@heper: set the interface-type to "none'  (you don't fill in ipv4/6 info on the interface page) @got0: The interface is only enabled, nothing more. For the rules, I use aliases for the 'interface net' and 'interface address' now. No such thing needed for useless logspam - https://redmine.pfsense.org/issues/4102

I found this on the web, Nitro Key User authentication on local computers (e.g. Windows, Linux) and networks (e.g. Firefox, OpenSSH, OpenVPN, IPSec, OpenID).

@ulla5000: I`ve taken the .p12 file, converted it to B64 Pem and imported the cert again. Is there a (another) recomended way how to handle that? I don't think so. @ulla5000: I`ve taken the .p12 file, converted it to B64 Pem and imported the cert again. Create a new CA and issue new certs… ?  ::) :(

What version of pfSense are you running?

Agreed, thats the only way you could do that.

You have both local networks listed in the OpenVPN Server instance?

This is how I do it: https://forum.pfsense.org/index.php?topic=84463.msg463226#msg463226

When I behind the first Pfsense with my mobile phone (connected with WIFI), connected with OpenVPN I have same issues. Then when I switch off the wifi and try the same over the mobile data connection, it works fine. So this suggest nothing to do with client…

Works like a charm! Thank you very much :D

Dude WTF does public vs private or domain have to do with it??  That is just setting your firewall rules that would be inbound rules to that box, not outbound. I am on 2.2.3 and it works perfectly as well - a vpn interface does NOT get a GATEWAY!!!  its a TUNNEL!!! Connect to your vpn, post up your route print output and your ipconfig /all output  and what IP you trying to get too?

OK, so we've finally came to a conclusion: I missed the "peer to peer" vs "remote access" configuration, but now that you guys mentioned it makes perfect sense. I'll try to see what I can do and post my findings here, should anyone be interested. On a more general topic, @doktornotor, I really appreciate your suggestions and technical feedback (although I don't agree with some of them you have a fair technical point / concern). What I didn't appreciate that much was the tone and little sarcasm which I think could have been avoided. Thanks

what are these virtual ip's you are talking about? could it be a nat issue? one side of the site-2-site thats natting towards the other end ?

Yup - it's enabled on both ends and the proper key is used on both ends.

Hi, Thanks for the reply. After a bit of a voyage of discovery I was able to ping only those clients using the new gateway device (the clone) so you are indeed correct, they are on the same subnet but different IP's for the gateway. Guess the only way to fully test this is to clone the live system and then bring it up using the same gateway IP address as the live (after taking the live offline) Drac