Hello Micha, Your issue seems very similar to mine.  See the thread below. http://forum.pfsense.org/index.php/topic,15300.0.html So far, I have not been able to resolve the issue.  However, I have made a similar discovery.  I had a terminal ping going in a session for 36 hours.  Once the tunnel is up it seems to be very stable.  I too have to attempt multiple times.  However, I did notice that while that one connection was active, I was much more likely to be able to establish a connection from another client on the first try. I know that this information will not help you as such but it may be wise to watch each other's threads to see where things go. I have actually decided to purchase a support contract and will be opening a case if I cannot figure this out.  At this point it seems unlikely that I will resolve myself.  I seem to have hit a brick wall due to my level of expertise it seems. Good luck Wayne

Try this method for making keys: http://doc.pfsense.org/index.php/Easyrsa_for_pfSense

after speaking with some guys on irc, i did some tests and the tunnel it's active and the rutes are right, but i still can't access the lan behind the ovpn server :( any hints?

bravo83 may i ask which guide did you specifically follow to enable bridging on pfSense? Thanks.

No problem.  Whenever you have time.  If you weren't a few thousand miles away I would offer my assistance. :)

thanks in any case i found the solution i make an alias where i put all subnets of vpn clients then i exclude this alias to use the load balancer and works both load balance and i can ping all vpn clients.

You missunderstand how the rules work. http://forum.pfsense.org/index.php/topic,7001.0.html Rules: Rules are processed from top to down. If a rule catches the rest of the rules is no longer considered. Per default a "block all" rule is always in place (invisible below your own rules). Traffic is filtered on the Interface on which traffic comes in. So traffic comming in on the LAN-Interface will only be processed by the rules you define on the LAN tab. A couple of reasons, my outside interface is using port 1194 the 12.166.84.3 ip is using 34246. Each connection has a destination-port and a source-port. Only the destination is 1194. The source can be something random between 1024+ ~ 65535.

Please give a little more information on your configuration.  Is this firewall to firewall, or a host to your firewall?  Is this PKI or shared key?  What are the networks involved?  How is OpenVPN configured?  It sounds like you're not trying to do anything fancy, so if you can give more details, I might be able to help.

Huh… No one is willing/able to verify?  I'd hate to raise a bug just to find out that it's an existing bug or only in my config.

We can close this issue. Jimp you are right. The problem why the IP-Address 192.168.11.2 doesn't response my requests was the gateway. I tried antother IP and I could see all things are working. The Push command brings up the solution - THANKS !!!

so…yesterday i uppgraded my firewall to 1.2.3 and now the tun interfaces (OpenVPN interfaces) show up in the GUI. I've adde them as optional interfaces. The thing is when i create rules for these interfaces nothing happens so i guess this is not supported? But...when i look in the firewal logs, i can se the occational packet beeing blocked on the tun0 or tun1 interface? Is there anyone who can bring some light as to why the tun interfaces show up in 1.2.3 and if they can be filtered? I just ran the command "pfctl -sr" on my pfsense box and it seems that the rules i've created for the tun interfaces are there. I'm no master of pf so i will have to spend some time decoding this printout.

I've kind of found a way to do this: 1)  Create a client config called DEFAULT.  This is parsed by OpenVPN when a CN is not matched elsewhere. 2)  Click the "Blocked" option in the config. What I'm not sure of is the downside of doing this… The blocked option specifically says that the option shouldn't be used "due to key or password compromise", which seems to imply that it has weaknesses the a CRL does not. Any thoughts?

Hi Dave, For the multiple client connections that you were trying to create, did each client have a different key and cert, or were they using the same client certificate pair to connect to the server?

Great!  I'll be sure to add that fact next time I update the howto.

The WebGUI works fine for configuring OpenVPN.  If you want to create the keys on the pfSense host then there are stickies that you've already been directed to: http://forum.pfsense.org/index.php/topic,4807.0.html http://forum.pfsense.org/index.php/topic,2057.0.html Otherwise, as GruensFroeschli said, if you don't say what you're trying to do it's impossible to help you - crystal balls are still on back order.

I'm not sure what you're trying to do (your choice of white font for the network diagram doesn't help ;) ).  Why don't you just configure the LAN hosts to use the DMZ IP address to access the server?  I can't see why you're using OpenVPN when the network between the hosts appears to be trusted.

Look at the log: status –> system log --> openvpn alternative you can enable the managment interface of the openVPN isntance: http://forum.pfsense.org/index.php/topic,5282.msg31843.html#msg31843

you coudl go ahead and install in. pfsense runs on freeBSD which is a *nix environment. I havn't look at the requirements however this shoudn't be too hard to implement yourself :) It will probably break the pfsense GUI openvpn configs though