if your telling the client go down the tunnel for EVERYTHING, there is little reason to have to send routes for your specific networks since EVERYTHING will be coming down the tunnel ;)

@ThePieMonster: haven't been able to find any guides on how to use Windows AD authentication with pfSense's OpenVPN Server. How much time have you spent searching? 0 secs? https://www.google.com/#q=pfsense+openvpn+radius+active+directory

Yes, the problem was, that I haven't created a certificate for the user itself, but used the VPN's CA… After the modifications everything goes well now. Thank you for your help and I wish you a happy new year!

Solution: we have to stop routing service

Got it to work.. The biggest problem I had was determining the correct external IPV6 address to use as I made it more complicated on myself as I did not have my cable modem in bridge mode. But, figured it out. Thanks again for trialing this so that I at least knew that it did work (or didn't have some sort of bug). Then I knew I just had to play around to get the right addressing and port forwarding. Awesome!

I saw this thread from 2013 and wonder if anyone has found a solution to syncing from iOS over OpenVPN to iTunes on the other side of the tunnel. Thanks…

@johnpoz: That really should have zero to do with it.. Is your remote client a member of your AD?  And you want it to register its vpn IP when it comes in via vpn? Yes this is a AD Member, as i say the same Device and Shrewsoft Client with IKE without any Problems only openvpn.

you guys were spot on! much appreciated !

@sos: I've reset my pfSense setup back to factory default, and just re-set up my openVPN server using the wizard, before setting any other services or firewall rules up. Glad to report that all is working, using my android phone and linux clients, via a 3G connection. As I carefully rebuild the rest of my configs, I'll keep checking functionality and may retrospectively be able to figure out what caused the issue in my case. Perhaps there was some stale firewall rule or state. Will report back if I find anything, but in the meantime, thanks for all the suggestions. Yesterday, I did the same: reset to factory defaults -> start new configuration with openvpn-server first and now it works ??? After setting up the ovpn-server, I reconfigured all (nat-)rules, snort, webproxy, vpn-clients, outgoing vpn-failover and wan-failover and did a connection test after every single step, without any errors. Now the configuration is exactly the same as before and openvpn-server is reachable. So I have no idea what the problem might have been.

you'd need to script a marcro to write the config (examples can be found in the wiki link i posted before) i posted some examples for someone who wished to change settings to captive-portal here: https://forum.pfsense.org/index.php?topic=121762.msg673072#msg673072 its not all that difficult but will need some experimenting.

We've been watching it. It's on pfSense 2.4 snapshots now and we're looking over what it's added that can be brought in. Already have a few good reports of speed improvement with AES-NI and AES-GCM in OpenVPN

It runs as root because otherwise it can't fully manipulate the routing table or take all of the actions expected by up/down scripts. We do plan on working around this in the future but it is still a way off. If you are worried about OpenVPN running open to the world, use a TLS key to protect OpenVPN (you might already be doing this).

For some reason the wizard created a user cert, not a server cert, on the first pass.  I went through the wizard a second time and it created the server cert the second time.  That was what was missing.

You need to use policy based routing for that, but first, you need to create new interfaces and bind your tunnels to those interfaces: Interfaces -> (assign) Once that is done, it will create new gateways which can then be used in your LAN firewall rules. For example, if you want a client with an IP of 10.0.0.1 to be routed over a certain interface, you'd create a new LAN rule above your any/any, change the source to 10.0.01: [image: 2017-01-01%2011_26_13-pfsense.gilbert.home%20-%20Firewall_%20Rules_%20Edit_zpshbibdsy0.png] then in the "Extra Options" section, click the "Display Advanced" button, scroll down to the bottom and change the Gateway: [image: 2017-01-01%2011_29_43-pfsense.gilbert.home%20-%20Firewall_%20Rules_%20Edit_zpsc1ttifpn.png] Now all internet traffic sourced from 10.0.0.1 will be routed over the tunnel assigned to that particular gateway. *** The one gotcha that I've read is that you need to bounce the tunnels after the interfaces are assigned or traffic will not be routed properly.  So, Status -> Services and restart the service for each tunnel you assigned to your interfaces***

OP, this is a common question.  The others have already mentioned it, but at a high level, what you have to do is: Push the LAN subnet of site B to your remote access clients on site A Add a return route for site A's remote access tunnel network to site B's side of the site-to-site tunnel… i.e. if site A's tunnel network is 10.0.0.0/24, you would add 10.0.0.0/24 to the IPv4 Remote network(s) field in site B's config.

nvdstruis, the "redirect-gateway def1" directive is the equivalent of the following option in the GUI: [image: 2016-12-31%2005_37_02-pfsense.gilbert.home%20-%20VPN_%20OpenVPN_%20Servers_%20Edit_zpsaxbi9pdk.png] You will find it in your OpenVPN config under the Tunnel Settings section.

nvdstruis, it's a site-to-site tunnel, so that setting is moot. mrgenie, post your server1.conf and client1.conf Also, post a network map, so we can visualize how things are connected and what subnets are where.

It's working fine for me still. I've removed all single rules and have LAN subnet working. I also have multiple vpns up and running so I can funnel torrents down a specific one