Well, this is the weirdest thing. I go and try it today and it works like nothing was ever wrong. I did reboot PFsense a thousand times this weekend trying to get Dansguardian to work and also rebooted my work machine. Anyhow, I'm still going to post what you asked because it is binding on a weird I{. This may or may not help someone else so what the heck: [image: vpn1.jpg] [image: vpn1.jpg_thumb] [image: vpn2.jpg] [image: vpn2.jpg_thumb] [image: vpn3.jpg] [image: vpn3.jpg_thumb]

@Stevej: @cmb The upstream of the customer side (supplied by ourselves) varies, it can be ADSL or leased line. What i've noticed is that if the connection on the customer size drops (this could be due to a link failure or such) then when the link re-establihes the VPN doesnt come back up, unless i disable the VPN profile and re-enable it. Is the key the infinetly resolve tick box? No, the completely default settings will reconnect automatically on their own. Would have to see some logs from the OpenVPN client while it's failing to reconnect to have an idea of what might be happening.

@ReneG: Hi any news to the 2.0.2 release? We are really really like to see Working Openvpn with UDP and CARP without Disable Openvpn on the salve. Any chance to get a update url? regards btw pfsense is very nice and stable! There's a thread on that here - http://forum.pfsense.org/index.php/topic,52810.0.html

@pkwong: Are you having issues passing traffic out the openvpn connection?  Is that what you are saying? Do you config pass? Thank's everyone interested,i have done.

@joako: I had tried something similar but it seemed the routes pushed from the vpn were conflicting with the local routing table. I'm sure there's a workaround. I basically copied a working config from the OpenVPN client (Viscosity,) it was pretty straightforward. I did the same, but the tunnel didnt came up. I just took a look into the client config and changed the tls seeting in /var/etc/openvpn/client1.conf from tls-auth /var/etc/openvpn/client1.tls-auth 1 to tls-auth /var/etc/openvpn/client1.tls-auth restarted the service and the tunnel came up Now i have the same issue like joako.

@kilthro: The local network is the network you want the vpn clients to have access to. If you do not enable that the connected users will not be able to access the network. Are you pushing DNS as well? Local network will not be available if you redirect all traffic through OpenVPN. Local network is only available if you want that the client should rout all traffic from network "172.16.1.0/24" through VPN and all other traffic through the internet connection on the VPN client site. @manolios On pfsense where the OpenVPN server is running, there you have to go to Firewall and on the "OpenVPN" tab. There you have to allow the traffic from the OpenVPN network (10.0.8.0) to any.

Yup, I did do that.

Not sure if you can access your computers at home through "network manager" when using OpenVPN in tun mode. But you should enable "Enable NetBIOS over TCP/IP" with "h-node" on your OpenVPN server. If you cannot connect to your computers through network manager just use the UNS path: \\home_computer_IP\Share

podilarius, thanks man, i feel so stupid. I thought it was a routing problem. That didn't even cross my mind. I got it working once i disabled the firewall. Thanks again.

Just tested in my own config, the "ifconfig-push clientip mask" works with TAP (windows 7 client). You have placed it under client-specific-overrides > advanced right?  And completely disconected the client so its gone from the status screen.? And rebuild the connection from 'nothing'. Do you get any error? Does the openvpn-client logs mention anything worth mentioning?

You could change the server mode to "Remote Access (SSL/TLS + User-Auth)" and re-export.

Not "now" – it's always been that way.

Create an interface and route it out that interface.  Or you can modify the routing tables manually (not suggested).

It didn't finish establishing the connection.  I'd need to see more if you still haven't fixed the solution, you can always contact me. Cheers. -Percy

Excellent!! thanks for reply!!

When you set up the VPN configuration, make sure you're using the right certificate authority and client certificate in your config.  Otherwise, delete the CA cert and client cert and redo those.  It'll almost definitely solve your problem.  Sounds like a problem with your cut and paste. -Percy Kwong http://swimminginthought.com

The issue with the GFW is that they interfere with the authentication mechanism (TLS).  There are ways around it, although it is not considered secure.  There would be nothing to stop them from killing the connection once it's up.  A shared key configuration would work, although, it isn't exactly secure.

Sorry guys checked my config and realised that I forgot to add the route back from the client site to site to the roadwarrior. Cheers, Raj