Just out of curiosity, what kind of device is on the server-side?

Ok, so PFsense on both sides?  Lets take a look at your config…post your server1.conf and client1.conf.

Thanks for the advice! I have to wait until after hours to make changes but hopefully will get to it tonight. -j

No. The pfSense box is the client (I already have it running just fine as a server using the method you describe). I have imported the external CA certs and client cert etc but the tunnel won't establish. I'll pull some logs together and post here.

@GruensFroeschli: How are you testing this? If you test by downloading from a windows share, then this does in no way reflect the speed the tunnel is capable of. Are you using TCP or UDP as transport protocol? In general you will have better performance when using UDP. Yeah that what I was thinking. Windows share shows about 600k/s and when I look at the WAN interface charts I do see it uploading at all 5Mb/s. I use UDP.

No idea ?

For more discussion on the "management ports" issue of having multiple OpenVPN client configs in OpenVPN manager, and the user selecting one to start, but OpenVPN Manager getting confused and starting a different one, see: https://github.com/jochenwierum/openvpn-manager/issues/17

Pretty simple deal, just have to make sure your LAN segments do not overlap, but we need more info.  10.x is not enough information, we need all the octets and the network mask.

I did a little mod on the /var/etc/openvpn/server1.conf and the config is changed like i wish but  it is not finished (diffrent between tun/tap)  but maybe someone can do this job better than i. in my config it add's now (no: server 192.168.4.0 255.255.255.0 any more:-) mode server ifconfig 192.168.4.1 192.168.4.2 route 192.168.4.0 255.255.255.0 ifconfig-pool 192.168.4.4 192.168.4.251 push "route 192.168.4.1" openvpn.inc.txt

Interesting - I suspect with the recent NSA revelations there may be more interest in this.  Did you get it working? I'm thinking about doing the same thing myself and, like you, haven't played with VPN's before - but I think it's time to try this out with pfSense.

anybody??

The VPN server often push something called "redirect-gateway def1" to the client upon connect. This adds a "default gateway" that overrides your existing default gateway, and is probably what you experience. You have to block this behaviour in the OpenVPN client config under advanced by using "route-nopull" or "route-noexec", but they you must create your own routing to make sure whatever traffic should go out the VPNs do.

[image: 2exwtvl.png] (or use Other if not matching pfS hostname).

I actually found the problem I had ticked off Enable authentication of TLS packets. After I unchecked this, it worked. Now my problem is a have an ipsec connection to the datacenter at work.  I route 10.X.X.X and 172.X.X.X to that network (for certain ip addresses on my home LAN) and the rest of the traffic to the outside WAN.    When I connect to the open vpn, it disrupts this.  I have not figured out how to route the traffic properly.  I did try to create a new interface and create a LAN rule, but that didn't work.

You got a Multi GW setup for this ? If so, simply use a firewall rule to do this… like this here: [image: voip.png] Set the GW as required