@Brow98n In what scenario am I attempting to set 2 default routes? I am thinking an assumption was made here, probably due to my bad explanation of the problem. When I log in twice with the same user it is from different machines as I would not be able to easily determine which tunnel was broken. I do not have OpenVPN overwrite the default route on the client, I just advertise routes to specific endpoints inside my networks. I do not believe that OpenVPN easily supports a per user route advertisement, AFAIK, it is a function of the OpenVPN instance. In the end, if I can give routes to device list A to user list A and device list B to user list B, that would accomplish my goal of 2 instances, and work around my issues I have on the second instance.

Hi, All the trick resides on Phase2 entries and Openvpn Remote networks setup. Let's start on OPENVPN config. You should configure OPENVPN Server Tunnel Settings like this [image: 1591261195124-openvpn.png] And now let's go for IPSec I will assume Phase1 is connecting properly You should add a new Phase 2 entry for injecting OPENVPN traffic from clients to IPSec remote network The final picture will be something like this [image: 1591261660195-ipsec-general.png] Just add a new P2 for IPSec traffic [image: 1591262586504-ipsec-p2.png] And finally check Rules on OpenVPN and IPSec interfaces to let traffic flow Here we have an example of what we have in a customer. There are restrictions of traffic getting through the tunnel to the IPSec remote network [image: 1591262858763-ipsec-rules.png] And we have full acces from OpenVPN clients [image: 1591262936917-openvpn-rules.png] We have all NAT outbound set as default [image: 1591263112624-nat-outbound.png] When connected, in Status - IPSEC - Overview you should see something like this [image: 1591263455748-status-ipsec.png] When testing connection, just send a ping from OPNVPN Subnet (you can use your pfsense OpenVPN box IP as source IP) and check on status if packets-out increases. If they do, you are injecting OpenVPN traffic through IPSec tunnel. If there's no response, check other side firewall and settings. We had a strong headache with a provider that did not set rules properly on their side. But if there is increasing Packets-out count, you're sending the traffic properly. Also note that when doing traceroute from OpenVPN client subnet you will have a "strange" response. It will be something like this in your case, assuming remote IPSec gateway public IP address is 203.0.113.10 Traza a 192.168.0.15 sobre caminos de 30 saltos como máximo. 1 7 ms 6 ms 7 ms 172.26.200.1 {pfsense OpenVPN IP address) 2 79 ms 77 ms 77 ms 203.0.113.10 {IPSec remote gateway public IP)} 3 78 ms 78 ms 77 ms 192.168.0.15 {remote ip} That's correct and traffic is tunnelled inside IPSec. Hope this helps.

@paulparisi said in Accessing OpenVPN Connected Devices: Is there a better way to do this? Probably not. You could hand out addresses via RADIUS but either way it's manually managed. Is there a way to have a full DHCP server on the OpenVPN private network? Not in any meaningful way. You could bridge the VPN to a local interface with a DHCP/DNS structure, but that has other drawbacks.

Well, it appears to be that the pfSense GUI is simply hiding the IPv4 Remote Networks option that I need to set on the main page, since I've selected a "Remote Access" mode. This is somewhat disappointing since that isn't even an OpenVPN "thing", just a pfSense "thing" to determine what GUI options to show and what options to hide. Guess I'm off to file a bug report / feature request to ask that we get a 5th "type" option for OpenVPN servers called "I know what I'm doing, don't hide any options from me." In the meantime for anyone running into this, I think the only way to address it without having to create a separate server on another port so you can get run it as "peer to peer" is to assign an interface to the OpenVPN instance which you can then use to assign a gateway and a static route in the main pfSense routing configuration. Ugh.

@Rico said in OVPN export to iOS fails: Yeah NM, I see Gertjan is also using udp4 in the config like TO. You bet it is ! I'm actually VPN-into-work just to get my iPhone 'multistacked' ^^ All this over an UDP IPV4 link of course.

I ended up resolving the issue. Only used the local Windows DNS server for the OpenVPN configuration. Viscosity setups up this loopback to internally handle the DNS itself.

@sreyas On the server configuration page, you select the protocol and local port. You'll then have to run client export again.

@q54e3w On the server side, I assigned the IPv6 Tunnel Network prefix. I also selected Redirect IPv6 Gateway, though that depends on your needs. In Advanced Configuration > Custom options, I added push "route-ipv6 ::/0". I also added that on the Client Export page, though I don't know if both are necessary.

@JKnott @Pippin Thank you very much! I have been putting this off due to a lot of dhcp reservations, but find and replace, in the xml export, reimport and reboot made it fairly easy to migrate to a subnet less likely to cause me conflict.

Thanks that was the problem.

Great! Many thanks for clarifying that :)

@Mat1987 Just to add. I can connect using a mobile hotspot but when using work connectiong its trying to use 1194 as local port. Mat

@azmodeuz said in OpenVPN SSL Site to Site - I am unable to push DNS to Site B and access a routed network in Site A from Site B: I set pfSense3 as OpenVPN Server so remote users are connected locally to communicate with our Local Net. Would this still be possible if I use pfSense2 as the OpenVPN Server? You will need a static route on pfSense3 for the OpenVPN tunnel network 192.168.121.0/24 pointing to pfSense2. @azmodeuz said in OpenVPN SSL Site to Site - I am unable to push DNS to Site B and access a routed network in Site A from Site B: Re: NAT, how should I do NAT to get responses back to pfSense3? You can add an outbound NAT rule on pfSense3 (S-NAT, also known as masquerading) which translates the source IP in packets from the remote site of the VPN into the DMZ interface address. So responses are sent back to pfSense3. However, that's a dirty solution and is not recommended if there are multiple clients connecting through the VPN.

Boa tarde, O Open-VPN funciona bem no pfsense se você segue as seguintes descrições: https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/openvpn-remote-access-server.html https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/using-the-openvpn-client-export-package.html Gostaria de mencionar que o suporte oficial ao Windows 7 terminou, portanto lembre-se disso por questões de segurança. isso causa um problema: [image: 1590517786999-bd25ae00-1dec-40ed-9447-24049653c980-image.png] Cumps, C

As addresses of RAS VPNs are handed out via DHCP there's no way I know of, that you could persuade the server to hand out a dial-in client more then one IP.

@Rico Thank you for noticing my post. This is my layout The pfSense2 is my Public Firewall or gateway. INTERNET == pfSense1 (Client) --- LAN B (192.168.140.0/24) --- PC B (192.168.140.10) || pfSense2 (Gateway) --- DMZ net (192.168.88.0/24) --- pfSense3 (Server) --- LAN (192.168.8.0/24) LAN B and LAN A can communicate properly except that I am unable to push DNS to LAN B pfSense3 which is both the DNS and OpenVPN server. PC B can ping pfSense3 LAN 192.168.8.1 and WAN 192.168.88.7 but I cannot ping pfSense2 LAN 192.168.88.5.