As has been said, you do not need anything in custom options to do what you need to do. Are you trying shared key or SSL/TLS? If shared key you have to duplicate reciprocal routes and tunnel network settings on the client side. You cannot push to the client when using shared key. If SSL/TLS you can push them to the client from the server. If using a tunnel network larger than /30 and are using SSL/TLS you ALSO have to set a Client-Specific Override on the server for the client setting the remote network there.

@johnpoz: What is your link speed? FastEthernet LAN between my pfSense box and my ISP Internet gateway. ADSL WAN link encapsulation IPoE 8000/500 Kbps dl/ul on my Internet gateway

have you figure out the problem can you explain what you have done to get the freenas under openvpn running as i am unable to access my nas under openvpn though i can run my dvr and printer remotely but no way for my nas4free

Is what about what better than what?

Hmm, even with rules that allow everything, still no success..

You referred to an article that referenced setting separate, static addresses. That's what was provided. I do not think there is another way to set another pool in a CSO. I could be wrong. I would just run another server for that.

Hi, Thanks for the reply. You are correct: it does work out of the box. T he probleem seems to be just ONE system (and that happened to be the one I was using as a reference to check if it works) that cannot be reached. I will further investigate the problem with this one system but it is probably not of interest to the community what the problem is so we can close this thread. regards.

I found a solution. Set the IP of your LAN interface to none and set the firewalls IP on the BRIDGE interface itself. I did this by downloading the config, editing the XML and uploading the config again. I tried doing it from the WebUI but accidently broke my network because I couldn't remove and add the IP to to the other interface at the same time. Hope this helps.

Is there any way we can get manual updates to vulnerable packages or are we just expected to wait for the next major/minor release? For a system that sits on the front lines of a LAN, I really would prefer that it's as secure as possible. According to 'pkg audit', I have 4 packages that need patched in pfsense v2.3.4.

Connect the vlan 3 to the vpn connection.

It may have the same cause as the problem at https://forum.pfsense.org/index.php?topic=127274 "Short hostnames not working on 2.3.3" There you have to make a change in the dns forwarder settings to get it working properly after a reboot. It does not matter what you change. It looks like some post-boot trigger is missing somewhere.

Pretty sure when you buy hardware you get 2 free support calls included in the price.  I did when bought the sg-2440.  Haven't used yet, prob never need them - but nice to know they are there if needed.. For setting up road warrior - you click through the wizard, then go to the export package and download you config.  Done! Now what I did run into recently, is that the ios app does not support the newer tls-crypt feature of 2.4 openvpn.. So you have to make sure your just using tls auth and not crypt.. I would suggest you post up your config, post up your logs from client and server and we can figure out what you are doing wrong.

@tgilcas: Thanks a lot for your help, i added pfsense as gatway on vm windows server. but did not helped. so what i did was in pfsense in dchp was adding static ip to the windows server and then i changed windows server ipv4 to get automatic ip, now i can make ping from vpn, i cant do the same to exsi host server. so, why is this? why if i put statics ip on the windows it does not work? any suggestions? You need to rephrase this.  It's unclear what was done to what…  and what is working and what is not. Also, to go much further, you'll need to provide more specifics about your topology.  Without specifics, your issue could be related to a dozen different things and we'd just be taking shots in the dark which is inefficient at best. Post a network map showing your topology and subnets in use Where are you testing from? Post your server1.conf The fact that PFsense is virtualized also adds another layer of complexity.  We'll need details on your ESXi setup.