More information is needed to help you. What is the server? What is the client? What are the Local and Remote networks on each end? Where are you pinging from? Where are you pinging to? You generally have to specify a specific source IP address (Like the interface address of a network specified as a Local network in the OpenVPN configuration) to ping across an OpenVPN tunnel from the firewall itself so it's pretty unclear what you're actually doing.

You can't, and you don't want to. Read the last post on that thread. https://forums.openvpn.net/viewtopic.php?f=15&t=12605&sid=c75d657e002504a39d34ae664ddd9ad5&start=60#p49837

Ok, just to confirm the issue was that the ISP device had a hidden 'advanced' setting which did not forward Internet packets by default, as I thought. Once this was found, and packets forwarded correctly, it worked fine! Thanks for your input!!

I used a NTRadPing and I could see there was something wrong with the user so I went back and I checked if the user was member of the vpn group on DC and it was not i forgot to add the user back in to the group after fiddling around in the DC this guide works https://community.spiceworks.com/how_to/128944-pfsense-admin-logins-via-radius-using-active-directory-accounts

That's from the client. The OS or OpenVPN build on that device doesn't support that method of hashing/encryption

the Pfsense have two WAN, somehow the routing of the openvpn is not on going to the right interface.

I solved my problem i can able to connect from laptop or desktop. Thanks

Thank you for your help, another user just PM'ed me with another method of fixing the issue. The killswitch now works using the link I just posted above and I'm ready to move on in my network issue 'todo' list. Thanks so much for you help. Also I had already deleted the redundant/useless rules. I had just started making any rule on whim to see if I could stumble on the solution.

You'd have to manually craft the OpenVPN server settings to match your server config. You don't have to import the full CA unless you want to manage the keys on pfSense, but if you do want to import it all, see https://doc.pfsense.org/index.php/Using_EasyRSA_Certificates_in_2.x If you just want to run the server on pfSense, you need only import the CA Cert and server cert.

sorry guys i already fix the image.. Derelict, that what i already did.

Thanks!  I got it working..

Reboot! Doh! Nothing to see here…

hey guys, not that anyone cares but I think I found the solution.  I was using a smart DNS service that was getting around Netflix geoblocking.  Part of that had static routes on my edge router.  One of them was the google dns which I think the VPN client was trying to use for it's own DNS.  As soon as i turned off static routes, my mobile devices can connect through the VPN and access the internet and everything else.

@Pippin: In OpenVPN Server config you can select it under: DH Parameter length (bits) Oh ok I see it. Do you still feel that 2048 is necessary ? I'm worried about a performance hit

@blacklotus: However I can't seem to have communications FROM the firewall WAN interface to use it's real IP address. DDNS from the firewall registers the PIA address IPSEC originates and Identifies as the PIA address Same with GRE or any other type of service I wan't to use port forwarding for certain types of services to/from the WAN IP Heh.  I'm having the exact opposite problem.  I'm trying to get pfsense to send DNS queries out over a PIA tunnel but they keep coming from the WAN interface instead.  Can you post your routing table?  You can get it from the GUI with Diagnostics > Routes or from the command line with "netstat -r" EDIT:  If you do post your routing table you should obfuscate your public IP address.

There isn't, but there is also no point in tuning it. It's a symptom of the root connectivity problem, not the source of any problems. Nothing you change will fix connectivity issues.