An OpenVPN Site-to-Site setup using two pfSense devices, one running an OpenVPN server and the other an OpenVPN client.
WARNING: This is NOT for setting up an OpenVPN server for clients to connect to a remote network over a VPN.
This setup is for a single remote client, not multiple remote clients.
These instructions are for the configuration of the Primary pfSense device; and is where the Remote pfSense client will connect to.
The Primary will require a static WAN IP address from their ISP to avoid the VPN going down when their public IP address is changed.
If the Primary pfSense box is behind another routing device and using a local IP address from this device, then additional port forwarding rules may be needed.
On the pfSense at the Primary location.
Navigate to VPN → OpenVPN.
Select Server.
In General Information:
NOTE: Port 1195 is used here instead of the usual OpenVPN Port 1194.
In Cryptographic Settings:
In Tunnel Settings:
NOTE: If the Remote client does not have a static IP address a Dynamic DNS account could be used.
In Advanced Configuration:
On the pfSense at the Primary location.
Navigate to VPN → OpenVPN.
WARNING: This will be used in the next step for setting up the Remote client.
Make sure to delete or secure this key once you are finished with it.
It could give anyone in its possession access to your network.
On the pfSense at the Remote location.
Navigate to VPN → OpenVPN.
Click the Clients tab.
In General Information:
NOTE: If the Primary server does not have a static IP address a Dynamic DNS account could be used.
In Cryptographic Settings:
NOTE: To find the Shared key on the OpenVPN Server:
On the pfSense at the Primary location.
In Tunnel Settings:
In Advanced Configuration:
On the pfSense at the Remote location.
Navigate to Firewall → Rules.
Test the OpenVPN connection to see if it works.
On the pfSense at the Primary location.
NOTE: If the OpenVPN connection is working this should show the IP address of the connected pfSense router at the Remote location.
From the Primary location, try to ping the Local IP address of the Remote location.
ping 192.168.2.1
NOTE: If the ping is successful it means traffic is passing across the tunnel and the Primary location can see the Remote location.
From the Remote location, try to ping the Local IP address of the Primary location.
ping 192.168.1.1
NOTE: Be aware that systems at either end may have Firewall rules preventing pings.
It is very likely you will not be able to resolve or reach devices by hostname over the new Site-to-Site VPN without some adjustments.
In pfsense DHCP settings it is usually best to add the local DNS servers to support resolving issues.
pfsense also includes the option Register connected OpenVPN clients in the DNS Resolver.
https://doc.pfsense.org/index.php/OpenVPN_Site-to-Site_(Shared_Key,_2.0)