Glad you have it working now. 🙂

-Rico

@freek_box
If your onlay goal is to access the router itself for maintenance I would go with the existing VPN and the NAT.
However, if you set up the router as OpenVPN client which is connecting to the cloud you can have a backup connection in case the main internet goes down. But you will need a route on the 4g router to the LAN behind pfSense.
Another option is to set up a second VPN on pfSense itself using the 4g as gateway. This way it may be easier to configure a failover for both directions.

@calbha What VPN do you use? I've also experienced it from time to time, especially while traveling. It seems to be ok now as I'm staying at one place during lockdown ahah. Maybe try to read some reviews about VPNs for Torrenting and simply switch it. (I've inserted the link with my fav website).

They're not vpnmentor yet but I like their approach and the way they test.

As far as I know, in most cases, it's simply the issue with the VPN

@ekoo I am doing what your asking in your OP. But my setup is different. I have multiple Nics in my server and I can bind P2P to use one of those Nics. My router is pFSense with 8 ports to do whatever I want with.

So I setup pFSense to use Opt3(port3) to route all traffic through expressvpn, then on my server, I bind my P2P client to use Nic3 only.

I then set each nics index priority so that traffic is routed through nic1 first and so on. Only my P2P is traveling through VPN.

You can use packet capture to check whether the packets are going out the VPN interface.

Also I'd recheck your firewall rules. Enable logging in all relevant rules and check the log to see which rule is applied.
Keep in mind the rule order and that floating rules and such ones on gateway group have advantage over interface rules.

Wow that was easy!
It worked straight away 😃

Thank you, i really appreciate it!

Thanks for all your help your comment about the windows firewall got me to look at it a different way. Turns out during one of my previous attempts to get internet to my VPN clients (a different issue not this one) I messed with some other firewall settings and pushed all of the VPN traffic out the WAN interface which worked fine for getting my clients internet access but caused issues when I tried to access the LAN. I removed that and now with the push route command my clients are able to access the Internet and my LAN

@Rico Those are respectable numbers. I'm curious to know how that would scale with 2 simultaneous connections? I'm thinking it's not entirely CPU bound, so maybe 2 by 60 or 70 Mbps?

easy-rsa together with easy-tls might be helpful:
https://github.com/OpenVPN/easy-rsa
https://github.com/TinCanTech/easy-tls

@viragomann: another very valuable hint - thank you!

I adapted the configuration accordingly:
IPSec-3.png

I also limited the ip-range of the DHCP-server to make sure this address cannot be assigned to anybody else.

Glad you have it working now.

-Rico

@jimp

yes i can get dyndns working with the real IP assigned by the ISP

so something like this

purple ... 62.116.x.y ... dyndns1.dyndns.org
yellow ... 91.113.x.y ... dyndns2.dyndns.org
green ... 194.96.x.y ... dyndns3.dyndns.org

the budget in COVID times is slim to n00thing

thx for the hint with the static IP gonna look into it.

Just in case anybody has this issue as well - I finally was able to resolve it: the issue seems to be that the routing table on the Android phone (version 9 - Pie) seems to have corrupted in some way when the OpenVPN-connection routed is closed and re-opened.
The solution is either rebooting the phone or (much faster) turning on and off flight-mode - this seems to reset the routing table and OpenVPN-connections can be initiated again.

@viragomann You are a bloody genius. Thanks SO much.

Just an update. I solved my issue. I switched vpn providers and its working. That tells me there was some nuance in the vpn config of strongvpn that didn't work.