I found the solution. I set the following on the OpenVPN configuration and now everything is working. link-mtu 1400; I don't fully understand why that was needed since my network is using the default 1500 MTU, but it solved the problem. Shoutout to the support I got on Reddit to resolve the issue.

ssh to pfsense. choose 8) Shell [22.05-RELEASE][root@yyy]/root: openssl list -digest-algorithms RSA-MD4 => MD4 RSA-MD5 => MD5 RSA-MDC2 => MDC2 RSA-RIPEMD160 => RIPEMD160 RSA-SHA1 => SHA1 RSA-SHA1-2 => RSA-SHA1 RSA-SHA224 => SHA224 RSA-SHA256 => SHA256 RSA-SHA3-224 => SHA3-224 RSA-SHA3-256 => SHA3-256 RSA-SHA3-384 => SHA3-384 RSA-SHA3-512 => SHA3-512 RSA-SHA384 => SHA384 RSA-SHA512 => SHA512 RSA-SHA512/224 => SHA512-224 RSA-SHA512/256 => SHA512-256 RSA-SM3 => SM3 BLAKE2b512 BLAKE2s256 id-rsassa-pkcs1-v1_5-with-sha3-224 => SHA3-224 id-rsassa-pkcs1-v1_5-with-sha3-256 => SHA3-256 id-rsassa-pkcs1-v1_5-with-sha3-384 => SHA3-384 id-rsassa-pkcs1-v1_5-with-sha3-512 => SHA3-512 MD4 md4WithRSAEncryption => MD4 MD5 MD5-SHA1 md5WithRSAEncryption => MD5 MDC2 mdc2WithRSA => MDC2 ripemd => RIPEMD160 RIPEMD160 ripemd160WithRSA => RIPEMD160 rmd160 => RIPEMD160 SHA1 sha1WithRSAEncryption => SHA1 SHA224 sha224WithRSAEncryption => SHA224 SHA256 sha256WithRSAEncryption => SHA256 SHA3-224 SHA3-256 SHA3-384 SHA3-512 SHA384 sha384WithRSAEncryption => SHA384 SHA512 SHA512-224 sha512-224WithRSAEncryption => SHA512-224 SHA512-256 sha512-256WithRSAEncryption => SHA512-256 sha512WithRSAEncryption => SHA512 SHAKE128 SHAKE256 SM3 sm3WithRSAEncryption => SM3 ssl3-md5 => MD5 ssl3-sha1 => SHA1 whirlpool now to openssl project...

@jarhead , thanks, I just double checked again: On site B I have the site A openvpn client net allowed in the peer. In the mean time I did set up an OpenVPN server on site B, put the openvpn client net of it in the WireGuard allowed list of the peer in site A. From Site B's OpenVPN clients, I can connect through the tunnel... site A is not working.

@gertjan Thank you guys for your support

@johnpoz I found my very stupid mistake! I did not ebabled the rule that i created! :) So now everything works like charm! Thank you very much, John! [image: 1666109531000-image3.jpg]

@gertjan I asked my ISP to get a real public IP and got one ... but sadly for a monthly fee. This solved the problems I had with OpenVPN. Thanks again for all your support ... I have learned alot about CG-NAT ... that was a white spot on my map.

@help-group Have a look at pfsense openvpn server with freeradius.

@rm85 Found it, we had to add a Outbound Firewall rule (Mappings) from LAN interface (Source IP VPN Client subnet) to the LAN. Now it works![image: 1666074145084-screenshot01l.jpg]

@renj said in Certificate Autority: So, In the available packages window I have notting. You don't see these : [image: 1665992337284-537b2daf-9e3b-4a71-8fb2-235e4a1ef86e-image.png] ? @renj said in Certificate Autority: I have, under Instaled Packages window; two isntalled Packages. At the bodom of this window, I have a message in red: Package is configured but not (fully) installed or deprecated. We all have this : [image: 1665992388532-a3d0d631-348e-418b-9c70-f850cfb5b53b-image.png] If an installed package is marked in red => now you know what that means. If an installed package is marked in yellow => now you know what that means.

@chuck1968 No, don't push a DNS server. You cannot push a DNS server for the local domain only. If the branch uses Server01 for DNS resolution it uses it for all request. You have to add a domain override for the local domain instead to only forward these certain requests to the main office. In the branch OpenVPN settings enter 192.168.99.0/24 to the "Remote Networks". On the main, presuming you are using a /30 tunnel network, enter 192.168.95.0/24 into the "Remote Networks" box.

There are no granular per-service privileges right now, so any user who must control a service requires access to status_services.php (WebCfg - Status: Services). All of the service control links, even in the shortcut bar, use that page to manage service control.

@petri Turns out a real managed switch needed to be connected. Not the Unifi Lite I had. Now my IP isn't leaking out anymore.

@ppcm said in Local authentication with groups of users: if the user changes groups, I will need to send a new config, not easy to manage I'm running multiple OpenVPN servers with different CAs for different user groups for 10 years. Never need to move a user into another group till today. Is there a way to use groups of pfSense? No, not the local user groups in OpenVPN. If you need to replace the functionality of AD you can install the FreeRADIUS package and use it in the OpenVPN servers for authentication. Authenticating OpenVPN Users with FreeRADIUS