Hi Rico,

Just to update:

Since I have two ISP connected to my firewall (1) PPPoE Connection (which is having issue) (2) Static IP Address.

I have tried using my secondary ISP by only changing the Interface and created the necessary firewall rules on the interface and the OpenVPN client connects w/out any issue, so it looks like my other ISP is blocking the traffic i still waiting for their feedback.

BTW, I have another issue please see the diagram below.
unnamed0.jpg

I also tried this options but no luck.
ipv4.JPG

Appreciate your advice.

Thanks,
A

This might be helpful.
https://forum.netgate.com/topic/150225/user-xxx-could-not-authenticate-every-1-hour

@mig said in Restarting OpenVPN interrupts non-VPN traffic:

I tried to add ping-restart 0 to OpenVPN-Clients-"Advanced configuration"-"Custom options" but it doesn't suppress ping-restarts

@Derelict Ah ok, thanks for investigating, I was just reading through that link you sent me. There are a lot of useful command line options in there 👍

@Derelict Thank you, you made my day! I need to learn more about basic networking.

Default port is 1194 and UDP.. While I agree he is using tcp, when you call out forwarding to 1194 - best to make sure you mention that in this scenario it will need to be TCP and not the default UDP port is all I was wanting to point out ;)

You need to isolate whether its a DNS issue or other issue.

Can you ping IP addresses from the VPN? ie... ping 8.8.8.8, 1.1.1.1 etc.... if that works its probably a DNS issues, if not then it's some other issue.

Can you give more information on the OpenVPN... is it a server or client? When you say connecting to the VPN... what exactly do you mean... from external into your pfSense box? or from the LAN to a VPN provider?

RHLinux

@jimp Thanks... that's what I needed to know.... I'll leave things alone.

Yeah that's a really old guide. You couldn't set a gateway group as the default gateway before 2.4 which didn't exist in 2016.

You should not have to source NAT traffic out of the LAN. The reply-to tag should take care of sending replies back out of the OpenVPN gateway. The only reason you might have to is if the target server is not configured to allow access from outside it's own subnet.

Steve

@gmbarlev

There is no difference between routing through a VPN or nor. It's all about your routing configuration. A VPN is simply another interface. So, once you've verified the VPN is working, ensure your routing is correct.

OK, I did some further digging on these lines coming from my openvpn.log file:

Mar 11 22:19:57 firewall openvpn[99120]: ++ Certificate has key usage 00b0, expects 00a0 Mar 11 22:19:57 firewall openvpn[99120]: ++ Certificate has key usage 00b0, expects 0088

I found an article on this site which is talking about OpenVPN and remote-cert-tls server option in Advanced Configuration -> Custom options.

When I add the option "remote-cert-ku b0" just after the option "remote-cert-tls server" my openvpn client connection status went to "up".

Screenshot from 2020-03-12 17-17-19.png

So now the VPN connection is up I can continue to configure pfsense to route the WAN through the tunnel.

Keep you posted if necessary. Thanks for the help so far.

Erik

@johnpoz I followed the instructions but after a couple of days the problem is present again, the vpn client has been assigned the IP address:
10.0.2.3

how is it possible ? where am i wrong?
thanks.