I don't know if that is possible. However, you can bind openvpn to the LAN carp ip and forward it. This ip is available for both, master and slave.

ram is not an issue … openvpn is very cpu intensive. you'll have to see how much throughput you'll get.

I have plenty of OpenVPN site-to-site links on 2.2.2 and they work fine just like they did in 2.1.5 - put the right subnets in Tunel, Local and Remote Network/s boxes on server and client, make sure the firewall rules on LAN and OpenVPN at both ends allow the relevant traffic - that is all there is to it. When I setup a new office it takes only a couple of minutes to bring up OpenVPN site-to-site links back to our main offices, it really does work.

Sorry, I don't remember who it was. I searched a lot here and I don't have time to look for this thread in my browser history. Anyway, I found the solution and I don't care for this wrong information any more. That's the nature of forums at the internet. Not all information you find is correct  ;)

The windows client yes.  I'd assumed you were talking about pfsense as client.

@Derelict: Should get you going OK.  Note that this connection will be routed so broadcast discovery will not work. Two errors in the video.  The WAN rule on prirouter only needs to be UDP 1194, not TCP/UDP and the WAN rule on secrouter is unnecessary and can be eliminated completely. Thank you for your help. Actually broadcast is exactly what I want the most. Furthermore, I followed https://forum.pfsense.org/index.php?topic=46984.0 and it seemed to be covering what I am looking for, but how can I use it as point to point (pfsense to pfsense), rather than pfsense directly to the client PC?

Found my answer on below thread https://forum.pfsense.org/index.php?topic=81291.msg443963#msg443963

IPv4 tunnel network should probably be optional also because you might be doing pure IPv6, and in that case you would put an IPv6 tunnel network but no IPv4 tunnel network. The validation is in /usr/local/www/vpn_openvpn_server.php Look for: if ($pconfig['dev_mode'] != "tap") { $reqdfields[] = 'tunnel_network'; $reqdfieldsn[] = gettext('Tunnel network'); } else { ... That makes tunnel_network a required field.

Hi doktornotor, it succeeded: before I tried the same approach, but due to the concurrent presence of another problem (the missing change in depth, I suppose) I thought it was wrong… now it works. Thanks a lot, Diego

I should be doing this in the next week or so, if I do my part right the next post I make on this will be a successful-themed one!

Found great help on redit…  I suggest people go there.

Nice work Phil. Your changes works and the generated config now selects the IPv6 CARP interface address. Will make a bug report during the afternoon.

What are your pfsense server settings?  I'd love to see that server config page from pfsense to get an idea what you are doing wrong.

Fair enough.  This actually solves many problems, as many online forums are blocking me (PIA is my VPN service provider, and all their IPs are getting blocked all over the place). Had no idea the solution was so easy, really, thanks again.  This is a huge help.

192.168.0.0/22 conflicts with 192.168.1.16 on WAN (Presumably /24).  You can't do that. And your pass any any rule on WAN is bad news.  Delete it.  With that in place you can just use the internet and don't need a VPN. Why is this in OpenVPN if you're using IPsec?

I have the same issue here. It used to run flawlessly, but suddenly stoped. I already rebuilt the server, restored the configuration and got stucked on the server. Can ping, open the url in a browser but cannot reach any of the machines on the LAN side.

May have been an issue with PIA.  Mine broke for about four hours a couple of days ago, never changed a thing.  Did a restore settings from a previous back up and rebooted, came right back up.

OP, did you find a solution to this?