Upon further investigation, it seems openvpn calls /usr/local/sbin/openvpn.learn-address.sh specifying the domain, ip, fqdn and an "update" command.... OpenVPN calls this script twice - once for legacy ipv4, and again immediately afterwards for ipv6. The problem seems to be that this script explicitly tries to create A records irrespective of the value provided for $IP, which when coupled with the ipv6 address are then rejected by the /usr/local/sbin/unbound-checkconf command. Forcing it to create AAAA records reverses the problem, it now only creates ipv6 records. Given more time i'l look at creating a patch that checks for and creates both.

Does anyone have any idea how to solve this problem?

Probably. I don't pretend to know how FreeBSD handles that but in general, yes. An OS will use the resources it has and try to spread the load over as many cores as it has.

I configure a VPN. Pheraps I'll change some configs in the future cause I don't fully understand how it work. Thanks for the videos Iam viewing them right now. I hope I'll understand OpenVPN better after seeing them. Firewall rules on OpenVPN tab works like a charm!

No one would have a clue what my problem is ?

I'm sorry... typo my local network is 10.x.10.0/24 Thank you very much for your help guys! I really appreciate it :)

I would not think IGMPProxy would be a solution for you but feel free to try it.

@viragomann thank you sir

Damn that’s encouraging

No, the static route is applied to the OpenVPN traffic as well. But the providers router may not have a route for the OpenVPN tunnel network. So I guess, its default route is not passing pfSense? If that's the case, you either have to add a route for the tunnel network to it, pointing to pfSense or do NAT on pfSense for traffic the the network behind the router. Another reason may be that access from the VPN tunnel is blocked. This can also be circumvented by NAT.

Thank you all for your contribution. I finally solved the "overvpn not using pfblockerng filter" by simply adding pfsense IP address (192.168.2.1) in to the OpenVPN server setting-->Advanced Clients Setting-->DNS server enabled-->DNS Server 1. No need to regenerate/export client ovpn file.

@johnpoz thanks mate, i worked it out and its now working 100% to my needs.

Yeah, I decided to just use the following instead and its working. push dhcp-option Domain "domainname"

Gertjan, Thank you, I changed it to 192.168.9.0/24 and now things appear to be working!! I'd tried that at one point but when I did the OpenVPN service wouldn't start for some reason, the log said something about a subnet mismatch (don't have log anymore) and I couldn't connect at all, when I brought it in to 192.168.0.0 the service would run. Not sure what the problem was before but it's working now. Thanks again!

So that is a site-to-site configuration? And you can reach the servers LAN from the clients LAN? Have you added a firewall rule on the client OPT3 to permit access from the other site?

@techjunky said in OPENVPN and IPERF not working: Enabled AES-NI cpu on the Netgate 3100 and now I am getting 10Mbit compared to 6Mbit. So it did help a little. That is interesting since, as the SG-3100 is an ARM device, it does not have AES-NI.