Now I know  :)

Will try to find why its working for me. That machine as I just discovered, is getting detected through NetBIOS so yes maybe its WINS. Under Network select View-Details, then right click on the columns (Name-Category-Workgroup-etc.) and select "Discovery Method". Then you can see how they`re discovered, obviously  :o I hope thats clear enough because I dont have English version of Windows  :)

Hello, I have the same problem. When I'm connected to the VPN I can not surf the Internet, but have access to the remote network.

Removed 'ping-restart' and other 'ping-xxx' options from the config and now the vpn client doesnt die.

That was it - changing it to 10.254.254.0/24 worked! Thank you all!

Moikerz, Pippen, NOYB, I really appreciate you guys replying back.  I've researched some things already that you all have mentioned and I'm going to do my best to dive in and start testing.  Wished I was looking for something simple in the GUI.  Guess not. I appreciate the sympathy on the matter.  I live in a state with only about 4 million people.  And I live in one of the larger cities if you wanna call it that.  I just refer to it as a big town.  So if we want more bandwidth, we have to cough up a heck of a lot.  The whole supply and demand thing. Right now I'm looking for a reason to switch out a few of my clients DD-WRT routers with a bigger gun, like pfSense.  Was hoping pfSense alone with little customization would provide a better OpenVPN experience.  Aside from the killer interface in pfSense I'm pretty much in the same place I started with DD-WRT. Thanks guys!  Hoping I can make pfSense work out for me.  I haven't had this much fun with tech in a long time.  I could play with that GUI for hours on end.  Just wish I had more time.  "Technology, why can't it be easy?"  Guess that's why we get paid the big bucks ;)

Thanks, that's work and it's that i needed.

@toysareforboys: @BlueKobold: If encryption comes in the game often lower end or very old hardware is not really so nice to play with it. Would you tell us oerhaps at first something about your hardware setup? Board, CPU, RAM, 32Bit or 64Bit, etc…... Do you know how to disable encryption on OpenVPN? VPN implies encryption. To lessen the load you can choose AES-128 rather than AES-192 or AES-256, but you cannot disable encryption completely.

i had this "problem" too, until i figured out i need to create users & user certificates before i can use the export function.

Ok, now i understand. Thanks again for this explanation!

That's fine, and that's a typical way to deploy as a VPN appliance. For traffic leaving pfSense going to the rest of the local network, you will need to apply outbound NAT to mask the source, or add a route for the tunnel network on whatever routing device is used as the default gateway on the local network.

@BlueKobold: Because something is done in software it must not be really bad or more bad then other things. Its not really about bad/bad more but more about whats going on under the hood (and my lack of understanding). Thanks

@johnpoz: Yeah most likely when your on your vpn your using your vpn for dns..  Which kind of want if you want to resolve your home stuff..  So just create an over ride in your home dns to resolve where that webserver name is to its 172 address and you should be fine. or just create a host entry on your work machine to resolve what you want to the 172 address. aww yiss, hosts file entry worked perfect, Thank you!

Sorted out. As imagined, the problem was routes. I had realized that was intermittent. An hour traffic going through a VPN, another hour went by another. The solution was to mark the option that our friend posted verdi. "don't pull routes". [image: UhSXE8.jpg] I did it in the second VPN and normalized access instantly. Now the internet will for my WAN and the access of the VPNs will by their respective interface through NAT.

It's been a while since I've actually run an OpenVPN server or client but roughly speaking: Assign the tun(4) interface used by the OpenVPN client as an OPT interface at the Interfaces->(assign) menu. Create a new outbound NAT rule at Firewall->NAT, set interface in the rule to the newly created OPT interface, leave everything else at defaults.

I've done some additional diagnostics and found that after much trial and error, firewall B is seeing traffic (I shut off all rules, address an easy pass rule and logged it) and then verified it with a packet capture however, even with Windows firewall turned off (and the port open), I'm not seeing a response from the server like it's still not getting to it….

@cmb: Import your CA certs as a chain into a single CA config entry. Actually I did that. But it does not solve the problem completely. Still CSRs generated locally and signed by the intermediate CA are showing with issuer external. However, if I generate the CSR, sign them with the intermediate CA and upload the certs BEFORE installing the Intermediate CA (ca-chain) then they are recognized as being issued by the intermediate CA once the intermediate CA is added.

That's the basic idea, although I wouldn't suggest the hardware I'm running is particularly high powered (or even new for that matter, 7+ years old). I have learned that more memory is an asset as well - again within limits. 512MB is tight in some scenarios (I still have one box with 384MB! ), 1GB is good, 2GB is great, 3GB+ is fantabulous. The packages caveats always apply, asking the box to do more than route and basic firewall and/or VPN adds to the required resources. When you get to the Snort/Suricata, Clamv, setups a whole different set of parameters get invoked that are best described in their respective forums.