well i see that, but i set it up according to the settings. I will look into it sorry.

@johnpoz said in remote OpenVPN-client LAN not reachable: @sgw said in remote OpenVPN-client LAN not reachable: redirect-gateway def1 Why are you redirecting gateway? That is normally not done in a site to site setup. A leftover from my desparate debugging. Thanks for spotting, disabled it now (was in the CSO).

On closer inspection, it appears that the problem is certain assets dropping any request coming from outside their assigned address range. This appears to be a crude and problematic security "feature" and has been brought up with the manufacturer. If I can verify, I'll mark this is solved. it may be necessary to configure as peer-peer and put each connecting client in the address range of the LAN, which, given we're using a class A as a classification system, there's plenty of class C ranges not internally assigned. Will update with any progress.

UDP should be better yeah - unless you can not get to it, then is useless ;) Takes nothing more than some simple setup to run both. And if you configure the client settings correctly - it will first try your UDP connection, and if can not connect it will then try TCP.

https://www.netgate.com/resources/videos/openvpn-as-a-wan-on-pfsense.html -Rico

@emammadov thanks

Share your OpenVPN Client settings (screenshots). -Rico

In Diagnostics -> DNS Lookup you can resolve this express vpn host or not? -Rico

@abadonna your link is down can you send me your tutorial. I'm trying to setup Secuirtykiss

i had it on authentication only in the open vpn server, now users are showing up for export, you nailed it thank you so much!

@jimp Ok, Thanks Rico and Jimp ! / br, pete

SOLVED Do NOT use the character "¤" &curren; in the password field. This makes pfsense create a config.xml.bad and revert to a previous version of the config. OpenVPN files under /var/etc/OpenVPN are created and active until reboot of pfsense. Newly created entry not shown in Services or Status, but still connecting in the background. My config.xml.bad, Under OpenVPN client section: <auth_pass>zYdfrJn&curren;bE</auth_pass> Using a password not containing "¤" does work, entry is created and functional. Anywhere said that password shouldn't contain strange characters? If not, this looks like a bug to me. Brgs,

@yash said in OpenVpn:TLS Error: TLS handshake failed: read UDP: Unknown error (code=10054) You need to validate that port is open from your client to the server.. It could be blocked at your client side, etc.. Or sure you could be blocking it on pfsense, or some nat router between. Is that IP your public IP that you xxxxx out? Lets see your firewall rules on your wan to validate 1199 is open.. Also your pfsense is not behind a nat right? And has public IP on its wan? Simple sniff on the wan for UDP traffic 1199 and then try to connect with your client will tell you for sure if the traffic is getting to pfsense or not.

I will take a look on those! Thanks for now!

@derelict I hear ya’. That’s a bummer, but makes sense... I could maybe I replace our existing router with another pfSense one and do a P2P server between both of them instead so the firewalls can talk to each other? xFi isn’t the best with their interface - far too simple. Home-Network friendly I suppose. Thank you for the help though.

Sorry to necrobump, but this should be pinned in official pfsense OpenVPN tutorials. Two years I've been using ~30-40Mps VPN being sure it's speed is limited by the provider. I just tested snd/rcvbuffer and fast-io and immediately landed on stable 60Mbps. Holy smokes! Thanks for making my life better :)

This was solved as you can't use a subnet that follows under the 10.1.0.0/16 VPC setup in AWS. 10.1.99.0 changed to 192.168.XX.X/24 subnet worked

I just noticed in the OpenVPN client log the following: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1601', remote='link-mtu 1602' Where does these MTU values comes from? I have no MTU defined in OpenVPN client config. I have no MTU defined in OpenVPN server config. I have no MTU defined in WAN interface. I have no MTU defined in OpenVPN interface.