For what it's worth, we figured out a way to do it with the Cisco ASA 5505.  I was able to issue to the VPN users the IP addresses in the same subnet as the 10.4.0.0/20 network.  Then I had to add some very strange looking acl's allowing 10.4.0.0/20 to talk to 10.4.0.0/20.  That seems very strange to me, but it works. I'd still really like to know how to make this work with Pfsense, so if anyone has any ideas, or has questions about my setup please chime in. Thanks.

this is solved - the config I got through the client exporter expected username + password even though I had configured SSL/TLS Remote Access w/o user auth. Works well now!

Hi, thanks for your feedback. Please post your results (in a few days).

np, once in a while i share the same boat

Anyone, any idea how to remove "server 0.0.0.0" parameter? I delete it from /var/etc/openvpn/server1.conf but it always come back after system restart. Where I can disable "server" parameter. I need only "mode server" parameter.

well the easiest thing to do would be outbound NAT on the LAN interface, source of the openvpn subnet, translated to the LAN IP of the box. Yes, you'd have to switch to manual. You could do 1:1 NAT on LAN from an OpenVPN IP to a VIP (non-CARP!) in the LAN subnet, but that would only work for one client with a static IP.

check if the routing is correct on both ends … it can happen that one side is able to send traffic, but that the other side does not know how/where to return the replies

I've had similar issues like this in the past. Some things to look at: as heper said, check your routing table. make sure there is a route in  site A's table that routes traffic to siteB_subnet via the openvpn interface (do the same check for site B) make sure you have the allow rules on the openvpn tab check your lan rules on A, see which rule get hits when your sending traffic from A to B and double check that its using the "default" gateway. if there is no such rule, add one that has source->lan_subnet dest-> siteb_subnet gateway->default Run a wireshark on the receiving end (the machine on site B that you're pinging), see if the ping requests are coming in (could be that the responses aren't going from B to A properly) -E

@jimp: coughcoughcough :-) OOOOHHH, I was looking in pfSense's FAQ in the OpenVPN sections…  :D Thanks for the link!

There is no tunnel network - when using TAP the client is effectively directly connected to the LAN. It gets a DHCP lease from the LAN DHCP server. I would recommend you read the OpenVPN documentation so you understand the basics of what you're dealing with.

If it is just OpenVPN under the hood of Zerina, then yes. The sticky post at the top of this forum for site to site covers the process, the GUI on Smoothwall should be the only difference.

Currently we have a bunch of 'satellite' systems that all serve the same purpose and don't have active users. It was looking to be a bit tedious (as we are constantly sending out new systems and such) to have to create a separate user in pfSense for our fluid usage of the network. However, as you have mentioned, if the certificate is compromised then anyone could have access to the network (which only allows access to one IP but that is beside the point) and we'd have to replace the certificate on all the systems. Is there an easier way to create a user/certificate combination without having to go through so many steps every time? On IPCop, for example, you type in the hostname and one or two other things and it created the user and certificate and everything.

That is in Client-Specific Overrides in the OpenVPN config. Make an entry for each user's certificate CN, give each of them a hardcoded tunnel network (a /30 inside of your larger tunnel network on the vpn), then set your firewall rules accordingly.

I set both the server and client to "any" and it still doesn't come back up until it gets rebooted. For example, the client machine was down for the weekend.  When I powered it back up the VPN would not come back up until I rebooted the server.