I'm sorry. You probably need to ask your question in the forum for your native language in your native language.

Hi My script is correctly editing config.xml and client1.conf OpenVPN is restarted and it appears to connect to the new server, but the GUI still shows the old host address and after a minute or so the VPN appears to be connected back to the old host. Can this be done? Thanks

Just use a pfSense instance somewhere on your network to manage your certs ;-) Though it's not perfectly suited to being a general purpose CA, it sure beats having to mess with EasyRSA. And on 2.4 you can sign CSRs as well as create certificates.

Current is 2.3.4_p1 I would assume it would be using the the same version as 2.4 betas [2.4.0-BETA][root@pfsense.local.lan]/root: openvpn –version OpenVPN 2.4.3 amd64-portbld-freebsd11.0 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jun 21 2017 library versions: OpenSSL 1.0.2k-freebsd  26 Jan 2017, LZO 2.10

You've to tell the site-to-site vpn to route the responses to the vpn clients back over the site-to-site. To do this, add the clients tunnel network to the "remote networks" in the site B settings.

here are more logs. those two clients are nat behind ISP Router which ports are still open Aug 18 16:13:52 openvpn[18274]: MANAGEMENT: Client disconnected Aug 18 16:13:52 openvpn[18274]: MANAGEMENT: CMD 'quit' Aug 18 16:13:52 openvpn[18274]: MANAGEMENT: CMD 'status 2' Aug 18 16:13:52 openvpn[18274]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock i see them on the server Firewall on the block side.

The problem was solved by rebooting the client.. so I would guess the OpenVPN client is bad. Or could it be some issue on the server side? I mean, the client IP stays the same.. I don't know if anything would survive on the server side, in this case I rebooted the server, and it reconnected on the same IP and opened VPN access again.

@johnpoz: "I NATed local IPv6" So you have not /64 segments and natted - wow what a BORKED setup! you don't need all that shit… You just need to add the ipv6 to your ipv4 tunnel.. yes, i have do that, but not work for me.

I forgot to add the link to the instructions I used for the Multi-VPN WAN as he/she puts it. I used the guide for my general sedtup and customized it a bit, substituting NordVPN's client setup for AirVPN's. https://nguvu.org/pfsense/pfsense-multi-vpn-wan/ I am thinking perhaps I should have put this in the General Section to get more views and perhaps help with the gateway aspect. I would be happy here with a start of how to just reset openVPN's setup to default. Looking into perhaps deleting OpenVPN completely and reinstalling. Might make things worse though.

Thanks Jimp! It was the last one on your list of things to check. Different CA for the OpenVPN server and user certificates User doesn't exist in the user manager *** User certificate is not listed on the user in the user manager**

I fixed it by downgrading the OpenVPN version on the client side (AWS EC2 instance). $ yum list openvpn Loaded plugins: priorities, update-motd, upgrade-helper 1023 packages excluded due to repository priority protections Installed Packages openvpn.x86_64                                                                2.3.14-1.el6                                                                      installed Available Packages openvpn.x86_64                                                                2.4.3-1.19.amzn1                                                                  amzn-updates Seems like AWS updates my AMI images at launch… I never did a yum update. Is this fix a big security issue? Will it all work out if I update my present main Netgate pfSense AWS instance to 2.3.4?  Will it generate the roght configs to work with OpenVPN 2..4.3 ? Thank you, JP