Dude are you freaking serious??? I think your just trolling now.

That is just freaking gibberish.. Valid until Openvpn server - What??

The freaking wizard walks you through creating a CA on pfsense to use - and then walks you through creating the server cert to use!

All of which is gone over in the doc I linked you too.

I get it now, thanks, guys!

@Daglimioux said in I cannot ping to device in secondary network using pfSense OpenVPN server, but I can in primary network:

will conflict if I have LAN2 address 10.0.0.1 with a netmask 255.0.0.0 and my OpenVPN private network to 10.20.30.X/24?

That is to be assumed. This way the OpenVPN is part of the LAN2 network, so there will be no routing possible between these networks.

@ressurex Thanks ressurex, the guide you supplied the link to helped me solve the issue. The issue was the "Gateway creation" setting in the VPN client. This setting has three radiobuttons of which none is checked by default. Since the ProtonVPN does not mention this setting I did not touch it. However, as it appears, you need to check one of the radiobuttons in order to create a gateway for IP4, IP6 or both. I checked both and after that, it worked.

@johnpoz The hybrid NAT is not sufficient. I really do need to manually create the NAT rules as mentioned in the ProtonVPN guide, because without those manually created rules (and with only the automatically created ones) it does not work.

@bmeeks Yeah. Open source levels the playing field for everyone to have access to quality IT, network security and anything-software, and makes IT less daunting for businesses.

Recently I has the same problem with getting my VPN through NordVPN setup, but it has failed. Can't say exactly what's the matter but after VPN service disconnection I could use the Internet with no troubles too.
You say it's not an issue with NordVPN but when I've changed it to VeePN service everything was straighten out. But your problem may be of another kind...

@KOM said in Benchmarking OpenVPN Performance:

I have a 100/100 link at work and a 150/15 at home. I use OpenVPN to connect to our LAN and various Windows boxes via Remmina (Linux version of RDP). It's fast enough for me. It's hard to say how it will perform for you without knowing what you do.

Thanks @KOM - my use case is similar - RDP, VNC and some file transfers now and then. For that it's working very well based on my limited testing. I just have a tweaker mentality and figured there might be things I could do to make it even better :). Also, thank you for mentioning Remmina - I have been looking for a good RDP/VNC client for Linux and this does the job. Thanks again!

Have you checked the OpenVPN Logs?

-Rico

Hi,
yes, the problem was on the antivirus installed on the server.
Thanks.

Just add the network you want to reach from the access server clients to the "Local networks" in the server settings and add the access server tunnel network to the "remote networks" in the peer-to-peer settings.

Even though it's possible to run a multi-purpose server (https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/configuring-a-single-multi-purpose-openvpn-instance.html), I would recommend to set up an additional remote access server for that user.
Simply run the wizard, it will guide you through the setup.

Yes, that can be achieved by policy routing:
https://docs.netgate.com/pfsense/en/latest/routing/directing-traffic-with-policy-routing.html

The tutorial seems to be old.
You have only to assign the interfaces to the OpenVPN instance and enable it and enter a proper name.
No further settings necessary.

In the settings for the PIA client check "Don*t pull routes" to avoid that you get pushed the default route from the server.

Then set up a policy routing rule like that:
Add an alias "NoPIA" first and add the networks 10.10.1.x, 10.10.2.x and your pfSense LAN address to it.
Add a firewall pass rule to your LAN (92.168.1.x):
source: LAN net (the 192.168.1.x network)
destination: check "invert match" and enter the alias "NoPIA"
Open the advanced options, go to gateway and select the PIA gateway.

You have to assign an interface to the PIA-VPN first.