Found the issue. It was related to the certificates and certificate authority. We recreated the authority certificate and then the server certificate and then the user certificate and used the new certificates, and everything started working.

@techpro2004 Obviously, some description of the configuration is also needed. Screenshots of the setup maybe? Hub and spoke?

for me, client is NOT disconnected. When I click nothing at all happens, logs are empty action is NOT taken at all.

@CubedRoot please look into the advanced option mssfix on openvpn some ciphers require adjustments for example I use aes-256-CBC because it can be off-boarded to my safexcel accelerator, and there is no lag for video calls at home etc when off boarding is utilized, for my DSL line [I am old school] I needed to add mssfix 1300; However, this is specific to my set up in many community technical threads addressing mtu path discovery and encryption encapsulation errors mssfix is frequently appended alongside data ciphers aes-256-cbc, you can also customize your MTU for your vpn interface that is often adjusted also.

@johnpoz I only use a VPN occasionally these days, but I used to do a lot of travelling for my work. I ran my own mail server then and used a VPN to access it. This was before smart phones became popular and my cell phone could only do SMS. This was so far back I was using CIPE for the VPN. It was also when I discovered that using the popular subnets at home was a bad idea because I'd run into conflicts between my home network and the one at the hotel I was staying at. I didn't have a problem with the WiFi at the hotels I was staying at, other than one place that had some problem that had nothing to do with a VPN. I've only come across blocked VPN at the local library and community centres. A popular donut/coffee shop has no problem with VPNs. I also have the employee WiFi password, as I did some work at some locations for that chain several years ago. This allows me to bypass all the ads, etc. that you'd normally get on their network. I haven't tried a VPN with the customer WiFi access though.

@MichaelCropper said in OpenVPN Can't Connect?: Issue - Times out. That's the message you see with the Client VPN app. On the pfSense side of things, you can check easily if the traffic initiated by the phone arrives at the WAN 'gate' (NIC) of pfSense : Remember the firewall rule ? Here : [image: 1785159983603-7432cbc1-f04b-4ec1-8041-a7696f2a7286-image.png] You the "States" (marked green) : if it stays on 0/0 then you have a solid proof nothing arrives at the WAN pfSense interface. Edit : My 'Source' is "pfB_Europe_v4" which is a "allowed IP list". Which means I can only connect when I'm 'in Europe'. Normally, you should the Source to '*' = everybody. When you connect with your phone, and the States change (go up), then look at the VPN Logs : Here / this is what you should see : [image: 1785160098784-00504ebc-0f15-4fb5-94b1-a0a749a3a118-image.png] == clean : no errors, no warnings.

@viragomann Ok, so what you pointed out was why I was getting the .0 in the iroutes. Thank you for catching that! BTW, I was finally able to get my /30 configuration to work. I was getting this error: Options error: --client-to-client requires --mode server This caused me to assume I needed to add the --mode server to my configuration and that just caused me to dig a deeper hole. In fact, the issues was that I should NOT have enabled the flag below for /30 networks, which of course makes sense now. [image: 1784831730186-b51aee98-9732-4d5d-886b-2e365fd9097a-image.png]

Never mind. It was a bad software installation. Once the 3.8.0 being removed and the 3.9.0 being installed, the problem was gone. 3.8.0 on another station is working fine too. Thanks.

Does anyone have any other ideas what it could be?

Pretty sure this is just the log message failing. /etc/inc/util.inc 26.03.01 Code function cisco_extract_index($prule) { $index = explode("#", $prule); if (is_numeric($index[1])) { return intval($index[1]); } else { logger(LOG_WARNING, localize_text("Error parsing RADIUS attribute - rule %s %s: Could not extract index", $prule)); } return -1;; } In my older version before localize_text was introduced i was getting an error but Openvpn would continue on as the Cisco radius attributes are not needed for openvpn authentication. Error parsing rule shell:priv-lvl: Could not extract index /etc/inc/util.inc 25.11 Code function cisco_extract_index($prule) { $index = explode("#", $prule); if (is_numeric($index[1])) { return intval($index[1]); } else { syslog(LOG_WARNING, "Error parsing rule {$prule}: Could not extract index"); } return -1;; } However in 26.03.01 it's crashing at the log message due to too many placeholders, $prule for me is just a string "shell:priv-lvl"

Oh I see. Yes, that's actually quite a common misunderstanding. Clients for servers are not configured there as you found. I should have spotted that.

Yes that is the expected behaviour if you policy route traffic. You would normally need a rule passing traffic to the VPN subnet before that without a gateway set to avoid it. The only other thing that might have come into play is the 'negate' rule. That is intended to allow that traffic for VPN subnets specifically and should be enabled by default. https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#disable-negate-rules

I plan to generate aliases and fw-rules via pfsensible ... at first I asked the customer to set fix tunnel IPs via CSOs and then give me a list of "tunnel-IP; target VM IP". From that I will try to write some playbook. There are also VMs with more than only RDP: postgres-DBs etc ... so that adds up to more complexity. AND customers with multiple tunnels. The fun has no end ;-)

So all things considered, my situation is relatively speaking a correct configuration right?

@Gertjan Thanks again! I only reply quickly: it seems it even works without pass rules, at least I had the impression. I now adapted my setup according to your suggestions, following rule on both WAN-interfaces: [image: 1780590972256-c44879d4-c6a4-43f3-9364-631cd9af37ad-grafik.png] I have to test through all the variants tomorrow or so (4 remotes in the client.conf now). Great tip with "This firewall", very handy. Have a nice evening!

Troubleshooting & Workarounds so far: Main Workaround: Turn off pfBlocker. Suricata on/off made no difference. pfBlocker IP blocks on but DNSBL off worked. pfBlocker IP blocks on and DNSBL with malware & other filters on but porn filter off works, but connections are slower to establish. Note the porn filter is the single biggest filter list. Of course testing the different DNSBL options takes a lot of time as after each change pfBlocker must be reloaded, which with a lot of lists can take 30 min to an hour each time. I'll do more testing as time allows, but hopefully this may help someone else. What is odd to me is that it only affects the Tun VPN's as Tap VPN's are so much more complicated. If anyone has any other ideas they would like me to test/try let me know!