That is a tab created when the firewall as any OpenVPN clients or servers defined. It's an interface group tab for firewall rules which apply to all OpenVPN interfaces. If you have assigned your OpenVPN instance(s) and use rules on the per-interface tabs then you won't need to do anything with the OpenVPN tab. Some people don't assign the OpenVPN clients or servers as interfaces and just manage rules on the OpenVPN tab.

I'd look at using Freeradius as external auth (Radius) server, if needing something like that /Bingo

Glad you have it working now. -Rico

No, I have PFSense server on one side. My server connects as OpenVPN user cert/user/pass. I gave it static IP via push ifconfig, then on firewall i have made rules that cover this communication. So, my server connects as a OpenVPN user.

@bingo600 said in Q: OpenVPN RoadWarrior Certificate Expired , what to do: 1: Delete the expired certificate 2: Under user manager , edit user -> "User Cartificates" -> "+Add" , create a new certificate with the same CA name ? That would be easier if working. That should be fine Though strictly speaking you probably want to setup a separate VPN for vendors than for your typical remote access users, to be sure they can be isolated more strictly. So a different CA, server cert, OpenVPN server, etc. I actually made 3 servers : ADM + INT + EXT , and made "interfaces" for all 3. All 3 have separate CA-Roots + Server /24. That way i can do firewalling based on the Client types. Sounds good

Hmm...you realize this is the pfSense forum? -Rico

@splinny Is that 192.168.1.0 actually from your ISP? If so, then you are behind NAT and a VPN will never work.

OpenVPN Connect for Windows is beta and aimed at OpenVPN Access Server. Either download from pfSense GUI or use the download from @Rico

No idea what you are showing there...just a port forward like it is mentioned in your VDSL Router user manual. ;-) -Rico

The wizard sets the firewall rules automatically which are needed to access the server and also for anything else over the VPN. What you have to check is the "Redirect gateway" check in the server settings. But I think, this is set by the wizard as well. @hyposera said in OpenVPN Remote acces server on VPS without LAN: I would like to set up the pfsense openvpn remote access server on VPS and connect my local pfsense box as a client. I assume, you aim to direct any upstream traffic from the network behind your local box over the VPN. So you have to add an outbound NAT rule for that traffic. If your outbound NAT works in automatic mode switch to hybrid mode and save that setting. Add a rule like this: interface: OpenVPN source: any (or restict it to your LANs) destination: any Translation: interface address I assume, you're running only that one OpenVPN instance (client or server) here. If you run multiple, assign an interface to the client instance and use that one in the NAT rule. On the remote pfSense, you also to add an outbound NAT rule like the above one, but to the WAN interface.

https://docs.netgate.com/pfsense/en/latest/book/openvpn/index.html -Rico

I got my Roarwarrior OpenVPN servers up & running. And it was as easy/elegant as i hoped, after the answer above. Just create the server , and "dig into" the available "unassigned" interfaces. Enable and name it , and "voila" you have gotten an interface to make your rules on. No need to have any rules at all under the "OpenVPN" interface. Thanx for this feature Netgate /Bingo Edit: This page was inspirational https://turbofuture.com/computers/How-to-Setup-a-Remote-Access-VPN-Using-pfSense-and-OpenVPN

You can have as many OpenVPN Clients and Servers as you want, just set it up. -Rico

If you change the status in the GUI and save, it would always be immediately reflected in config.xml. Unless your disk is doing something really funky with caching writes, it should be there as soon as the config is written.

Sorry to bump, but I have made some progress. Although it's still only the wireless AP that seems to be affected which I can't quite my head around, it may well be a routing issue. I found if I turn off my OpenVPN client on the pfsense box, then the OpenVPN server doesn't break net access for the wireless AP. Reading up on people having similar issues trying to run a client/server at same time, it seems the key is to check "don't pull routes". The issue then is how do I set up the routing manually to push out everything on the LAN via the VPN client. I'm guessing a combo of firewall and NAT?

OMG, the stupidity, it burns! I had a rule only allowing DNS requests only to the firewall itself. I readded the internal VPN DNS servers with their respective VPN gateway to System>General and made a rule allowing the VPN clients to use DNS only with the internal VPN DNS servers, above the other rule. Fixed. Sorry for cluttering up the forum with stupidity :(

I got my issue resolved and feel quite relieved - but also kind of embarassed for taking so long to find the problem. In the hope that it will save someone else from digging around for days, here is what I found. Problem was: private IPs will not be routed. All my 192.168.xx.yy/24 networks are private networks and I force-routed the a little way but could not get them through all the way. Solution was: set an outgoing NAT rule: [image: 1582831485259-c274d0d7-6f2c-4f73-8f12-75283e7ab6a9-grafik.png] Again: router A is the openVPN server, it has subnet 192.168.225.0/24. The above setting is for router B, which has subnet 192.168.245.0/24 for LAN. This permits a host in B's subnet to reach a host in A's subnet. A corresponding NAT rule will be required on A for the opposite direction. I my case server A will assign an interface address to B, so the NAT address needs to be B's openVPN interface address. What else did I learn? For one thing, Apple's version of ping supports some really helpful options: -A will make a sound for each outgoing packet -a will make a sound for each incoming response -f will flood the target with ICMP packets. On an otherwise quiet system, this permitted me to see where my packets were going just by looking at pfSense's traffic graphs on the dashboard. Another thing is, it took me ages to get to the solution but I feel that all the failures I have been through taught me more than I ever wanted to know Keep working on your problems, eventually you will master them!