In that way, if HDSL link goes down, all services will be still reachable via VPN / WAN2 link, even WAN2 is a private/natted connection. yes probably Also, if the WAN2 link goes down, VPN can be activated via WAN1, and again all services are available on both public IP. this might be a little tricky … there is, by my knowledge, no way to "activate" an openvpn connection upon failure. two things that might be worth a shot: -run the openvpn client (pfsense) on a virtual ip on the LAN interface and use a failover group to decide what WAN interface the client should connect to the server <-- perhaps someone has done this allready -perhaps the vpn provider is willing to offer 2 seperate openvpn connection, attached to the same public-ip ? Do you think is it possible ?  How I can manage the VPN as a WAN3 ?  Have someone any other suggestion ? most of it yes, some detail are a maybe. assign an interface to openvpn (interfaces–>assign). Lots of folks will probably have suggestions about the details :)

Solved : A /30 will only work if you set up this with a shared key. For site-to-site you should use a shared key. Yes you will have to set an interface IP, because with a shared key no routes/IPs/DHCP-settings/anything will be pushed from the server. The configuration is only what you put into the config file. The reason why a /30 with a PKI won't work: In a PKI you have the x.1 IP for the server. Every time a client connects a new dynamic /30 subnet is added to the virtual interface. So x.0/30 initial IP of the Server. x.4/30 first client (x.5 server, x.6 client) x.8/30 second client (x.9 server, x.10 client) etc. This ensures that the clients can talk only with the server and not with each other directly.

HA! I feel dumb now :) Thank you for the quick response, and for the link!

Thanks, fixed.  I had to create both WAN and LAN rules specifying the correct gateway interface.

The keys to operate the VPN are kept in config.xml and will upgrade. If you want to start managing the keys from the GUI rather than easyrsa, then see this: http://doc.pfsense.org/index.php/Using_EasyRSA_Certificates_in_2.x

I have no experience in making an OpenVPN connection be NAt'd on arriving into the local LAN. Someone who has some idea (or can say why it is not possible), please feel free to advise!

Thankyou, an entry in site B domain overrides pointing the domain to site B's DNS server did trick.

@AlanMAC: Thanks guys! I did a write up, which is attached. Hopefully someone will find it useful. Thanks Much for the write up, i haven't tried it yet (will do in the coming days) appreciate the effort  ;)

Thanks again, you are my hero!

Site to site VPNs should never be bridged, that's a bad network design that's begging for problems. Not related to the problem, but I'd stop trying to fix something that shouldn't be done, and put a proper routed setup in place.

I have solved one issue.  To get Host C to route 10.224.34.0/24 over OpenVPN for the 10.111.79.0/24 network I had to go to make changes in the outbound tab (Firewall->NAT->Outbound).  I changed it to manual and added an OpenVPN rule. [image: ManualOutbound.png] However the issue were I can not pint 10.224.34.254 from the 10.111.79.0/24 network remains.  I believe this is probably due to some pfsense setting on that particular box.  Although I am not sure what else to move since I have already removed  "Block private networks" (Interfaces->WAN). Another issue that has since developed, is that I am sometimes able to ping and sometimes not if I turn on an OpenVPN Server on HOST C. For Instance if I am on any of the the computers on 10.111.79.0/24 , I can ping 10.224.34.2, 10.224.34.100, 10.224.34.107, and 10.224.34.109. If I then go to (VPN->OpenVPN-Server) and I enable the server. I will sometimes lose pings to some of the 10.224.34.0/24 IPs , but it's not permanent.  Randomly, they some times work.  If I keep trying to ping them at different times some IPs will reply.  During this setup however I can still SSH into any of those machines.  Which means OpenVPN is still sort of working.  There is nothing special about my server config, I did use a different tunnel network, Diffrent CA and certificates.  This is my personal office network that I would sometimes like to access when I am somewhere else. [image: sconf1.png] [image: sconf2.png] [image: sconf3.png] [image: sconf4.png]

I solved it. Anyone running into this problem: On SERVEER PFSENSE you new to enable advanced routing(AON). On that screen once you activate you will see rules. Copy the rule for open vpn, and replace it wil the IP range of PCs behind the Pfsense  client. Unline DD-WRT, pfsense does not do NAT on OpenVPN which is great :-)

The OpenVPN server is the same as on other distributions. There is no (major) difference between. The only advantage I see on pfsense is the GUI which is easy to use and you do not hneed extra hardware, extra port forward because all is on the same machine. And you can easily see which user is logged in, you can enable firewall logging on this user, you can discconect a user and so on.

It seems that you have: WAN IP 192.168.1.50/24 - gateway 192.168.1.1 LAN IP 192.168.1.2/24 Normally there are bigger problems than VPN when I accidentally get WAN and LAN subnets the same. Usually I can't even access the WebGUI from LAN. First thing is to make your LAN a different subnet - e.g. 192.168.2.1/24 Then the ordinary routing will work, and maybe when the VPN connects it will do something useful. If you want/need to access your pfSense from what is its WAN side (which is actually behind your other router and cable modem), then you can easily add pass rules on WAN to do that.

In this config you can't access from pfsense subnet to dd-wrt router to manage via web or ping, only telnet. But some code maybe added to dd-wrt router firewall script: iptables -I INPUT 3 -i tun0 -p icmp -j ACCEPT iptables -I INPUT 1 -i tun0 -p tcp –dport 80 -j ACCEPT and saved.

Given that none of those log entries indicate it fully established a connection, I'd say you're either pointing it at the wrong server IP, the firewall rules on the server end are blocking the traffic, or something in between is blocking the traffic.