wunderbar! Yeah, I have a few other rules but they were created from NAT, and DMZ rules were created by me guided by the pfsense community. The only rules in Lan tab is the anti-lockout rule and the default Lan rule. Now all I have to do is update pfsense to 2.1.2 tonight and hopefully no surprises. Thank you so much.

@goodbyte: Dec 22 23:48:23    openvpn[7866]: ERROR: FreeBSD route add command failed: external program exited with error status: 1 I had the exact same issue a bit earlier and it was driving me nuts as it seem only to happen when I was adding a 2nd VPN connection. The first exactly configured the same was working fine. I rebootet pfSense and all worked like a charm

You either need to stop using same certificate for both connections, or check the proper checkbox in OpenVPN configuration to allow this.

If you are using the exact same certificate on all of those, make sure you checked "Duplicate Connections" on the server config.

@phil.davis: You still do not know if 192.168.3.33 can correctly route back to 10.0.8.0/24. From 192.168.3.33 do a "traceroute 10.0.8.1" and see how that goes. The path it takes and where it stops will help you find the device/s that do not know how to route to 10.0.8.0/24. OK, will be next week at the location and will be able to perform the test. Thanks a lot for help, stay in touch for replies next week ;-)

@jimp: Yeah I'm doing that right now actually. Going to move it to 2.3.3. I'll bump the export pkg version when I'm done. Export should be OK now – https://forum.pfsense.org/index.php?topic=74948.0

@BradWaite: For others with this issue, be sure to add a pass rule on the OpenVPN interface. The firewall rules for traffic inside the VPN has no relation to the outside of the VPN, that would have been a coincidence or otherwise unrelated.

@phil.davis: The user certificates for all the users that connect to 1 server must all be under the same CA. Thank you Phil, i just created a RADUIS configuration with my domain controllers and it works really great. thank you so much to other who might have the same issue or want to have a RADUIS to AD. please follow the below link. https://doc.pfsense.org/index.php/OpenVPN_with_RADIUS_via_Active_Directory

That's kind of a major thing to not have a dedicated option for.  I'm thinking the GUI should have an option specifically to enable or disable that.  Is there a way I should officially propose that? Feature requests and bug reports are entered at https://redmine.pfsense.org

Um, because some people don't like mass surveillance by governments and large corporations? Your data and DNS requests… are encrypted between you and the VPN provider end point. But the VPN provider knows who you are, and your DNS requests go to their DNS server, and your ordinary data to and from the various public internet sites you use goes between the VPN provider and those sites as ordinary data. One has to assume that these agencies are gathering the data they want from VPN providers and matching it to user VPN accounts. So actually I don't see how any of us can really "hide". But it might be fun to try ;)

I figured it out! So it looks like I do need to have that manual outbound NAT after all, it's just a bummer that I can't use aliases for that either. So I looked in my openvpn logs and saw there were a bunch of encryption/decryption errors. So I changed my cipher from AES-256 to BF and now I am up and running! Now to test for any leaking. Thanks for all the help guys, you were all very helpful and friendly.

edit: solution https://forum.pfsense.org/index.php?topic=74743.0

I am doing basically the reverse of what you are doing. Check this out for an idea on what needs to happen: https://forum.pfsense.org/index.php/topic,29944.0.html You can create rules that are based on Aliases, hosts, network range, etc. That can re-route your traffic however you define. You just have to setup the interface and gateway correctly.

Try changing the monitor ip address in system->routing

using the current 2.1.1, originally setup on 2.1.0. both connect ok. Try following the tutorial I linked above. I am having an issue with speeds and also an odd time out fail to reconnect issue.

Hi Phil, all working now I was expecting it to load balance across both openvpn no matter what I was doing. but it works per session which if fine with me. I do get what I would call true load balancing when I use a download manger. I have now moved VPN providers to PrivateInternetaccess and have 3 openvpns working in the group.  Thanks for your help

Thank you all!!!  I really appreciate the help!

Should be no problem with pfSense behind your ISP router. As long as the PIA VPN link is up you are good. Feels like deja vu - sure I have typed this stuff before. Make sure PIA VPN client has an interface assigned. Make rules on LAN that policy-route traffic to PIA VPN GW. Firewall->NAT, Outbound, switch to Manual. On 2.1 you will get some rules generated for NATing out the PIA VPN. They should help, press save. On 2.1.1 and later, those rules are no longer generated (they were an inconsistent behavior). Add rules yourself to NAT out the PIA VPN GW.