The others could be whatever you want on them..  Be it based on the specific user your creating the cert for, or you site and location.  Email for example could be the users, the admin..  etc..

Sorry, that is the one I was talking about.  I'm not at home so I was going off of my phone configuration as I can't look at my system at the moment. Thanks for the answer.

switch is probably missing a default gateway, or has the wrong default gateway, or the default is on a diff subnet so it's replying back the wrong way.

Unless I've misunderstood your original request, no, you don't need anything like that. This is assuming you're talking about having remote access OpenVPN clients connect to both your WANs and use Multi-WAN for their Internet-bound traffic coming across the VPN: a: Make sure clients can connect to both WANs: 1. Set the Interface for the VPN to Localhost 2. Add port forwards to both WANs to forward your OpenVPN port for this server to localhost (127.0.0.1) on the same port b: Use gateway groups on OpenVPN rules: 1. Firewall > Rules, OpenVPN tab 2. Add a rule at the top of the list to match from a source of this server's tunnel network, destination is your local LAN, without a gateway set 3. Add a rule just under the previous rule to match from a source of this server's tunnel network, destination is "any", using your existing gateway group.

Not surprising - many (most/almost all ????) Windows/share issues across OpenVPN are Windows issues not OpenVPN issues. Dare I say that should be the title for a sticky note (or at least a line in the Wiki)…..........

I finally had some time to do some more exhaustive testing and you were right.  For some reason, the default flag in my Android VPN client was not routing all traffic over the VPN.  The route to the LAN was as expected (through pfsense) and the route to the WAN was over the cell network.  Once I set the flag to force everything over the VPN, the behavior (and routes) are the same. So in the end, I really just needed to lower the MTU to get a reliable connection.  I'm just happy it's working  :)

I finally got a chance to replace my working PFsense box at the main branch. Now I have it and a test box both v2.3 with openVPN. I exported a client from the test box and installed it on my PC which already had the client exported from the production box. I installed the testbox client which was very quick and evidently only installed the certificate. When I start OpenVPN manager (v. 0.0.3.6) from the desktop icon an icon appears in the area next to the clock (lower right in Windows 10-can't remember the name) then right click I get these options top to bottom: status, Pfsense-udp-1194-admin's name-config, then the same thing except with service on the end. Either of these options connects to the same box. How do I get it so I can choose which box to connect to? Thanks for any help!

Thanks! You are right, that tutorial is wrong. Now it works perfectly!!

In the client export utility select "Other" at "Host Name Resolution" and enter your domain name at "Host Name" below, then export the client config.

Hello, I follow the step, everything is clear and working thank you verry much!! I have just problem, the intra client communication is possible? Client 192.168.2.1 –---> communication ok with Server 192.168.1.1 Client 192.168.3.1 -----> communication ok with Server 192.168.1.1 Client 192.168.2.1 -----> communication not ok with client 192.168.3.1 Thank you

To direct the traffic for a particular website to the client you need a route for this site at OpenVPN server. This can be set up by "client specific overrides". Add an override, select the server an enter the clients certs common name, enter a tunnel network that should be used for this client (within the servers vpn tunnel network). At "Local Networks" fill in your server sites LANs (it's necessary that at least the source IP of the host which want to access sites via this VPN is entered here to get the route pushed to the client) and other IPs or networks that the client should reach over vpn as you did in the server setting and at "Remote Networks" enter the addresses or networks you want to reach via the client from server side. Set the other options to your fits. Off cause the access has to be allowed by the clients firewall rules as well as at server side and the clients router must do masquerading also for the servers sites source network.

@heper: thats exactly what that checkbox is supposed to do….. Do not create rules when gateway is down By default, when a rule has a gateway specified and this gateway is down, the rule is created omitting the gateway. This option overrides that behavior by omitting the entire rule instead. you just need to make sure that there is no rule above&below it that allows the traffic out a different way Thanks it did work, just wondering if I have multilans what do I need to do to make them work?

I solved it by making a gateway on a dynamic IP and setup a rule in my LAN that is connected to the gateway to transfer all traffic, here's my setup: Enable your OpenVPN interface (you can rename it) [image: 6f27b79f1bd849d3b4a11a54ae88f65f.png] Create a gateway with a dynamic IP, I set my monitoring IP to my VPN's tunnel IP [image: d818d364644e4b4cb9e2f556a71c4174.png] Go to VPN -> OpenVPN and go to your server's settings and this line [image: e9a9b83ec19c4569bf4e3a5e55a2dddd.png] Go to Firewall -> Rules -> LAN and create this rule (You'll need to click show advanced settings) [image: 7dcf9b69c2c24e5ba2e0887e33b97941.png] Then you can port forward to that tunneled IP you want to host the server on Firewall -> NAT [image: 73aaad3793a141c6a300dfedf3b758ef.png] Last you forward is in Firewall -> Rules -> Opt1 (Destination is the tunneled IP) [image: 06447c7b2d94439e9916da9c56743c7a.png] Sorry if I missed anything, I hope this helps though or at least point people in the right direction. The goal was to make the server owner who can't open his ports just login to my VPN & then people connect through my IP and they'll join his server, without needing to connect to the VPN themselves.

I fixed this problem.I wasnt related to pfSense at all.I was wondering how can I set MTU 1492 only for OpenVPN.I know how to do it using advanced options but I was wondering I need to change it in the physical interface used for connection.Thank you.

I think I may have just had one of those answered your own question after asking it moments. In following that guide and others, I was using the net30 option but I see that is deprecated now and the default is set to use a subnet topology. Looking at my settings, it seems that in the upgrade my config changed to the new default which I assume would explain it breaking. Since then I seem to have confused myself and have ended up with a net30 config but not with that option selected, so the VPN probably has no idea what is going on. I think I'll sleep on it and take another look in the morning, hopefully I've understood that correctly and can fix it. Please let me know if I'm still confused though, in case I'm just going down another wrong track. Thanks.

but your hosts are not using dns through the tunnel they are using pfsense.  Pfsense is not sending the resolver traffic through the tunnel is just sending it out your wan. Yes, I know and this is what I want to change. I want the VPN Clients (and only the VPN clients) to send their DNS queries down the tunnel to the VPN provider. as for IPv6, I only want to prevent VPN clients, as defined by their alias, from getting or using IPv6.

Came across this looking after finding that the VPN client (OPENVPN ios) stayed connected after I disconnected the user connection from status>OpenVPN by hitting the X next to their connection. I expected the behavior the original post was describing and was puzzled why it not only showed on the client that it was still connected, but also why after attempting to access a resource located behind the VPN connection that it connected back up and worked. Rather than disabling account or trying to change the timeout/reconnect options, I found the best way to have this control to disconnect a session is to set up authentication to another directory (Ldap) and filter approval based upon group membership (memberOf). This way one can remove the account from the LDAP group, then click the X to close the client vpn session from the server side. The client then tries to (automatically) reconnect and fails based on authentication. I found that this is the only clean way to have administrative control over the client vpn session apart from disabling the entire user account or disabling the VPN server itself. Thanks, Brian