@spudnet The real solution would be to bite the bullet and renumber one of the networks which is no small undertaking. Such a bizarre decision to make both a /8 unless they really do need to have 16 million clients on the same network.

@erfanxp
Ah, so even NM.
Here on OpenSUSE 15.2 NM OpenVPN is working flawlessly after importing the config. However, I had this issue as well with earlier versions.
Of course it doesn't work if your local networks are overlapping with the remote networks.

If that isn't the case, you can configure the routing manually:
Edit the connection. Select the IPv4 or v6 tab, whatever routes you need. Click "Routes..." at the right bottom, in the opening window check "ignore pulled routes", hit "Add" and enter the remote network and mask (in your example 10.10.184.0, 255.255.254.0). Leave the gateway blank and save all.

Worked well for me in earlier NM versions.

@chefdeski It depends. Policy routing mean using firewall rules to direct which gateway traffic goes out. I have a rule on LAN that directs one client out my Mullvad VPN, and another rule for my desktop so that any access to 10.10.0.0/16 goes out my work tunnel. I just have to disable a rule to switch the VPN "off" even though it's still up & running fine as an interface.

On my side, same watching.
Since I upgrade my pfSense to 2.5.x, I encounter a deep & blocking bug with OpenVPN server.
My VPN clients are regularly unable to reach LAN.

I've detailed the entire issue here

@kom Hi,
I think if it would be the encryption issue, I woud't be able to connect at all I guess.

@viragomann said in Backup tunnel with overlapping routes:

@ddbnj

You can use policy routes instead of OpenVPN added ones if you want that. So you can use both VPNs for different purposes and additionally set up a fail-over gateway of both for common use.

If you want to this, you have to remove the remote networks from the OpenVPN settings, so that both connections can be established without interfere.
Then create a gateway group with both VPNs.
Now you can add policy routing rules using either the gateway group or only one VPN gateway.
You will have to check the "skip filter rules if gateway down" option in the advanced settings to avoid skipping a rule and use another gateway.

I think I got this working using policy routing.

Thank you!

@thatguy
Probably you meant 'fellymar is using mismatched versions'.
I've only one version that is 2.5.1-RELEASE (amd64)

@clhols This only killed my internet connection.

Hi John

Thanks again for your help here, I have found your older thread where you were discussing this and developing your ideas for this script, that is a damn fine thread btw and I'm a bit embarassed I didnt find it before... https://forum.netgate.com/topic/157520/openvpn-client-cascade/46 for anyone else reading (who is also an idiot who cant use search), its a very solid description of the process for manually setting up a nested VPN.

I will have to look into this script a bit more, it seems to automate the later steps nicely but im not sure I understand all the details, especially the "Don't pull routes" settings, more research required. All the best mate

@jeangirgis said in V21.02 openvpn not working Netgate SG-2440:

OpenVPN clients do not work

Hi,
Exactly where?
The client installed on NGFW? (for example to a VPN provider's server)

Can you elaborate on this? 😉

I finally solved it.

The LAN subnet on both sites must not be identical.

After changing the LAN subnet on one of the two sites (so they differ) it works like a charme.

Further reading:

https://blog.matrixpost.net/pfsense-site-to-site-ipsec-vpn-same-subnet-on-each-site/

@ptz-m Server's were still on openvpn 2.4, which seems not capable of fully disabling it, after updating to 2.5 and setting 'allow-compression no' the warning is gone.

@jimp Did you get that working somehow? I tried send via Microsoft NPS server (Radius) the Cisco Vendor Attribute "ip:route 10.0.0.0 255.255.255.0 192.168.1.1 100" from somewhere, but I am not sure if that is the correct format, as could not find specific/clear documentation.

I tried to deal with this problem independently, but unfortunately, it didn't work out. For some reason, I didn't contact the PC engineer on this issue but changed my vps server to another windows server vps, and it seems that there were no more errors. The next time such errors occur, I will contact an engineer who will tell me what is wrong and how to solve this problem. The problem is that I don't always have the money to pay for the work of an engineer, and I want to continue to work comfortably. It's good that now there are many good vps servers, and everyone can choose the best one for themselves.