It is a PKI what i get from the IPCOP, but the pki does have a password
When i use it on windows with the client from openvpn.se it is asking me for a password. (Client to Net)
and on the setup on the IPCop i had to enter a Password even in PKI

pfsense is setup as client and it took my CA, Client certificate and Client Key just fine.

Pfsense is always coming up with this

Aug 2 20:39:04 openvpn[43938]: Exiting
Aug 2 20:39:04 openvpn[43938]: Error: private key password verification failed
Aug 2 20:39:04 openvpn[43938]: Cannot load private key file /var/etc/openvpn_client0.key: error:0906A068:PEM routines:PEM_do_header:bad password read: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
Aug 2 20:39:04 openvpn[43938]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Aug 2 20:39:04 openvpn[43938]: OpenVPN 2.0.6 i386-portbld-freebsd6.1 [SSL] [LZO] built on Apr 6 2006

I'm a noob on OpenVPN … :-)

I've had a friend help figure this one out.  What we had to do was use iroute in conjunction with the route command.  We now have a working PKI VPN infrastructure where all remote locations and the local office are fully connected.  (Can ping from anywhere to anything).

If you're having issues, try looking at using the ccd directory and the iroute/route directives.

is this pertaining to the challenge password i setup in my keys? I can still connect to my VPN and i don't need to enter any password. Is this secure without having a challenge password? I'm a little concerned about the man in the middle type attack

ive been working on getting a CRL generated, but each time i do, i get errors.

(hesitant to post all my output, as it has lots of information pertaining to one of my clients).

has anyone else sucessfully revoked a cert, and if so, how did you do it?

I've resolved my problem !

I add a static route in "mypfsense2" for network subnet of "client1"

on the openvpn wishlist…

i didnt log in and try to post yet another, but maybe someone could edit their GUI wish, to be able to not only add certs, but to revoke them as well.  this would probably be a given if someone were to actually go to the trouble, but either way, i think its worth wishing for  :)

No need for rules, but need to specify remote subnets in the openvpn config on both pfsense-sides…

OpenVPN-Filtering is not available until now…
Will come later...

False alarm. :)

The problem is on the ADSL router. I can't traceroute also from the LAN to the internet (traffic goes only through the ADSL router)

So nothing to do with pfsense.

Thanks for the response.

Hi! Thanks for replying. I've Pfsense 1.2-BETA-1, and with the OpenVPN package, i'm already capable of doing this three things:

Listen on multiple ports Listen on multiple protos (tcp & udp) Listen on multiple IP's (multi-WAN)

I just put on the "custom options" of the my two openvpn tunnel configuration this line:

local 85.35.218.x;remote 85.35.219.x # for tunnel A

local 85.35.219.x;remote 85.35.220.x # for tunnel A

and doing a netstat -an it shows:

udp4      0      0  85.35.218.138.1194    .
udp4      0      0  85.35.219.219.1195    .

So openvpn daemon is listening correctly on both two wans fo incoming connections (with tcpdump i've tested it). And changing the protocol tab of the config, should also do the trick to listen on different protocol (tcp/udp).

But my question was referred to the possibility of doing policy routing for the two vpn, for the hosts inside the lan subnet of both sites. If i create a firewall rule, the tun0 and tun1 interface should appear in the gateway tab, so that i could choose the tunnel to use for a particular host/subnet to host/subnet communication. Is there another way to do this, waiting for the possibility to choose also the tun interfaces in the gateway tab of firewall rules option?

Thanks again.

PS. For failover over vpns i can wait, but the policy routing would be the choice to decide to switch or not to this great product.

@fumes87:

Is there a way I can connect to all elements on my LAN without changing their gateway to the PFSENSE machine?

Appropriate routing configured on whatever device is their default gateway.

http://doc.pfsense.org/index.php/Setting_up_OpenVPN_with_pfSense

part at the bottom: "advanced hackery"

Hi all,

Just wanna update with the current issue…I'm currently running 1.2-BETA-1 version...

I just get the solution for this problem...I change the user configuration from "route-delay 2"  to "route-delay 10" and the OpenVPN can successfully accessing OpenVPN Server and also can ping the LAN.
float
port 81
dev-node vpn
proto udp
remote 10.10.100.223 81
ping 30
persist-tun
persist-key
tls-client
ca ca.crt
cert 21.crt
key 21.key
ns-cert-type server
cipher BF-CBC
route-method exe
route-delay 10
pull
verb 4

Any info regarding this issue why some client can connect successfully without any problem and some clients need to change the configuration as above. Need feedback from the expertise..

Thanks…

@sbarreros:

I found what my problem was, when I was creating my client certificates in the common name I was entering the same name myserver.mydomain.com thinking this was refering to the openvpn server name.
I created my certificates with different common name and now it works.

Thank you gentlemen. ;D

Hi sbarreros,

I'm also have a problem same yours. What's actually u change? I'm also do like yours above, give a different name for Common Name (for client certificates), but it's also same. Both client if wanna access OpenVPN server will get the same IP Address.

Thus will give this kind of error :

"
NOTE: FlushIpNetTable failed on interface [65539] {3890476B-0667-4DE4-832E-0FB996C0862A} (status=1413) : Invalid index.
"

Somebody if can help me on this.

Here is my OpenVPN and user setting:

OpenVPN Server
–-------------

#user nobody
#group nobody
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
dev tun
proto udp
cipher BF-CBC
up /etc/rc.filter_configure
down /etc/rc.filter_configure
server 10.20.2.0 255.255.255.0
client-config-dir /var/etc/openvpn_csc
push "route 10.20.20.0 255.255.255.0"
lport 81
ca /var/etc/openvpn_server2.ca
cert /var/etc/openvpn_server2.cert
key /var/etc/openvpn_server2.key
dh /var/etc/openvpn_server2.dh
persist-remote-ip
float

Client1 and Client2 Setting

float
port 81
dev tun
dev-node ovpn
proto udp
remote 10.10.100.223 81
ping 30
persist-key
persist-tun
tls-client
ca ca.crt
cert aslahuddin.crt
key aslahuddin.key
ns-cert-type server
cipher BF-CBC
pull
verb 4

Hope there is somebiody can help me on this.

the diff is on it's way to scott by mail…

wait till it's applied and a new snapshot is built...

have a look on the dhcp server options in further snapshots…