Bah, I hate posting and then saying Nevermind, but I already found some closure. After multiple attempts on my Linux Desktop, I decided to just get the Certificate data straight out of terminal with the openssl command without the -noout. Entering this text in the text box (the BEGIN CERTIFICATE / END CERTIFICATE contents) with absolutely no modification worked. I compared the two entries side by side, and it looks like my Text Editor was still adding markup language. It's a silly thing, but if someone searches for this in the future, all I can say is keep trying to make sure your certificate data is getting imported with absolutely no modification from your text editor.

@audiobahn This is just an OpenVPN server on the NetGate with various devices connecting. I resolved my issue by redoing the OpenVPN server without the use of a TLS cert. Oddly enough, the DNS resolver suddenly stopped working and still has issues even after restarting the service. Haven't been able to reboot it yet. hmmmm... glad you got yours working

@mucip said in Site to Site and Server-Client VPN in same Pfsense?: very helpfull drawing Your more than welcome - yeah if more people would post up drawings right off the bat, stuff would go some much quicker in figuring out the issues.. I always like to have a drawing - even if just for reference on what trying to accomplish.. It helps to make sure everyone on the same page if you will ;)

@bob-dig said in unable to access surfshark via openvpn: @vjer2021 First it is SHA512 not SHA-3 512. low and behold, that solved. it. thank you Bob. You're a gentleman and a scholar. and curse my eyesight.

@fairy Examining how your computer connects to your VPN can help you determine why and where the connection is slowing down.

@chrischambers Yes, if you want to policy route the traffic from certain devices through the vpn, you should have this option checked on both. You can also start / stop the client services on the OpenVPN status page when you have both enabled.

@johnpoz yes, I have it there. Just curious if I'm the only one with this (little) problem.

@droidus Check the system and OpenVPN log for hints.

@marvosa here are my screenshots. [image: 1633883990588-firewall-rules-nat-port-forward.png] [image: 1633884009576-firewall-rules-floating.png] [image: 1633883999380-firewall-rules-wan.png] [image: 1633884021253-firewall-rules-lan.png] [image: 1633884027850-firewall-rules-wlan.png] [image: 1633884033258-firewall-rules-openvpn.png]

All is working now, I had to add a firewall rule to allow ICMP, and then obviously TCP/UDP traffic too. I was confused because the VPN subnet said 172.16.100.0/28 but I was getting an IP of .18 for some reason, but none the less it still works. Thanks anyway all sorted now.

I don't know what changed (aside from me opening this topic), but suddenly it is working now...

@johnpoz Many Thanks.

@viragomann I tried disabling the port-forward rule but the connection didn't drop at all. Maybe I need to kill the states on the firewall but can't do that during production hours without disruption. I haven't actually disconnected the primary WAN either. I suppose I could try that after hours for a real test. I'm adding 2FA to our VPN connections so this is the perfect time to make the connections more robust with failover as well.

@jfassad Thanks a lot for the info. I'll give it a shot!

@thisisbenwoo Do you have a Firewall -> NAT -> Outbound rule for your VPN Network? Mine looks like this: [image: 1633443722934-screen-shot-2021-10-05-at-9.21.56-am-resized.png]