@bobby121418 As long as the ends have different addresses, within the same subnet, it should work. PfSense does that for you automagically. It assigns the first usable address to itself and subsequent addresses to the client(s). All you have to do is pick the subnet.

@unsichtbarre I do it all the time. Put your "remote" box behind your primary box LAN and build the OpenVPN instance that way. Make sure both boxes have different LAN subnets.

@danielino1981 Could be. Depends on the HW and the level of encryption....

@viragomann Thank you. This is when it comes out that I am a self-taught amateur. It solved the issue - I did not have a NAT rule for the OpenVPN server interface. To answer your second question: That is my mobile phone - the source is there to set it up on one device since other are connected. (I allow access to a bunch of friends via my OpenVPN server (and FreeRadius) accounts to those that host my RPI or live in totalitarian states - they get to watch Netflix and/or read uncensored news). Thanks and I am closing this post.

@mike_7947 Take a look at the following for guidance regarding address selection. https://routersecurity.org/ipaddresses.php Ted Quade

@jknott I just noticed ULA is covered by the RFC 1918 rule, so I deleted my ULA rule.

Hi @viktor_g, thx this one solved issue.

Thanks worked, its just put the same CA Name in Common name client specific override.

@codemasterjc Did you ever get it figured out? I plan to use a video I found (https://www.youtube.com/watch?v=lUzSsX4T4WQ) and I also found a promising document: https://forum.netgate.com/topic/116235/guide-how-to-connect-pfsense-openvpn-client-to-ipvanish If you have something better, please share.

@aminbaik said in pfsense openvpn client port forwarding](/post/1040351): its my i resolved it by add the server subnet to tunnel address.

@aikikun My guess is that you might have installed OpenVPN as "user" , it seems that it needs to be installed with local admin privilleges. See below: https://github.com/OpenVPN/openvpn-gui/issues/281 As Local-Admin, uninstall openvpn. Login as your user and re-install openvpn. At the UAC enter the Local-Admin password. This should create the group and add your user to it. It does not point to pfSense , as being the source of the error. /Bingo

UPDATE: IT WORKS! I did a clean install of v2.6 and selectively imported sections from the prior config.; specifically the OpenVPN, System, FW aliases (NOT rules), DHCP and DNS forwarder services. I did add an 'allow any-any' rule to the OpenVPN interface, but the WAN and LAN interfaces were left at default (basically empty). I did add DHCP options 066 and 160 to specify a provisioning server rather than manually entering it on the phone. A factory reset of the phone did the expected; downloaded a config. and registered with the PBX at the remote site. It can make and receive calls normally. I can't honestly say what the root cause was so it will just have to remain a mystery.