You need a route on the client settings to the server side subnet and the iroute on the connecting client to the server side subnet in order for the Clint subnet to respond to packets from the server side subnet. Example If your server side subnet is 10.2.0.0/24 you need to add iroute 10.2.0.0/24 to the client specific overrides section of the OpenVPN configuration on the client side

If you open a command prompt and run a route print do you see a route to the server subnet through the tap interface IP?

Install the OpenVPN client exort utility package. After you get a tab for the export utility in VPN > OpenVPN. Use this tool to export the certs and config and check "Password Protect Certificate".

Yeah outbound NAT on LAN

I finally found the problem. My ANTI VIRUS was blocking connection, so i had to edit the AV rules.Thanks to you all!!!!

So you have your sites connected to a mpls cloud.  And these sites also have internet where you run a vpn tunnel between the locations. Now you want to auto use the vpn connection over the internet if the mpls is down? As helper stated this is normally done via running a routing protocol.. If the mpls goes away that route drops off and you use the less priority route.

well i just ended up reinstalling pfSense again from scratch  and its working the OpenVPN its just odd this happened Thanks again

I found a workaround of sorts: unchecked the "bridge dhcp" box left "bridge interface" set to none left "server bridge dhcp start" and "end" blank in custom options i added: server-bridge 10.1.0.1 255.255.255.0 10.1.0.150 10.1.0.200; push "redirect-gateway def1" (it was the "server bridge" command that was setting the wrong gateway in the openvpn config.  As i wanted to keep all config in the xml, this seemed like the easiest workaround) thanks! -bmwt

Some update here. No problem with OpenVPN Client 2.3.14 Only higher versions are affected

problem solved. decreased "time period" (Time period in milliseconds over which results are averaged. Default is 60000.) to 5000 Now wan correctly goes down, OpenVpn do not crash.

Never mind. The things I wanted to add to the config needs to be done on the client-export tab. This is resolved now.  8)

@bilbo: Did either of you get this to work? yes i did. I've setup an alias for BBC as per the below screenshots… It seems to work fine for me - i can leave all IPs on my network connecting via VPN but only BBC sites get routed to bypass the VPN. I just need to work out/find the IP address range for Netflix now! HTH EDIT: just to confirm this works on both iPlayer website on my PC and also on iPlayer app on Samsung TVs. It also unblocks entire BBC website [image: Capture.PNG] [image: Capture.PNG_thumb] [image: Capture1.PNG] [image: Capture1.PNG_thumb] [image: Capture2.PNG] [image: Capture2.PNG_thumb]

Your OpenVPN client configuration is set to require a password but there is no password entered in the GUI for that client. The server may be pushing that requirement to the client.

Whew,  :) thought maybe I was losing my mind for a moment and somehow what I thought was 48 bits had changed.