I've resolved my problem ! I add a static route in "mypfsense2" for network subnet of "client1"

on the openvpn wishlist… i didnt log in and try to post yet another, but maybe someone could edit their GUI wish, to be able to not only add certs, but to revoke them as well.  this would probably be a given if someone were to actually go to the trouble, but either way, i think its worth wishing for  :)

No need for rules, but need to specify remote subnets in the openvpn config on both pfsense-sides…

OpenVPN-Filtering is not available until now… Will come later...

False alarm. :) The problem is on the ADSL router. I can't traceroute also from the LAN to the internet (traffic goes only through the ADSL router) So nothing to do with pfsense. Thanks for the response.

Hi! Thanks for replying. I've Pfsense 1.2-BETA-1, and with the OpenVPN package, i'm already capable of doing this three things: Listen on multiple ports Listen on multiple protos (tcp & udp) Listen on multiple IP's (multi-WAN) I just put on the "custom options" of the my two openvpn tunnel configuration this line: local 85.35.218.x;remote 85.35.219.x # for tunnel A local 85.35.219.x;remote 85.35.220.x # for tunnel A and doing a netstat -an it shows: udp4      0      0  85.35.218.138.1194    . udp4      0      0  85.35.219.219.1195    . So openvpn daemon is listening correctly on both two wans fo incoming connections (with tcpdump i've tested it). And changing the protocol tab of the config, should also do the trick to listen on different protocol (tcp/udp). But my question was referred to the possibility of doing policy routing for the two vpn, for the hosts inside the lan subnet of both sites. If i create a firewall rule, the tun0 and tun1 interface should appear in the gateway tab, so that i could choose the tunnel to use for a particular host/subnet to host/subnet communication. Is there another way to do this, waiting for the possibility to choose also the tun interfaces in the gateway tab of firewall rules option? Thanks again. PS. For failover over vpns i can wait, but the policy routing would be the choice to decide to switch or not to this great product.

@fumes87: Is there a way I can connect to all elements on my LAN without changing their gateway to the PFSENSE machine? Appropriate routing configured on whatever device is their default gateway.

http://doc.pfsense.org/index.php/Setting_up_OpenVPN_with_pfSense part at the bottom: "advanced hackery"

Hi all, Just wanna update with the current issue…I'm currently running 1.2-BETA-1 version... I just get the solution for this problem...I change the user configuration from "route-delay 2"  to "route-delay 10" and the OpenVPN can successfully accessing OpenVPN Server and also can ping the LAN. float port 81 dev-node vpn proto udp remote 10.10.100.223 81 ping 30 persist-tun persist-key tls-client ca ca.crt cert 21.crt key 21.key ns-cert-type server cipher BF-CBC route-method exe route-delay 10 pull verb 4 Any info regarding this issue why some client can connect successfully without any problem and some clients need to change the configuration as above. Need feedback from the expertise.. Thanks…

@sbarreros: I found what my problem was, when I was creating my client certificates in the common name I was entering the same name myserver.mydomain.com thinking this was refering to the openvpn server name. I created my certificates with different common name and now it works. Thank you gentlemen. ;D Hi sbarreros, I'm also have a problem same yours. What's actually u change? I'm also do like yours above, give a different name for Common Name (for client certificates), but it's also same. Both client if wanna access OpenVPN server will get the same IP Address. Thus will give this kind of error : " NOTE: FlushIpNetTable failed on interface [65539] {3890476B-0667-4DE4-832E-0FB996C0862A} (status=1413) : Invalid index. " Somebody if can help me on this. Here is my OpenVPN and user setting: OpenVPN Server –------------- #user nobody #group nobody daemon keepalive 10 60 ping-timer-rem persist-tun persist-key dev tun proto udp cipher BF-CBC up /etc/rc.filter_configure down /etc/rc.filter_configure server 10.20.2.0 255.255.255.0 client-config-dir /var/etc/openvpn_csc push "route 10.20.20.0 255.255.255.0" lport 81 ca /var/etc/openvpn_server2.ca cert /var/etc/openvpn_server2.cert key /var/etc/openvpn_server2.key dh /var/etc/openvpn_server2.dh persist-remote-ip float Client1 and Client2 Setting float port 81 dev tun dev-node ovpn proto udp remote 10.10.100.223 81 ping 30 persist-key persist-tun tls-client ca ca.crt cert aslahuddin.crt key aslahuddin.key ns-cert-type server cipher BF-CBC pull verb 4 Hope there is somebiody can help me on this.

the diff is on it's way to scott by mail… wait till it's applied and a new snapshot is built...

have a look on the dhcp server options in further snapshots…

in the next snapshot DHCP-Options are enabled…

Hi GruensFroeschli. Yes the option: push "route 10.8.0.0 255.255.255.0" Did the trick. I will check my settings, right now we are testing, thanks for your right answer  ;D!!!

Might it be possible to firewall on the LAN interface? That you add a block rule on the LAN tab which blocks all IP's of the VPN-subnet as destination? So the VPN clients can talk to the LAN, but LAN never answers.

Figured it out. 1. Killed the process based on pid in /var/run 2. Built the conf file using openvpn.inc 3. Called openvpn command with conf file as argument. Bingo… went on well.