@viragomann
Now I managed to get full tunnel and get internet in connected devices.
Sorry to make this a very long discussion.
Thank you all.
If you don't mind, could you please delete the certificate chat section in this discussion ?

@ncohafmuta said in OpenVPN on 2.7.1 crashes on some circumstances:

I'm running pfsense 2.7.1

Be aware that those who are using 2.7.1 are not the persons who visit this forum.
As they would see right away that 2.7.2 was avaible. Did you test 2.7.2 ?

I'd love to add more details, but 2.7.1 is more then two years old and I can't recall any related info anymore.

Just so it's clear:

OpenVPN Client Export version 1.9.5 isn't available on the 24.03 package repository. It's only available in the 24.11 package repository.

No packages from the 24.11 repository should be installed on 24.03. Either upgrade to 24.11 first, or ensure the update branch is set to stay on 24.03.

On the current versions that update branch doesn't automatically get set to the latest version so you'd have to go out of your way to land in this situation.

@GuillaumeJ
Try to follow the steps mentioned in their official guide for pfSense:

Proton VPN over pfSense

Regarding your question:

Once you are in NAT > Outbound, you should go to the tab:

Manual Outbound NAT rule generation.
(AON - Advanced Outbound NAT)

here you should see the automatic rules created.

Actually I have Proton VPN over pfSense working, although I'm getting some strange random issue I'm trying to investigate.

Hope it helps

@joaobarbi said in Setup OpenVPN to redirect all traffic directly to WAN:

Now, instead of routing traffic through the enterprise network, I want to use the VPN to redirect traffic directly to the WAN, bypassing the enterprise's internal network

Which path though the internal network does the traffic actually take now?

If you run an OpenVPN server on your firewall, routing all clients upstream traffic over it (for whatever reason..), the packets come in on the VPN interface and go out on WAN.
I cannot think of any shorter path.

@Gertjan OK thanks, I didn't realize that the DNS name is tied to the pfSense user name used when connecting to the OpenVPN server.

@blackslash

They were fire-walling port 1194 UDP traffic ?
They are anti OpenVPN ?

@Decepticon yup thanks!

@viragomann Thank you for mentioning CSOs, I was missing the CSO for the new building thus the VPN connection wasn't working properly. I cloned the existing one and everything works fine.
Thanks and have a nice day!

@AnthonyW
Hi Anthony, as I face the same issue with my users frequently getting disconnected due to inactivity timeout. I found your KB here, however I can't see https://forum.pfsense.org/index.php?topic=138984.0
could you please explain how to resolve or guide me the correct forum to find the resolution.

@Gertjan GASIONSERVER was udp only because ewon protocol is udp

@coreybrett said in can a firewall connection route packets ?:

Does the established firewall connection on Site B's router allow packets from Site's B LAN to be routed back

If incoming traffic was allowed to reach 'a place', the firewall (router) states will handle the traffic going back.

Your example :
With your phone as a VPN client, you can connect to the VPN server, site A. The firewall rules of the VPN server on site A will decide 'where' you can go.
Let's presume a "pass all" so you can go to every known address on site A.
So you can access, site A, pfSense itself, all all its LAN type interfaces, and why not, all it's available WAN interfaces, and one of the WAN interfaces is probably the VPN "site to site" link that connects Site A to Site B.
So, if your phone, using the VPN to site A, wants to access an IP address that exists on site B, and pfSense Site A knows that that IP (network) is reachable somewhere on Site B, it will transfer your phone traffic to Site B over the existing route, your site to site (VPN) connection.
Traffic coming in Site B will, if local firewall rules allow it, reach the final IP.

The traffic going back, as traffic is a dual direction stream, will be handled by all the routers involved. That's the beauty of using stateful router/firewalls.

After all, when you set up a connection to www.facebook.com through I don't know how many routers, the traffic reaches Facebook.
And - now your are not surprised ( ? ! ) - that you get an answer back.

@Gertjan
both my my client ovpn and the server config file has
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256

yes my file has this for the TLS ( i broke the real one with lines that start with 111

<tls-crypt>

2048 bit OpenVPN static key

-----BEGIN OpenVPN Static key V1-----
89adff0d024f4b0cdeb8f2b5f0d7d52d
1111ec561
6757da21950d7bf075cbd3b9430fd552
7861728c9db9a99c8da70d09678c4c94
6900a656e7642edc64ada8c960f9990e
111120e67dc1
4b996b5309bc42e7771fe43637fdc1ce
986ea2b7c8116b5577c503a790bc0f0d
111e2544be6b
ab6a818fb8dd5e212ee5f0183e43ff1b
-----END OpenVPN Static key V1-----
</tls-crypt>

@dutchie said in pfsense as openvpn server behind fortigate 40F:

The pfsense machine was my previous router, and currently i want to use it as my vpn server, because my tunnels are all Openvpn based

Yeah, ok, but wait : you also said :

@viragomann said in pfsense as openvpn server behind fortigate 40F:

(2) my main lan subnet >> connected to lanport on the pfsense box (dhcp on lan turned off)

So, even when the pfSense based OpenVPN clienst will conenct just fine through any upstream router (your Forigate, and any number of upstream ISP routers), you wind up, or LANs are not pfSense LANs, but somewhere other side, on pfSense WAN.

You are making your setup very strange.
Forigate can't handle OpenVPN ?

@Gertjan Seemed to be an issue with the openvpn tunnel, I must have done something to it while adding express vpn. Recreating it helped.

@stephenw10 said in Setting up ExpressVPN using OpenVPN:

FQDN

But they didn't give me any DNS information at all. They just kept telling me to use the app or buy their expensive $190 Alcove Router.

The reason why I'm building this router is because my old router that I was using ExpressVPN on was only getting like 28Mb/s download through the router.

But when I used the app on my PC I would get near full speed of my internet connection. They told me it's because my old router is to weak to run a VPN that's why it's so slow.

But now this PFSense is running well into the hundreds. I have a 500Mb/s download and I'm getting like 400Mb/s. The machine it's running on cost me $55.

Anyway I've done some more test it seems that my DSN is showing up where I place my VPN location. So I think it's working as is.

I think my problems has been resolved. Thank you for all your help. ☺

Now I'm going to watch some youtube to learn more about this program.

@sxefadim Anybody?

@thomalv
Add a rule to the WAN2 interface tab to allow access to the OpenVPN server, state a unique description and ensure, that it is applied to the incoming traffic to the server.

Remove floating pass rules or pass rules on interface group tabs, which may match the OpenVPN traffic, if any.
For connections passed by these rules, the reply-to isn't set. But it's required to send reply packets back to the correct gateway.

Note that floating quick rules and interface group rules have precedence over member interface rules. So you have to ensure, that none of these match the VPN traffic.