Unfortunately my partner rebooted the system whilst I was away so I'll have to wait another couple of weeks to pull logs.

Under LAN of Site A. I tried setting rule: SRC * DST * DSTPort 25 GW OPTVPN That looks reasonable. and also SRC Port 25 DST * DSTPort * GW OPTVPN Setting a source port is almost never right, and is certainly not right in this case. I have no problem routing inbound internet traffic -> 99.99.99.99:STMP to 10.10.0.15 So if that is the case, you want to check: The rules on the OpenVPN tab/interface at Site B to be sure the traffic is allowed from site A (10.10.0.15) to any You have outbound NAT in place on WAN at site B for the 10.10.0.15 source address. That is also where you would specify 99.99.99.99 as the source address if there is more than one choice.

Done! thanks

Not sure why your trying to hide your 192.168 address?? But your problem is 192.168.x.1/24 is not a network, that is a host address.  A /24 network would be 192.168.x.0/24

FOUND IT!! When you create a new vpn server or editting the actual, you can see almost at the end of the configuration: Advanced Configuration In Custom options you can add whatever you want, for example:  reneg-sec 36000 THank you!

What does it show when you go into the OpenVPN status page? I would start by checking your OpenVPN log to see if there is a problem. You may want to post some screen shots of the settings you used to configure your openvpn client and the  ovpn file itself.

HI Both,  Excellent thanks that worked. Much appreciated.

Is this happening on your phone when you are connected to your VPN from the outside? If so you could have the option to force traffic through the tunnel and are missing the allow rule on your OpenVPN interface. Can you post a screenshot of your interfaces tab and of your OpenVPN config?

You need a route on the client settings to the server side subnet and the iroute on the connecting client to the server side subnet in order for the Clint subnet to respond to packets from the server side subnet. Example If your server side subnet is 10.2.0.0/24 you need to add iroute 10.2.0.0/24 to the client specific overrides section of the OpenVPN configuration on the client side

If you open a command prompt and run a route print do you see a route to the server subnet through the tap interface IP?

Install the OpenVPN client exort utility package. After you get a tab for the export utility in VPN > OpenVPN. Use this tool to export the certs and config and check "Password Protect Certificate".

Yeah outbound NAT on LAN

I finally found the problem. My ANTI VIRUS was blocking connection, so i had to edit the AV rules.Thanks to you all!!!!

So you have your sites connected to a mpls cloud.  And these sites also have internet where you run a vpn tunnel between the locations. Now you want to auto use the vpn connection over the internet if the mpls is down? As helper stated this is normally done via running a routing protocol.. If the mpls goes away that route drops off and you use the less priority route.