start by providing info…. "ive tried everything" is fairly useless to start debugging this issue so: diagram of your intended network (include subnets/ip's) screenshots of configuration related to vpn logs

Yeah often when someone suggest changing from default port someone else usually retorts with a speech about security through obscurity being worthless… Security through obscurity vs "true" security is an imperfect analogy to cover vs concealment. Concealment can't physically protect you but it serves a purpose. The most commonly cited purpose is to clean up your log files, and that is certainly a valid purpose.

Agreed that would be the best option to be sure!

@Pippin: See here: https://forum.pfsense.org/index.php?topic=132534.msg728642#msg728642 ah, thanks and sorry for doubleposting! Greets Stephan

@Derelict: It turns out that Block private networks and loopback addresses on the WAN address was blocking access to the WAN from the VPN.  Is it a problem to disable this option? No it wasn't. That blocks connections into WAN from outside WAN from RFC1918 source addresses. You can run without those checked. Your correct it only loaded the one web page and then it wouldn't work anymore. I have no idea what else to look for.

Working for 8 hours without issues on UDP port 1197 with AES-256-CBC and SHA256. Seems it was an issue on the PIA side. Update: No issues since

As it happens, I just had to reboot because the cable ISP was doing planned maintenance. Yes, the routes are completely unaffected on the client.  Though I've never experienced the problem you're seeing. I noticed that the OpenVPN Client Export package allows separation of push statements by either a linefeed or a semicolon.  Whereas the OpenVPN Server settings only seem to permit the semicolon.  Should probably be consistent.

That error is from the client, not pfSense. Something else is already using the address/port it wants. Also your Windows OpenVPN client is very out of date and vulnerable. Uninstall that and install the latest version. If you installed it from the client export package, update your export package and then export a new installer. Use the 2.4 installer if you can.

@shetu: Another question - Does lan pc ip change to vpn subnet or not? My lan ip is 192.168.1.17. it is not changed. You mean the PCs IP?? That should be static and is not changed inside the LAN network. The outbound NAT rule you've added translates the address when packet go out the vpn interface. On the vpn server it is translated once more to the servers public IP. In the LAN rule you have permitted only TCP protocol. Change this to TCP/UDP and configure the pc to use a public DNS server to avoid DNS leaks. DNS also require UDP.

What interface is that openvpn running on? In your client config what are you pointing them too in your export of the config? If you want your wifi clients to use the vpn, then it should be listening on your wifi interface of pfsense, and NOT your wan.. [image: vpn.png] [image: vpn.png_thumb] [image: address.png] [image: address.png_thumb]