireguard or Open VPN support?). But gnif says this is a bad idea, so
-
The only real thing I'm trying to do is add a VPN so all my computer appear to be in another country.
Easiest way i can imagine.
Would be to get a new VPN capable WiFi router, make a SSID called ie. DaveVpn , and set that WiFi router up to permanently VPN connect to your select VPN provider/exit-destination.
Whenever you want to exit abroad , connect to the VPN SSID.
Else connect to the "Normal/Old ssid".
If you have cabled devices needing VPN , connect the cable to the VPN router's lan port.
That way you don't need to bother about policy routing or other complicated stuff .....
Anything connected to the VPN router goes out via VPN.
Ie. something like this - I haven't tried this, bit it doesn't look to complicated.
https://www.linuxscrew.com/openwrt-openvpn-luci
That's exactly what I was saying, and a ton of people on X said, just get a router that supports a VPN service (wireguard or Open VPN support?). But gnif says this is a bad idea, so
Maybe he thought you wanted to replace your existing router w such a guy...
Don't ... Add it as an extra that is just connected to when you want to be "cloaked"
That said ... I do agree that most Manufactor router firmware is buggy like h...
And that it is a risk to connect them directly to the internet.
But if you have thought about it, it's now a "Calculated risk".
But that's another story, not covering your VPN need.
Just your data security & ransomware risk (NAS & Family pictures) ...
Edit: An EEVblog analogy.
Using most stock firmware on an internet router, is like buying components on ebay/Aliexpress.
You can be lucky they are originals/"bug free" .... But time usually proves otherwise.
Components : Your thingy starts to act/smell weird.
Router : You get "strange guests" on your inside lan, and maybe even the "bonus" of participating in a BotNet
-
Just two examples of configuring routers for 'VPN services':
- Setting up a router with NordVPN - https://support.nordvpn.com/hc/en-us/articles/19426084718865-Setting-up-a-router-with-NordVPN
- How to set up a VPN on your router: an easy step-by-step guide (2025) - https://surfshark.com/blog/setup-vpn-router
Both include links to guides for specific router brands. -
The only real thing I'm trying to do is add a VPN so all my computer appear to be in another country.
Anything else is bonus.
I have no real need to access the lab or home remotely. I don't currently have that and I get by fine without it.
You may want to try "PIA VPN". It's inexpensive, there is no limits how many computers you use and it works on any OS.
Link: https://www.privateinternetaccess.com/
I checked and latency US - AU is in 46 ms range using PIA VPN.
-
I'd still consider to install the two 'sense boxes towards the internet, for the much better hacker protection.
But realizing your situation - I would just install them "default" ... No fancy/complicated setup.
Default would :
Block anything comming "uninvited" from the outside (Wan/Inet) towards Lan.
Allow anything comming from the Lan towards (Wan/Inet).
Change DNS to use the A-root servers, skipping your ISP DNS servers.
Serve DHCP ip addresses on Lan.
Pro:
MUCH better hacker protection from anything coming uninvited from internet
Avoid using your ISP for DNS lookup (tracking)
Your TP-link's & other "eastern" boxes can be deployed much more safe, now that your "Front internet door" is securely closed. Just internal users have access.
Con:
Possible Double NAT - Both pfSense & ISP Box ... Unless ISP Box is in "bridge mode"
Yet another Box in the Internet chain.
Current 'sense is not good for DNS resolving your DHCP clients, but avahi (Multicast DNS / Bonjour) can be installed. - Might have changed in pfSense 2.8.0
Then for VPN I would still get the "el-cheapo" OpenWRT router, and make the setup described above.
Things to watch out for:
Make sure that the upcomming 'sense lan subnet (default 192.168.1.0/24) is NOT used anywhere in your existing setup right now.
All your Fixed IP addresses would have to be changed to fit into the new 'sense lan range .
Sidenote:
I hate 192.168.1.0/24 as Lan segment ... 50% of the world uses that.
I would chose something else during 'sense install ...
Make sure you don't have multi DHCP servers active on lan.
ISP Box can (must) serve DHCP for pfSense wan - Think it already does - You mentioned 192.168.0.124 as wan ip.
TP-Link '6000 (existig WiFi router) must NOT have DHCP active on the Lan side, would clash with the 'sense DHCP server.
Disconnect TP-link wan cable (routing function)
Set TP-Link Lan interface to DHCP , or (better) a static ip + def-gw. and connect it to 'sense lan.
Does anyone know what default start ip-addres 'sense DHCP uses ... DHCP Pool range ?
I don't use pfSense DHCP but local ISC.
Info needed for Dave's static ip assignments.
I think the 'sense DHCP P range is starting at .100 to 254
So any 'sense Lan - Static IP assignments should be between .2 and .99
Suggested install Steps:
First make sure that the 'sense lan subnet you install/use is NON existing in your current network.
Connect 'sense wan port to ISP Lan , could be along w. the existing TP-Link if you have the ports.
Install 'sense
Connect a PC to 'sense lan port directly , check you get a DHCP ip in the lan range.
Now make sure you can browse (login) to 'sense would be the lan .1 address.
Now you should also be able to browse internet normally, using the PC connected to 'sense lan.
Now move your TP-Link '6000 WAN port to the 'sense lan port (maybe reboot it)
Your existing home infrastructure should work normally.
You have now inserted the 'sense between ISP & TP-Link WiFi (router box)
You could stop here ... Only "Con" would be an extra Nat step in the 'sense box.
To avoid the extra Nat step you would have to disable the TP-Link router function, and make it function as a WiFi Access Point (AP)
Aka ... Disconnect TP-Link Wan, and connect 'sense lan directly to the same (switch) as TP-Link Lan
But you also have to change the ip adddress of the TP-Link Lan adapter to fit the new 'sense Lan subnet.
Either set TP-Link Lan to get a DHCP ip address , or set a static ip in the 'sense lan range.
And disable the TP-Link DHCP server... Now that the 'sense box is serving DHCP.
*** I'd snoop a bit around in the TP-Link, to see where & what to do , before disconnecting any cables. AND MAKE a TP-Link config backup.
Now you should be "done"
-
Surfshark support both wireguard and oepnvpn clients, if you configure a router correctly that supports these, yes it is possible. I can't start enough though how bad an idea this is.
I don't get it, why is that bad idea compared with installing on every PC?
As I see it, it's just doing the exact same thing, but inside the router so all downstream PC's get the benefit.
What am I missing?
I do not think you are missing anything. The only disadvantage is that the VPN part is more difficult to get working. I never had a problem getting pfSense or OPNsense to work on random hardware. (1)
I think there is a disadvantage to using a consumer grade router, including the one which comes from your internet service, because they have a terrible record for security and reliability. If you put your pfSense or OPNsense router between your provider's device and your network, and likely access the internet through a VPN, that will protect you from your provider's security lapses.
I always recommend using a pfSense or OPNsense router instead of a consumer piece of junk, whether VPN features are desired or not, unless a router from someone like Ubiquiti or mikrotik used.
(1) Back around, oh, call it 2010, the ice maker in my kitchen leaked and the water dropped into the basement directly onto the Pentium 2 hardware that I had running pfSense. It took me about 20 minutes to pull the ethernet cards and drive and install them into a decommissioned Gateway Pentium 4. It booted on the first try, and all I had to do was assign the ethernet interfaces from the console to get back up and working like before.QuoteQuoteThose "millions of people" just connect each PC directly, not via a router.
Doesn't practically everyone have modem -> wifi router -> PC(with VPN software)
Why can't the VPN software be on the router instead?
My router (PCEngines OPNsense, shown below) and wifi (Ubiquity UniFi) are separate devices, but it works out to the same thing. Combination wifi-routers tend to be limiting and buggy; I have not used one since before 2000 when I installed the predecessor to pfSense, m0n0wall, on a Packard Bell 90 MHz Pentium with 128 MB of RAM.
The VPN software, or more properly the VPN endpoint, *can* be on the router, and do exactly what you intend and more, but at least in my experience, the VPN part is difficult to get working unless you have specific instructions for setting it up. The easiest option is to buy a small hardware router which is preconfigured for the VPN service that you want to use.QuoteQuoteAnother thing to note... Contrary to what providers say, pretty much everything you do today is encrypted with "military grade encryption". With a decent gateway you can enforce encrypted DNS too, making your activity on the Internet completely illegegable to an attacker. VPN services are overrated.
How else do you make your PC appear to be in another country without a VPN server in that country?
Well, that is exactly the point. Most things you do on the internet now are encrypted by the selection of protocol, like HTTPS or encrypted DNS, but that still allows traffic to be traced back to you through your IP address. A VPN service effectively conceals your IP address, and usually traffic patterns, by using a remote IP address as an exit and entry for multiple users through NAT and lack of logging where it is not required.
I am still terminating my VPN connections on my individual systems, but I would prefer to have my router be the VPN endpoint. I know my router running OPNsense can do it; I just have not put enough effort into getting it to work. PFSense would be easier because of better documentation for specific services, but I prefer OPNsense since pfSense went commercial; I am not entirely happy with NetGate.
-
The VPN software, or more properly the VPN endpoint, *can* be on the router, and do exactly what you intend and more, but at least in my experience, the VPN part is difficult to get working unless you have specific instructions for setting it up. The easiest option is to buy a small hardware router which is preconfigured for the VPN service that you want to use.
If I'm going to just go the new router option then that seems like a good idea.
Looks like I have three options here:
1) Continue with the firewall as I tried and get it working. And then get the VPN service working on top of that. (Two entirely separate problems?)
2) Just buy new routers that support a VPN service directly (or come pre-configured already)
3) Just install a software VPN service on every machine like 99% of people do.
The thing is I never started this with the intention of improving my network security, yet it somehow seems to have pivoted towards this.
I don't actually care that much about security, I've had just normal consumer routers for 15 years now and it hasn't been a problem (yeah yeah, until it is...), I just thought a LAN wide VPN would be nice.
The problem is I have a ton of people who I'm sure all know what they are talking about, suggesting something different, so
-
You opened a big can of worms here, lol. Using the VPN to appear to be from another country is about the only real usage of these services, but like I and others have said, there are caveats such as websites blocking VPN users, and being flagged as suspicious on even Google and needing to enter a captcha for every 3 or so searches.
The most accepted small home office solution is to use a box like pf/open sense. Any network administrator you pay to deploy what your asking for will use this unless you give them the budget to buy a Cisco or ubiquity device, which are really just the same thing in the end.
Tplink and such are generally good for just a generic home router, but add a VPN on top and they are often lacking the horsepower to give a good and reliable experience, especially for a network of multiple systems when the network is busy. Not to mention the security and support implications.
The complexity Dave is your jumping into the deep end. To do all this stuff properly you need to understand multiple technologies in the stack, from subnets and routing tables to services such as DNS and DHCP, not to mention encapsulation layers like PPPoE often needed for NBN, along with a good understanding of firewall policies.
Professional solutions like pfsense/open sense and Cisco, etc, all come default configured with nothing, you have to set all the configuration for how you want things to work. For example, the default policy on a pfsense firewall (IIRC) is to block all traffic. This is intentional, so the network admin isn't surprised by some extra "feature" like UPnP that was default enabled that compromises their secure design.
Even services like DHCP are not enabled by default, otherwise when setting up a new device, you might disrupt the local working network because suddenly you have another DHCP server on the network messing things up. -
You opened a big can of worms here, lol. Using the VPN to appear to be from another country is about the only real usage of these services, but like I and others have said, there are caveats such as websites blocking VPN users, and being flagged as suspicious on even Google and needing to enter a captcha for every 3 or so searches.
The most accepted small home office solution is to use a box like pf/open sense. Any network administrator you pay to deploy what your asking for will use this unless you give them the budget to buy a Cisco or ubiquity device, which are really just the same thing in the end.
Tplink and such are generally good for just a generic home router, but add a VPN on top and they are often lacking the horsepower to give a good and reliable experience, especially for a network of multiple systems when the network is busy. Not to mention the security and support implications.
The complexity Dave is your jumping into the deep end. To do all this stuff properly you need to understand multiple technologies in the stack, from subnets and routing tables to services such as DNS and DHCP, not to mention encapsulation layers like PPPoE often needed for NBN, along with a good understanding of firewall policies.
Professional solutions like pfsense/open sense and Cisco, etc, all come default configured with nothing, you have to set all the configuration for how you want things to work. For example, the default policy on a pfsense firewall (IIRC) is to block all traffic. This is intentional, so the network admin isn't surprised by some extra "feature" like UPnP that was default enabled that compromises their secure design.
Even services like DHCP are not enabled by default, otherwise when setting up a new device, you might disrupt the local working network because suddenly you have another DHCP server on the network messing things up.
Thanks.
So what you telling me is to just install a VPN software service on every machine and enable/disable as required, and anything else it too hard