Well after googling the past hour Im no closer to finding out the correct syntax to making sure OpenSSL can talk correctly to one of the few cipher OpenVPN supports.  And as far as more detailed logs, I cant find anything else in granular detail.

I got it working with these options on the client side: auth-nocache inactive 900 ping 10 ping-exit 60 Seems that auth-nocache is the key. After it times out it tries to connect but because the creds aren't cached, the dialog box appears asking for them again. Since no one is there to enter the password and click OK, it times out and loses the connection. It's not the best way to handle it but it seems the only way currently.

Is this still an issue? I'm having dns resolver issues through my openvpn. I removed the file and restart dnsmasq with no help. I also just upgraded to 2.3.3 from 2.3.2_1 but no difference.

I don't know how this HW performs. Ask at dd-wrt forums for observed OpenVPN throughput. Also, you may need to adjust settings on tunnel if you observe low performance, search for "valdikss openvpn fragment"

well, country, province, city org and email are identical (most of these CAs where created well before we started using pfsense, all of them where created using easy rsa) so yes, if pfsense tries to look at the subject to find out if they are related this could indeed be the reason. while using the same email address might not have been ideal, i don't think it's possible to change it afterwards, so i'm stuck with it… regards, albert dengg

One tunnel per LAN interface to a switch is the easiest to do. I will go for it. Never mind about the other configuration.

Hello, Well I finally found a solution for the web configuration page load problem. I found on google a suggestion which finally worked for me. What I did was decrease the MTU under General Configuration on the WAN interface which is by default blank (1500) down to 1380. This was the trick for me.

No, that is not viable if you wish to use overrides and perform strict user/cn matching.

You need a better grasp regarding what firewall rules should go where: https://doc.pfsense.org/index.php/Firewall_Rule_Basics https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

Thank You Derelict for responding. Yes, I am  now running two instances of Openvpn server –- one for the road warrior and other for connecting all the sites. Although it turned out to be quite simple, in case any one wants a step by step guide please let me know. Thank you, Ashima

@firegood: @jimp: What auth settings do you have on the tunnel? Local? Remote (RADIUS/LDAP)? Does authentication still work for that user under Diag > Authentication? There were a couple of changes in that area but nothing that I've seen fail now that was working before. I am seeing the same thing as well. I have a site i VPN into once or twice a week. Nothing changed on the client side, upgraded to 2.3.3 from 2.3.2 and now i cant get in. I have the VPN tunnel setup to use a radius authentication server that goes back to MS Server 2012 via Network Policy Server hooked to AD. Test authentication works just fine under diags I am getting these error logs: TLS Auth Error: Auth Username/Password verification failed for peer WARNING: Failed running command (–auth-user-pass-verify): external program exited with error status: 1 user 'XXXX' could not authenticate. i would love to get with you and see how you have the radius setup tied back into AD!

Crap! I just lost the second post because the software logged me out before I hit post, Now I'm pissed off so I'll continue this later… JayArr

@myth20: Took me 3 years to got my CCNP R&S I have understanding of subnetting works. Cool - sorry - my post was aimed at anyone who comes here looking for an (easy) answer - there isnt one - and this is the only way i could get it to work. @myth20: So you would run TCPLogview on a Windows machine and this will list all Netflix IP's? No, it will only list IP's that, more than likely, are currently resolved by DNS for particular Netflix domains, it wont give you everything, BUT i did notice a trend of 52 and 54 addresses that were being accessed and went from there as you can use ultratools.com to find the subnets for the IP's listed and stick them in the Alias. They DO change from run to run, but the majority seemed to be within the 52 and 54 ranges above and since adding these to the Alias (several weeks ago), i have not had to add any more. @myth20: 52.0.0.0/10 & 54.0.0.0/10 will cover 52.0.0.0 - 52.63.255.255.255 & 54.0.0.0 - 54.63.255.255 nnnnnnnn.sshhhhhh.hhhhhhhh.hhhhhhhh Did you try adding those prefix instead of smaller subnets? It will but there are subnets owned by companies OTHER than Amazon / Netflix within that range that i didnt want to route via the VPN which i why i used https://www.ultratools.com/tools/ipWhoisLookup to find which subnets were owned specifically by Amazon / Netflix in that /10 and subnetted it from there. There ARE other IP's but these seem to be the main ones that Netflix is using IN MY CASE. I cant stress that enough - i have no idea if connections from your location will resolve to the same subnets. This is why you need to use something like TCPLogview to A) Confirm this and B) get the rest of the IP's that you need. As i said above, there is no easy answer here - no correct set of IP's and my range could change tomorrow - but i'll be able to find out what they resolve to by using the method above. I've seen lists of ranges with Netflix IP's off the internet that were useless and missing ranges so your only real method is to find them yourself. It might take you an hour of loading and closing the Netflix app, clearing TCPLogview and rechecking and adjusting the alias list but it works.

@kpa: A csr file would never work as a certificate (argument for the cert option) for OpenVPN, it's just a certificate request that can not be used for anything else but sending it to a certificate authority for signing and getting the real certificate. Make sure you're not mixing up files. The configuration I was referencing was an old not working one… of course the csr did not work when configured as cert.

hello, I have been for a long time trying to get the remote plex connection working over the openvpn unsuccessfully. It can work routed over the wan, but i can't get over openvpn. If you managed to solve this, i would appreciate some advice on how you did it. cheers