It works fine, I run some systems that have a half dozen or so of each. As long as they don't have settings that directly conflict (e.g. same tunnel network or they are both trying to use the same local port) it should be fine. What errors do you get in the OpenVPN log?

Thank you for the fast reply. Done and working.

Why do you want to use that option in that context? You could simply not enable any options that would put those directives in the config (e.g. don't set redirect-gateway, don't specify any local or remote networks), and then add max-routes and put in all of the directives manually after that.

You'd need to change your DNS such that OpenVPN clients would talk to a DNS server that returns the internal IP address for "foo.org" when they look it up.

Those log messages are harmless, they are the GUI probing the daemon status via the management socket. It is not a VPN client connecting/disconnecting.

But are you not worried that you will be leaking dns from pfsense when it checks for updates and package list, etc. <rolleyes>;)</rolleyes>

An auth error is considered a hard failure by the OpenVPN daemon and it shuts down. Try adding this to the custom options in the client's advanced config: auth-retry nointeract; Service watchdog should also work.

Ok, I've narrowed this down.  It seems the redirect-gateway command is what's preventing IOS from switching from cellular to WiFi when "Cellular Only" is enabled in the OpenVPN settings.  Any thoughts?

any help please

Very true - but the export gui is not designed for that fancy stuff ;)  You would would have to edit the config by hand for that..

@sirbusby: After upgrading to version 2.3.4-p1, static IP clients in openvpn do not work. Earlier I registered in the Custom options ifconfig-pool-persist /var/opvpn/ipstatic.list. The file specified the correspondence of ip adresses. Now after restarting openvpn in the file /var/opvpn/ipstatic.list, ip addresses are overwritten Yes, some trouble were detected in Open VPN connexion.

Its also just screams – person doesn't know what they are doing at all ;) Then that seems to have served my purpose well. I changed my LAN interface to 10.233.233.1/24 and everything is working now! Thanks for the feedback. I'm still trying to wrap my head around how it was a problem but for now I'll have to accept that I'm not as smart as my mom tells me I am.

No, I said to check Don't Pull Routes not Don't Add/Remove Routes. Check Don't pull routes Uncheck Don't Add/Remove Routes

You could always just pass DNS (TCP/UDP on port 53) to This firewall and then block all other TCP/UDP port 53 destinations. If that's really what's important to you.

Thanks - solved my problem as well. I would have thought this was a pretty common configuration.  An easier to find guide for newbies would be helpful.