So in fact you only need two VLANs? Or is that just an example? If it really is only two you can just use two OpenVPN TAP tunnels on different ports. Bridge them to the VLAN interfaces at each end. That actually helps throughput in most cases by using two OpenVPN processes. Steve

So I don't know how or why, but recreating the client seems to have fixed this. Not sure why I didn't try this earlier. For some context though, the raw interface socket changed. The original interface was being labeled as OPT9 but when I recreated the client it now is branded as OPT1. At a guess I was creating the client before I had finished something else VLAN related and the OPT interface was mislabelled or misassigned somehow and that is why traffic flow and routing was broken. Thanks for the tip viragomman!

The only workaround would be to check "Don't pull routes" in the client settings and direct your traffic by policy routing to the vpn server. So the default route points to the WAN gateway, which is used by pfSense for upstream traffic.

thanks viragomann! i went with your 2nd suggestion of adding routes to each device I needed to access. routing is performed by proxmox host and i don't trust myself yet with attempting suggestion #1 since this is a production environment although it seems like the best way to go about it. thanks again.

a) I have not created any iroutes anywhere (mentioned inthe guide I was following but didn't understand them) If you are running an SSL/TLS server with a tunnel network larger than a /30 and have routed subnets and no iroutes it is not going to work. Add the remote networks for each CN to a client specific override.

Thank you  8)

I got this error on a UDP too where I have a mis match in cipher, server was none and client was AES-128-CBC and a mismatch in the comp-lzo, server said no and client was comp-lzo.

Are you using the built-in bsnmpd or the net-snmp package? net-snmp appears to have counter64 data for ovpn interfaces. $ snmpwalk bill ifName            IF-MIB::ifName.1 = STRING: vmx0 IF-MIB::ifName.2 = STRING: vmx1 IF-MIB::ifName.3 = STRING: vmx2 IF-MIB::ifName.4 = STRING: lo0 IF-MIB::ifName.5 = STRING: enc0 IF-MIB::ifName.6 = STRING: pflog0 IF-MIB::ifName.7 = STRING: pfsync0 IF-MIB::ifName.8 = STRING: gif0 IF-MIB::ifName.9 = STRING: ovpns2 IF-MIB::ifName.10 = STRING: ovpns4 IF-MIB::ifName.11 = STRING: ovpns1 $ snmpwalk bill ifHCInOctets IF-MIB::ifHCInOctets.1 = Counter64: 206324779 IF-MIB::ifHCInOctets.2 = Counter64: 1245848 IF-MIB::ifHCInOctets.3 = Counter64: 0 IF-MIB::ifHCInOctets.4 = Counter64: 3667209 IF-MIB::ifHCInOctets.5 = Counter64: 0 IF-MIB::ifHCInOctets.6 = Counter64: 0 IF-MIB::ifHCInOctets.7 = Counter64: 0 IF-MIB::ifHCInOctets.8 = Counter64: 8469397 IF-MIB::ifHCInOctets.9 = Counter64: 8510755 IF-MIB::ifHCInOctets.10 = Counter64: 0 IF-MIB::ifHCInOctets.11 = Counter64: 0 $ snmpwalk bill ifInOctets IF-MIB::ifInOctets.1 = Counter32: 206350521 IF-MIB::ifInOctets.2 = Counter32: 1246200 IF-MIB::ifInOctets.3 = Counter32: 0 IF-MIB::ifInOctets.4 = Counter32: 3667209 IF-MIB::ifInOctets.5 = Counter32: 0 IF-MIB::ifInOctets.6 = Counter32: 0 IF-MIB::ifInOctets.7 = Counter32: 0 IF-MIB::ifInOctets.8 = Counter32: 8470213 IF-MIB::ifInOctets.9 = Counter32: 8511571 IF-MIB::ifInOctets.10 = Counter32: 0 IF-MIB::ifInOctets.11 = Counter32: 0 Index 9 is the one to look at. If you don't need anything from the pf MIB then you are probably better off using the NET-SNMP package.

Installed 2.3.5.  Restored backup.  Ran the same battery of speed tests.  Instant improvement! Speed's are still nothing like my non-vpn,  but that's as expected.  I got 50-80 Mbps on all the test sites that should be VPN.  Ironically, speedtest.net which the other day was showing my comcast IP but testing super slow, is now showing my vpn IP, but testing at 276 Mbps.  Oh well, at least I'm getting workable speeds through the vpn. Definitely are some different settings for OpenVPN in 2.4.2 vs 2.3.5.  Even though I set them per the guides, apparently something wasn't agreeing with my system. I think I'll stick with 2.3.5 until I see a real reason to upgrade.

Yes. It is possible. Remote Access Server: https://doc.pfsense.org/index.php/OpenVPN_Remote_Access_Server Policy-routed OpenVPN Client: https://www.infotechwerx.com/blog/Creating-pfSense-Connection-VPNBook VPNbook used there but any provider would work.

@bcruze: i've posted it a few times on here.    i did 2 trials with Nordvpn and my speeds with openvpn on pfsense and their proprietary software.  with 3 different devices at 3 different locations were terrible. i canceled both trials within the cancellation period.    i've love to hears others experiences I have managed NordVPN to work reasonably.  On ubuntu the trick was to use command line OpenVPN

Can you expand on why CSOs are used and why they are needed with SSL/TLS servers? Thanks.

if your policy routing you would have to have a rule above where you force traffic out a gateway or group that could not get to the vpn. Or sure it could be firewall on the vpn client side. Here pinging my vpn client box from the vpn server side. $ ping 10.0.8.2 Pinging 10.0.8.2 with 32 bytes of data: Reply from 10.0.8.2: bytes=32 time=112ms TTL=127 Reply from 10.0.8.2: bytes=32 time=104ms TTL=127 Reply from 10.0.8.2: bytes=32 time=102ms TTL=127 Reply from 10.0.8.2: bytes=32 time=114ms TTL=127 Ping statistics for 10.0.8.2:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 102ms, Maximum = 114ms, Average = 108ms

AES-256-CBC (256 bit key, 128 bit block) is utilised on both AirVPN clients.  See attached screenshot. [image: Capture.JPG] [image: Capture.JPG_thumb]

Same thing here but with a different option: 'ns-cert-type' was deprecated in OpenVPN 2.4 and removed in OpenVPN 2.5