first, try openvpn because that is well established and wire guard is new. the ProtonVPN service website should have setup instructions and OpenVPN config files that you can use.

@gertjan this fixed issue for me

Updating the linker file manually fixed it for me. Run: ``` kldxref /boot/kernel

on both SG-3100

restarted OpenVPN service on both router

Thanks for quick reply.

@prunch

I don't understand the question.
You think the connection to your LAN isn't safe ?

@gertjan awesome, it worked.
thank you very much for your knowledge, clear instructions, and patience. hope you have a great day.
also thank you @chpalmer @viragomann for helping out

@nospam
Maybe this helps: https://redmine.pfsense.org/issues/13424

Solved!
Followed a lot of rabbit holes down until I found these:
https://serverfault.com/questions/1064935/openvpn-server-connexion-ok-but-no-access-to-remote-lan

which lead to:
https://openvpn.net/community-resources/how-to/#expanding-the-scope-of-the-vpn-to-include-additional-machines-on-either-the-client-or-server-subnet

Main take away was that I needed to add

push "route [Local LAN subnet] 255.255.255.0"

to the advanced configuration on the server setup.
Still reading a bit more to understand how this worked, but I'm able to ping my local machine as well as remote into it.

Happy days.

@rcoleman-netgate Hello Sir,
Yes, i make some trial and error and i notice that the issue comes when i let pfsense generate the shared key !

While i use another vpn instance already existing with copy , and edit the settings, is working !
Also this is happening on the client side ! both pfsense on 2.6 version.

Is this a bug or i'm doing something wrong ? I just exchanging the generated key with copy paste. If generated on server, client is not accepting it and cause this error. If key generated on client, and copy to server, server gets the error !

I will try 2-3 things and let you know.

@johnpoz Thanks, John, I'll give that a try.

In the mean time, I am trying to get a site-to-site VPN established between two Netgate boxes (one with a dynamic ip address) but I'm not having much success :-( The VPN connects but no traffic flows through it yet...

Actually do not know, still analyzing, that's the setting I changed and it seems to be stable now, cross-client (windows, linux, android, ...).
Also changed the DNS servers to both VPN network x.x.x.1 and vlans CARP IPs (the vlans reachable throguh VPN), to be HA proficient.

Do not know why I do need the DNS entries to reach other IPs in the remote networks (not hostnames, just IPs...).

Thank you very much!

I fixed the problem.

The firewall died during the night from friday to saturday, so naturally I needed to build a new one on sunday.

After a clean reinstall, I again started having the same error
openvpn xxxxx IP packet with unknown IP version=15 seen
Endlessly filling the logs, and killing the SSD-s.

It seems the ntopng is the culprit.
After disabling ntopng, the errors stopped. And after enabling ntopng, the errors started again, even when there are no clients connected, and the errors start and stop at random intervals.

I am currently testing running ntopng but without OpenVPN interfaces selected.
For now it seems to be working as expected.

So it seems running ntopng with OpenVPN interfaces selected causes the OpenVPN server to have endless errors, even when everything else is working fine.

Now I am waiting for monday so we have some user traffic, but judging by the short test I am currently conducting, it should work.
Hope this helps someone with a similar problem.

@vusqq Well normally if you have a openvpn client installed on your client box.. When you click on a ovpn file it will ask if you want to import it into openvpn

example.jpg

Not sure with macs, but for example here is a ovpn file I downloaded from pfsense with the export section under pfsense, and when I click on it windows, the openvpn software I have installed on my windows machine asks if I want to import it.

@orangehand where exactly are you pinging from.. 169.1 would be pfsense lan IP on the remote end.. There wouldn't be any different with your routing, or normally firewall on the 69.x device.

10.0.69.16 -- 69.1 pfsenseA -- vpn tunnel --- pfsenseB 169.1 -- 10.0.169.x

If you ping 69.16 from 169.1 interface on pfsenseB, it should work from 169.x unless 169.x is not using pfsenseB as its gateway. Or you doing some sort of policy routing on your 169.1 interface, or you have some firewall rule blocking access to this remote network?

@johnpoz Ah understood if going down VPN will lost my inet but if reset to default ISP gateway now and use in this way, during VPN problem on upstream VPN servers. My inet will exist with DNS resolver settings above? Second question: with default ISP gateway will this less privacy? Should I create for every other VPN location new VPN client in pfsense or exist way to combine a few locations in one settings? I mean to choose different locations like in VPN client on PC.

@antibiotic
Don't know, whats the suppose of your "local subnets" alias.
At the moment the default allow rule would pass any traffic with different source than "local subnets".

A different source could be the case if you have a router within your local network like a VPN endpoint, which passes traffic trough.
But where will it get to? Since you obviously have a single LAN subnet, which might be included in the local subnets alias, the traffic could be go to the WAN or VPN at its best, but would fail then, since it is not natted (Outbound NAT source).

@troubleshooting74

865e91ae-2931-4faf-a302-c24e1724e58a-image.png

User : auser
Password (twice) auser
I made this user member of the OpenVPN group
Checked : Certicate, gave it a description 'auser'

And save.

This user called 'auser' is now usable on the VPN Client Export page.

If not, it's time to explain your setup.

@gwaitsi said in Express VPN Received control message: AUTH_FAILED:

unable to get certificate CR

CRL missing, or not accessible, isn't a big deal in this case.
See for example unable to get certificate crl

If something happens to the certificate emitted by expressvpn, they would remove it message or warning, and force you to update your connection settings.
There is no such thing as : expressvpn let you use their generated certs, but starts to list them on a revocation list. That not needed in this usage case.
I've these same two warnings.