@johnpoz: "I NATed local IPv6" So you have not /64 segments and natted - wow what a BORKED setup! you don't need all that shit… You just need to add the ipv6 to your ipv4 tunnel.. yes, i have do that, but not work for me.

I forgot to add the link to the instructions I used for the Multi-VPN WAN as he/she puts it. I used the guide for my general sedtup and customized it a bit, substituting NordVPN's client setup for AirVPN's. https://nguvu.org/pfsense/pfsense-multi-vpn-wan/ I am thinking perhaps I should have put this in the General Section to get more views and perhaps help with the gateway aspect. I would be happy here with a start of how to just reset openVPN's setup to default. Looking into perhaps deleting OpenVPN completely and reinstalling. Might make things worse though.

Thanks Jimp! It was the last one on your list of things to check. Different CA for the OpenVPN server and user certificates User doesn't exist in the user manager *** User certificate is not listed on the user in the user manager**

I fixed it by downgrading the OpenVPN version on the client side (AWS EC2 instance). $ yum list openvpn Loaded plugins: priorities, update-motd, upgrade-helper 1023 packages excluded due to repository priority protections Installed Packages openvpn.x86_64                                                                2.3.14-1.el6                                                                      installed Available Packages openvpn.x86_64                                                                2.4.3-1.19.amzn1                                                                  amzn-updates Seems like AWS updates my AMI images at launch… I never did a yum update. Is this fix a big security issue? Will it all work out if I update my present main Netgate pfSense AWS instance to 2.3.4?  Will it generate the roght configs to work with OpenVPN 2..4.3 ? Thank you, JP

It works fine, I run some systems that have a half dozen or so of each. As long as they don't have settings that directly conflict (e.g. same tunnel network or they are both trying to use the same local port) it should be fine. What errors do you get in the OpenVPN log?

Thank you for the fast reply. Done and working.

Why do you want to use that option in that context? You could simply not enable any options that would put those directives in the config (e.g. don't set redirect-gateway, don't specify any local or remote networks), and then add max-routes and put in all of the directives manually after that.

You'd need to change your DNS such that OpenVPN clients would talk to a DNS server that returns the internal IP address for "foo.org" when they look it up.

Those log messages are harmless, they are the GUI probing the daemon status via the management socket. It is not a VPN client connecting/disconnecting.

But are you not worried that you will be leaking dns from pfsense when it checks for updates and package list, etc. <rolleyes>;)</rolleyes>

An auth error is considered a hard failure by the OpenVPN daemon and it shuts down. Try adding this to the custom options in the client's advanced config: auth-retry nointeract; Service watchdog should also work.

Ok, I've narrowed this down.  It seems the redirect-gateway command is what's preventing IOS from switching from cellular to WiFi when "Cellular Only" is enabled in the OpenVPN settings.  Any thoughts?

any help please

Very true - but the export gui is not designed for that fancy stuff ;)  You would would have to edit the config by hand for that..

@sirbusby: After upgrading to version 2.3.4-p1, static IP clients in openvpn do not work. Earlier I registered in the Custom options ifconfig-pool-persist /var/opvpn/ipstatic.list. The file specified the correspondence of ip adresses. Now after restarting openvpn in the file /var/opvpn/ipstatic.list, ip addresses are overwritten Yes, some trouble were detected in Open VPN connexion.