It’s took me two weeks to get a working Connection in my sg 2220 and I literally just deleted my backup files.. I tried to different trials if Nordvpn and both tries could not get acceptable speeds so I canceled If you get this working I’d love to hear it… at 3 different facilities using various devices and operating systems I could not get a 20Mb download on at least a 100Mb internet Connection Totally unacceptable

Thanks, this helped me to understand, that key should be entered in the certificates section along with client certificate. This means that my problem is different. OpenVPN log says that (from bottom to top):     Exiting due to fatal error     FreeBSD ifconfig failed: external program exited with error status: 1     /sbin/ifconfig ovpnc5 10.11.0.34 netmask 255.255.255.0 mtu 1500 up     do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0     TUN/TAP device /dev/tap5 opened     TUN/TAP device ovpnc5 exists previously, keep at program end     OPTIONS IMPORT: route-related options modified     OPTIONS IMPORT: --ifconfig/up options modified     OPTIONS IMPORT: timers and/or timeouts modified     Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])     PUSH: Received control message: 'PUSH_REPLY,route 10.10.0.0 255.255.255.0,route-gateway 10.11.0.1,ping 10,ping-restart 120,ifconfig 10.11.0.34 255.255.255.0'     SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)     [server] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:1194 as far as I understood, server pushes ifconfig command, which fails. When I try to execute it manually, it also fails     >/sbin/ifconfig ovpnc5 10.11.0.34 netmask 255.255.255.0     ifconfig: ioctl (SIOCAIFADDR): Destination address required does this mean that server sends command with incorrect FreeBSD syntax? Or this incorrect syntax comes from OpenVPN? How to configure OpenVPN client to ignore such commands?

I found the setting in the Sierra Wireless RV50 OpenVPN Tunnel settings. There is a setting called NAT, which I had to set to disable. After I disabled it, the SNAT was removed and the true source IPs are now visible. Thanks.

According to this video https://www.youtube.com/watch?v=ov-xddVpxhc You can use firewall rules to exclude the hosts that you dont want to go through the vpn tunnel. So if you set static ip's for the hosts that use the vpn tunnel an make a firewall alias for the dhcp range and use this alias in a firewall rule which will pass the vpn tunnel and to go through the wan Wouldn't that work?

Jimp can you take a quick look at my other theard, basiclly the same issue but I noticed a change in routing table that effects my other vlans. i'm trying to understand what can cause the change in routing table. The "static" part is removed when openvpn dies, after it reconnects it's not replaced. I'm giving up on UDP for the moment, but i made more comments about that in the other thread. https://forum.pfsense.org/index.php?topic=145237.0 Before OpenVPN connection dies Destination        Gateway            Flags    Netif Expire default            10.75.1.2          UGS      pppoe0 PUBLIC-IP.static link#13            UHS        lo0 After OpenVPN connection dies. Destination        Gateway            Flags    Netif Expire default            10.75.1.2          UGS      pppoe0 PUBLIC-IP        link#13            UHS        lo0

Not a pfSense problem. You might want to consult your operating system or OpenVPN support/forums for that. (Viscosity tells me when I am disconnected…) Someone else might know. Personally I think you're overthinking it. I would figure out why your home pfSense is crashing. Mine never does.

I'm also using OpenVPN Connect 1.2.9 build 0 (iOS 64-bit) and there's no problem like that.

For anyone who stumbles across this thread, the solution was to add the OpenVPN connection as a Interface on the client side. After creating the interface, restart the OpenVPN service and add allow firewall  rules for the interface. For OSPF to work, you need to add the interface on both ends. It's also advised to remove/disable the default OpenVPN rules as they'll supersede the interface rules if matched first.

facepalm That was it! I added the rules to the Firewall and now does everything work as expected. Thanks for the right pointer  :)

Check the client log and post it here. Also look if there are entries in the server log.

You'd add that on your AD setup, not on pfSense. Look into AD-based multi-factor auth.

Do you have an example? Our configuration on six boxes started on pfSense 2.3.4 and i upgraded it to 2.4.2_p1 on all of them. I did not have to change anything on our OpenVPN configurations so far.

simples thanks very much, all sorted  :)

Can someone help  :'(

Looking for a solution  :'(

I have successfully set up 4 site with independent connections between each other (see attached).  

If you want all ethernet ports to have the VPN then it should do that by default.