OPNsense 21 setup with NordVPN

OPNsense is an all-around open-source firewall and router software based on FreeBSD. One of its key strengths is support for various VPN clients, including OpenVPN. Following this guide, you can set up NordVPN on your OPNsense 21.x installation via the OpenVPN client, allowing you to secure and encrypt your internet traffic.

Certification

Access the OPNsense web interface by writing the router's LAN IP into the browser.
Log in with the credentials that you have set up for the router. If not, enter the default username and password.
Navigate to System -> Trust -> Authorities and click on the +Add button.

You should see this screen:
We will configure our OPNsense to connect to the US 8561 server, but you should connect to a server suggested on this page: https://my.nordaccount.com/dashboard/nordvpn/manual-configuration/server-recommendation/.

You can find the server hostname right under the server title.

Follow the steps below to find the best server for your connection:
Log in to your Nord Account and click NordVPN.
Scroll down to Advanced Settings and click Set up NordVPN manually.
Select the Server recommendation tab. The best server will be recommended for you according to your location.

By pressing Advanced filters, you can customize the recommended servers by selecting the Server type and the Security protocol.

In case you wish to select a specific server, follow these steps:

Under Set up NordVPN manually, select OpenVPN configuration files.
You can find the server you'd like to connect to using the Search bar or scrolling down. Then, you can download it by clicking Download UDP or Download TCP.
When connecting to OpenVPN & IKEv2 manually, you'll need the username and password from the service credential tab.

Press the + Add button.

Then fill the fields out like this:

Descriptive Name: NordVPN_US8561_CA
Method: Import an existing Certificate Authority
Certificate data: Paste the contents below:

Certificate Private Key: leave blank;
Serial for following certificate: leave as it is by default;

Press Save

VPN Client set up

Navigate to VPN -> OpenVPN -> Clients and press the + Add button. Then fill in the fields:

GENERAL INFORMATION

Disabled: leave unchecked.
Description: Any name you like. We will use NordVPN_US8561.
Server mode: Peer to Peer (SSL/TLS);
Protocol: UDP4 (you can also use TCP4);
Device mode: tun;
Interface: any;
Remote server:

Host or address: us8561.nordvpn.com (change to the hostname of the server you are going to use);
Port: 1194 (use 443 if you use TCP);

Retry DNS resolution: check;
Proxy host or address: leave blank;
Proxy port: leave blank;
Proxy Authentication: None;

Authentication

USER AUTHENTICATION SETTINGS

User name/pass: Fill in NordVPN service credentials, username, and password.

To find the NordVPN Service Credentials, log in to your Nord Account, click NordVPN, and, under Manual setup, click on Service credentials. You'll find your username and password, which you must connect manually.

Renegotiate time: leave blank;

CRYPTOGRAPHIC SETTINGS

TLS Authentication: Enabled - Authentication only
TLS Shared Key: Paste the contents below

-----BEGIN OpenVPN Static key V1-----
e685bdaf659a25a200e2b9e39e51ff03
0fc72cf1ce07232bd8b2be5e6c670143
f51e937e670eee09d4f2ea5a6e4e6996
5db852c275351b86fc4ca892d78ae002
d6f70d029bd79c4d1c26cf14e9588033
cf639f8a74809f29f72b9d58f9b8f5fe
fc7938eade40e9fed6cb92184abb2cc1
0eb1a296df243b251df0643d53724cdb
5a92a1d6cb817804c4a9319b57d53be5
80815bcfcb2df55018cc83fc43bc7ff8
2d51f9b88364776ee9d12fc85cc7ea5b
9741c4f598c485316db066d52db4540e
212e1518a9bd4828219e24b20d88f598
a196c9de96012090e333519ae18d3509
9427e7b372d348d352dc4c85e18cd4b9
3f8a56ddb2e64eb67adfc9b337157ff4
-----END OpenVPN Static key V1-----

Peer Certificate Authority: NordVPN_US8601_CA;
Client Certificate: None (Username and Password required);
Encryption Algorithm: AES-256-GCM;
Auth Digest Algorithm: SHA512;

TUNNEL SETTINGS:

IPv4 tunnel network: leave blank;
IPv6 tunnel network: leave blank;
IPv4 remote network: leave blank;
IPv6 remote network: leave blank;
Limit outgoing bandwidth: leave blank;
Compression: Legacy - Disabled LZO algorithm (--comp-lzo no)
Type-of-service: leave unchecked;
Don't pull routes: leave unchecked;
Don't add/remove routes: check.

ADVANCED CONFIGURATION:

Advanced: Paste the contents below.

remote-random;
tun-mtu 1500;
tun-mtu-extra 32;
mssfix 1450;
persist-key;
persist-tun;
reneg-sec 0;
remote-cert-tls server;

Verbosity level: 3 (recommended);

Click Save.

Setting up and enabling the OpenVPN interface

1. 1. 1. Navigate to Interfaces -> Assignments and click on + near New Interface. By default, it is ovpnc1.
    2. Click on the OPT1 to edit the interface.
    3. Click on the Enable Interface and make the following changes:
      
      Description: NordVPN (or anything you want);
      Block private networks: leave unchecked.
      Block bogon networks: leave unchecked.
      IPv4 Configuration Type: None;
      IPv6 Configuration Type: None;
      MAC address: leave blank;
      MTU: leave blank;
      MSS: leave blank;
      
      You don't need to change the DHCP client configuration; you can just click the Save button.
      
      Click on the Apply changes button.
    4. Navigate to Services -> Unbound DNS -> General.
      
      Enable: check;
      Listen port: 53;
      Network Interfaces: All;
      DNSSEC: uncheck;
      DHCP Registration: check;
      DHCP Domain Override: leave blank;
      DHCP Static Mappings: check;
      IPv6 Link-local: unchecked;
      TXT Comment Support: leave unchecked;
      DNS Query Forwarding: check;
      Local Zone Type: Transparent;
      Custom options: leave blank;
      Outgoing Network Interfaces: NordVPN (or whatever you named your OpenVPN interface);
      WPAD Records: leave unchecked;
      
      Click Save and Apply changes.
    5. Navigate to Services -> Unbound DNS -> Advanced and check the following options:
      
      Hide Identity: check
      Hide Version: check
      Prefetch Support: check
      Prefetch DNS Key Support: check
      
      Leave anything else as it is by default, click Save, and Apply Settings.
    6. Navigate to Firewall -> NAT -> Outbound, select Hybrid outbound NAT rule generation (automatically generated rules are applied after manual rules), click Save, and Apply Changes.
    7. Click on the +Add button at the top. In the edit menu, select Interface as NordVPN. Leave everything else as it is by default, click Save, and Apply Changes.
    8. Navigate to Firewall -> Rules -> LAN and delete the IPv6 rule. After that, click on the edit button next to IPv4. Scroll down and under Advanced features, select Gateway as NORDVPN_VPN4. Click Save.
      
      Next, click +Add, change Source to LAN net and Destination to LAN Address, don't change anything else, Save and Apply Changes.
    9. Navigate to System -> Settings -> General and make the following changes:
      
      Under Networking, check the Prefer IPv4 over IPv6.
      DNS servers:
      103.86.96.100, Use Gateway: none;
      103.86.99.100, Use Gateway: none.
      
      On DNS server options, uncheck Allow DNS server list to be overridden by DHCP/PPP on WAN.
      
      Click Save and Apply Changes.
    10. Navigate to System -> Gateways -> Single and do the following changes:
      
      Edit NORDVPN_VPN6 -> click Disabled
      
      Save and Apply Changes.
    11. Now you can navigate to VPN -> OpenVPN -> Connection Status, and it should state that the service is "up":
      
      Restart the connection to assign the OpenVPN Virtual Address to the interfaces.
    12. Navigate to Lobby -> Dashboard and confirm the NordVPN Interface has an IP address.
    13. You can also check the connection log file under VPN -> OpenVPN -> Log File. If you have any connection issues, please send the log file to our customer support for more help.

Was this article helpful?

Still having issues?

Live chat

Contact our support to solve an issue live.
Email form

Fill out an email form so we can help you with an issue.

Email us

Our Support team will get back to you within 24 hours. We’ll reply to the email address you provide.

Attach a file (Optional)

Supported formats: JPEG, PNG.

We couldn’t process your form. Please try again or come back later.

By clicking “Submit”, you agree to our Terms of Service and acknowledge our Privacy Policy.

Thank you! We've got your message and will get back to you within 24 hours.

Chat functionality relies on cookies. By starting the chat, you agree to their use. Learn more in our Cookie Policy.

{ "chatTitle": "NordVPN Support", "chatCustomText": { "actionPaymentCompleted": "Payment Completed", "actionPaymentError": "An error occurred while processing the card. Please try again or use a different card.", "actionPostbackError": "An error occurred while processing your action. Please try again.", "clickToRetry": "Message not delivered. Click to retry.", "clickToRetryForm": "Form not submitted. Click anywhere on the form to retry.", "connectNotificationText": "Sync your conversation and continue messaging us through your favorite app.", "connectNotificationSingleText": "Be notified when you get a reply.", "conversationListHeaderText": "My conversations", "conversationListRelativeTimeJustNow": "Just now", "conversationListRelativeTimeMinute": "1 minute ago", "conversationListRelativeTimeMinutes": "{value} minutes ago", "conversationListRelativeTimeHour": "1 hour ago", "conversationListRelativeTimeHours": "{value} hours ago", "conversationListRelativeTimeYesterday": "Yesterday", "conversationListTimestampFormat": "MM/DD/YY", "conversationListPreviewAnonymousText": "Someone", "conversationListPreviewCarouselText": "{user} sent a message", "conversationListPreviewFileText": "{user} sent a file", "conversationListPreviewFormText": "{user} sent a form", "conversationListPreviewFormResponseText": "{user} filled a form", "conversationListPreviewImageText": "{user} sent an image", "conversationListPreviewLocationRequestText": "{user} sent a location request", "conversationListPreviewUserText": "You", "conversationTimestampHeaderFormat": "MMMM D, h:mm A", "couldNotConnect": "Offline. You will not receive messages.", "couldNotConnectRetry": "Reconnecting...", "couldNotConnectRetrySuccess": "You're back online!", "couldNotLoadConversations": "Couldn't load conversations.", "emailChangeAddress": "Change my email", "emailDescription": "To be notified by email when you get a reply, enter your email address.", "emailFieldLabel": "Email", "emailFieldPlaceholder": "Your email address", "emailFormButton": "Submit", "emailLinkingErrorMessage": "Please submit a valid email address.", "errorPrefix": "Error:", "fetchHistory": "Load more", "fetchingHistory": "Retrieving history...", "fileTooLargeError": "Max file size limit exceeded ({size})", "fileTypeError": "Unsupported file type.", "formErrorEntryRequired": "This entry is required", "formErrorInvalidEmail": "Email is invalid", "formErrorNoLongerThan": "Must contain no more than ({characters}) characters", "formErrorNoShorterThan": "Must contain at least ({characters}) characters", "formErrorUnknown": "This doesn't look quite right", "formFieldSelectPlaceholderFallback": "Choose one...", "frontendEmailChannelDescription": "To talk to us using email just send a message to our email address and we'll reply shortly:", "headerText": "How can we help?", "imageClickToReload": "Click to reload image.", "imageClickToView": "Click to view {size} image.", "imagePreviewNotAvailable": "Preview not available.", "inputPlaceholder": "Type a message...", "inputPlaceholderBlocked": "Complete the form above...", "introAppText": "Message us below or from your favorite app.", "lineChannelDescription": "To talk to us using LINE, scan this QR code using the LINE app and send us a message.", "linkError": "An error occurred when attempting to generate a link for this channel. Please try again.", "linkChannelPageHeader": "Sync your conversation", "locationNotSupported": "Your browser does not support location services or it's been disabled. Please type your location instead.", "locationSecurityRestriction": "This website cannot access your location. Please type your location instead.", "locationSendingFailed": "Could not send location", "locationServicesDenied": "This website cannot access your location. Allow access in your settings or type your location instead.", "messageError": "An error occured while sending your message. Please try again.", "messageIndicatorTitlePlural": "({count}) New messages", "messageIndicatorTitleSingular": "({count}) New message", "messageRelativeTimeDay": "{value}d ago", "messageRelativeTimeHour": "{value}h ago", "messageRelativeTimeJustNow": "Just now", "messageRelativeTimeMinute": "{value}m ago", "messageTimestampFormat": "h:mm A", "messageDelivered": "Delivered", "messageSeen": "Seen", "messageSending": "Sending...", "messageTooLongError": "Max message size limit exceeded ({size}).", "messengerChannelDescription": "Connect your Facebook Messenger account to be notified when you get a reply and continue the conversation on Facebook Messenger.", "newConversationButtonText": "New Conversation", "notificationSettingsChannelsDescription": "Sync this conversation by connecting to your favorite messaging app to continue the conversation your way.", "notificationSettingsChannelsTitle": "Other Channels", "notificationSettingsConnected": "Connected", "notificationSettingsConnectedAs": "Connected as {username}", "prechatCaptureGreetingText": "Hi there 👋\nTo start off, we'd like to know a little bit more about you:", "prechatCaptureNameLabel": "Your name", "prechatCaptureNamePlaceholder": "Type your name...", "prechatCaptureEmailLabel": "Email", "prechatCaptureEmailPlaceholder": "name@company.com", "prechatCaptureConfirmationText": "Hi there! I’m the AI Nordbot here to assist you. How can I help you today?", "prechatCaptureMailgunLinkingConfirmation": "You'll be notified here and by email at {email} once we reply.", "sendButtonText": "Send", "settingsHeaderText": "Settings", "shareLocation": "Location", "smsBadRequestError": "We were unable to communicate with this number. Try again or use a different one.", "smsCancel": "Cancel", "smsChangeNumber": "Change my number", "smsChannelDescription": "Connect your SMS number to be notified when you get a reply and continue the conversation over SMS.", "smsChannelPendingDescription": "Check your messages at {number} to confirm your phone number.", "smsContinue": "Send", "smsInvalidNumberError": "Please submit a valid phone number.", "smsLinkCancelled": "Link to {appUserNumber} was cancelled.", "smsLinkPending": "Pending", "smsPingChannelError": "There was an error sending a message to your number.", "smsSendText": "Send me a text", "smsStartTexting": "Start Texting", "smsTooManyRequestsError": "A connection for that number was requested recently. Please try again in {minutes} minutes.", "smsTooManyRequestsOneMinuteError": "A connection for that number was requested recently. Please try again in 1 minute.", "smsUnhandledError": "Something went wrong. Please try again.", "syncConversation": "Sync conversation", "tapToRetry": "Message not delivered. Tap to retry.", "tapToRetryForm": "Form not submitted. Tap anywhere on the form to retry.", "telegramChannelDescription": "Connect your Telegram account to be notified when you get a reply and continue the conversation on Telegram", "unsupportedMessageType": "Unsupported message type.", "unsupportedActionType": "Unsupported action type.", "uploadDocument": "File", "uploadInvalidError": "Invalid file.", "uploadPhoto": "Image", "uploadVirusError": "A virus was detected in your file and it has been rejected", "viberChannelDescription": "Connect your Viber account to be notified when you get a reply and continue the conversation on Viber. To get started, scan the QR code using the Viber app.", "viberChannelDescriptionMobile": "Connect your Viber account to be notified when you get a reply and continue the conversation on Viber. To get started, install the Viber app and tap Connect.", "viberQRCodeError": "An error occurred while fetching your Viber QR code. Please try again.", "wechatChannelDescription": "Connect your WeChat account to be notified when you get a reply and continue the conversation on WeChat. To get started, scan this QR code using the WeChat app.", "wechatChannelDescriptionMobile": "Connect your WeChat account to be notified when you get a reply and continue the conversation on WeChat. To get started, save this QR code image and upload it QR code scanner.", "wechatQRCodeError": "An error occurred while fetching your WeChat QR code. Please try again.", "whatsappChannelDescriptionDesktop": "Sync your account to WhatsApp by scanning the QR code or clicking the link below.\nThen", "whatsappChannelDescriptionMobile": "Sync your account to WhatsApp by clicking the link below.\nThen", "whatsappLinkingError": "An error occurred while fetching your WhatsApp linking information. Please try again." }, "chatCustomScreenReaderAnnouncement": { "supportTyping": "{author} is typing", "supportSays": "{author} says:", "sentImage": "{author} sent an image", "sentFile": "{author} sent a file", "sentCarousel": "{author} sent a carousel", "sentLocation": "{author} sent a location" } }