@kpa: Nothing ready to use afaik but OpenVPN has -client-connect and -client-disconnect scripts that are run when client connects/disconnects so it's possible to hack something in those to register/deregister entries to the DNS forwarder/resolver during connect/disconnect. Do note that there is no DHCP used on an OpenVPN connection when the usual settings (tun type tunnel network etc.) are used so the OpenVPN server never sees the hostname of the connecting client, it sees only the CN from the client certificate of the connecting client. In my case at least with any machines I care about reaching I've already set the CN to the same as the hostname (lacking any other ideas what to put) so maybe that will help. I assume this is a server-side script setting?  Is there any documentation on how to do this in pfSense? I'm quite familiar with both networking and bash/sh/csh scripting from work projects but I've never worked with VPNs before (from an administrator point of view, I've only used them as a "client" before) and I'm not sure how I'd properly "save" a script to pfSense.  I assume it has to go in a certain place to be saved thru upgrades/reinstall and then I'd have to reference it there in the openvpn advanced-configuration and somehow it would "find" what clients are connected to register them.

hi just tried it, works alright, thanks for your help whosmatt and kpa  :)

Hum, it's ok with new pfSense 2.3.3 thanks

I got this working. I had way too many rules it seems, I followed a tutorial when I set things up that told me that for every rule I create on one interface like LAN I had to create the mirror on it's destination. I just disabled half my rules and everything is running fine. To opt out the one device I made one rule: Pass, Interface=Wireless, Source=Singlehost-192.168.25.45, Destination=any, Gateway=WAN No extra NAT rules or anything else and it works great

Thanks for the reply. After thinking about it, I too realized that this probably won't work. Oh well.  Much appreciated!

Did you setup the Bridge?

After looking for some openvpn configurations in /etc/ I possibly could apply from my existing installation, I was searching the forums until I found this thread OpenVPN config file? and realized the configs are stored in /var/etc/openvpn/ so from the webui via menu "diagnostics" - "edit file" its possible to edit your specific config. Looking at the openvpn logs it seems like it works same as it worked on my existing installation. I have to fully set up pfsense to test if the same configuration would work, but so far it looks good. Thanks

If you can't change your router to act as a (bridging) modem, at least you need to be able to add corresponding port-forwards for your openvpn server. Without a possibility to connect to the openvpn server from outside, it won't work. See OpenVPN Networking

@jimp: The new version of the export package includes OpenVPN 2.4 binaries. They will work fine with OpenVPN 2.3.x servers. The message in that description is warning you that if you have an OpenVPN 2.4 server, and the OpenVPN 2.4 server has features enabled that are only in OpenVPN 2.4, then an older OpenVPN 2.3.x client may not work against that server. Thanks for this explication It's ok Have a nice week-end,

Anyone have any ideas??

To answer my own question, it was pulling routes from OpenVPN. I checked the "Don't pull routes: Bars the server from adding routes to the client's routing table" box and everything is working as desired! Routing before: Internet: Destination        Gateway            Flags      Netif Expire 0.0.0.0/1          10.69.0.5          UGS      ovpnc1 default            InternetIPGoesHere      UGS        em0 Routing after: Internet: Destination        Gateway            Flags      Netif Expire default            InternetIPGoesHere      UGS        em0 Special thanks to FPSRogerRamjet for the help!

Yes, that will work with pfSense and also with only one interface. Do you plan a remote access server or a site-to-site? A site-to-site would be more comfortable for the remote users. In both cases you will have to add a static route for the remote site to the file server pointing to pfSense. If it's an access server for the tunnel subnet, if it's a site-to-site for the remote users LAN.

Yup - i think that fixed it.  I switched from "All" to multi selected.  All seems to be working now! Huge thanks for your help, truly appreciated!

How do you connect to those other /24 ranges? Is there some other router involved? In all likelihood the traffic leaves pfSense heading toward those other subnets but can't find its way back.

Can this be fixed on the next stable release?

Not currently, no. It may be possible with changes to some of the nsis scripts used to do the install but it's not something that gets requested often and I'm not sure how complicated it might be. Windows installers are not something I like hacking on ;-)

It's working ! I don't do anything more, just sleep a long night and it's working ! Amazing ! … Yesterday, my test don't work because i must drop existing tcp/udp flow before testing

@TheIPdude: I experienced the same problem! How did you solve it?