seems like, the only, what was missing, was a OUTGOING NAT rule i've added a rule with allow all from LAN to the remote net behind the tunnel. that made it work.

@noplan Thank you !

@milosz-engel for openvpn look here: openvpn-external-crl-automatic-renewing-openvpn-restart So... you could download the CRL with Curl, transfrom it in x509 and drop it where it is needed.

@gertjan You should try how the script works. It returns IP address of the LEAST loaded server in a country at this moment . The idea I have is to use cron to stop VPN client every 15 minutes, get the least loaded server IP, change it in pfSense OpenVPN client config and start the client. This way my pfSense will be "always" connected to the fastest server in a specific country.

@gertjan gotcha so my scenario is that I have a user who needs a vpn address from me but does not need my dns, or dns suffix. Just the remote network. So I believed that setting a csc with no dns option would work but instead they get the firewalls upstream dns servers which I didn’t expect.

@viragomann sorry, still don't understand, how to stop traffic from passing to normal gateways and pass it to openvpn client instead; don't capture general idea

@dimskraft Use the same command on pfSense ;) [image: 1646651924201-55c83b55-c7a9-4f0e-a804-bfeb184198ee-image.png] Your (old now) pfSEnse 2.5.1 is using (I don't recall any more) OpenVPN 2.5.2 ? 2.5.x on the client side, and 2.4.x on the server side (probably time to upgrade your docker and pfSEnse) should work. But there is a but. If you use mixed versions on both sides, you should really read the changelogs : https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25, just to make sure you not using an option that changed somewhat. Did the phone app test work ? What about an easy bare bone setup with certs, just a user/password + no -or minimal) crypto) stuff. That is, if you control the server side and have access to the server log file.

@bob-dig Thank you for all your help! BTW I updated to 2.6 AND I will make a back up of my config once I have everything back up. PFBlocker is next. :)

Try all of the below but none is working: Disabling 'Dynamic IP' setting Upgraded to latest pfSense version 2.6.0 Enabled the following [image: 1646390209421-4df3f129-3a62-4349-ba1d-ab25758f97bd-image.png] Looks like there is bug in pfSense?

@viragomann I think after some googling and a few coffees I found my solution: https://forum.netgate.com/topic/127814/pfsense-only-openvpn-server-with-only-single-interface-wan I haven't tested it yet, but it must be almost this problem. Thank you!

@alexparedes Did you also update the client? Which client is it? Also check the server logs for hints on what is failing.