@yobyot said in OpenVPN with laptop clients failing after pfSense Upgrade to 2.5.0: @eapperley This change worked for me, too. Is there a point release coming which will include this fix? Yes: https://redmine.pfsense.org/issues/4521#note-27

cgv

@viragomann Awesome, thanks so much for that, I really appreciate your help

@bcruze Thank you, made no difference in speed though. CPU is fine on the host as well.

@proger said in Users OVPN auth failure with 2 backends after upgrade to 2.5.0: @viktor_g This bug not listed.. :( here is: Related issues Bug #4521: Issue with OpenVPN certificate depth validation and long certificate subjects

I found the problem. There was a floating rule that disabled access to the internal network. We never used floating rules, but we did have virtual networks where the rules were for and these networks were removed with the move to the new location. After disabling these rules my test works (a simple webserver with a default page and a NAT-rule to access it from outside)

@wtw Any suggestions on how to view the calls? It appears the place to check are the calls in ovpn_auth_verify during the TLS verify (line 27).

hi every one, i have the same probleme did you find any solution please?

@dyener thank you for the pointer! Adding lport 0 to the client config fixed my issues.

@vettalex If it's an SSL/TLS setup check "Dynamic IP" in the server settings.

@ghummantech Hi, I was able to resole the issue selecting different EC2 instance size, t3 or larger (without bust limit) seems to be resolving the problem. Give it a try and let me know.

I ran a few ookla speedtests, again, graph looks fine but numbers are nonsense. I have a 50mbit/s speed limiter on both pfsense boxes. [image: 1615081446614-pfsense_speedtest_dip.png]

A little more information. I can change the monitoring IP address in the routing>gateways>monitoring to the WAN IP address and the gateway reports good (because it is ping status from the WAN interface). However, the firewall LAN still report Blue Gateway status and no traffic is routing via the LAN rule. ...

@divsys Haha! And you are right again. I am not touching it. It works now and I need a break from it. ^_^ Thank you for your advice. It is a valid concern. I left the part not saying why the flag was there at the first place since the entire thing is all my fault. I added it upon suggestions from others and then I forgot. I am pretty sure that this is the only thing I messed up under the hood. Really appreciate your consideration!