@romanvekil said in pfSense OpenVPN on VPS client not access internet:

here wireshark listening vpn interface form pc when connected

Would like to know if you can see these packets on pfSense OpenVPN interface likewise. I suspect, you can't.
In this case, I'd recommend to tear down the OpenVPN server and start from scratch.
Have read some threads here in the past, where people complaining similar issues and never got it working.

@benjaminbeckcsl
Ohne Konfiguration ist das echt schwer

@anthoinn Problem resolved just need to put correct subnets on server side

@nick-loenders
Yes, this simply adds the proper route on the client to go over the VPN gateway.

@3lmar It turned out it was a totally different problem.
The solution is somehow related to pfsense, because I would not have found it without pfsense's package capture.
My windows 10 notebook on the OpenVPN was trying to connect via port 80, which seemed strange. I learned it did that, because the share wasn't on the same subnet.
The solution was to disable NetBIOS over TCP/IP: https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/direct-hosting-of-smb-over-tcpip

Sorry for having disturbed you.
Maybe this helps anybody else, who like me wouldn't expect a problem with windows pcs connecting to windows pcs.
I should have stayed with linux.

@viragomann Ok i got it working.
It took some cleaning up after previous attempts and I wouldn't make it work if it wasn't for you info.
Thanks

(L'adresse 20.0.0.1 n'est pas privée : ce n'est pas recommandé !)

Je ne comprends pas que vous ayez utilisé le MEME réseau pour le VPN site-à-site et le VPN roadwarrior ! Ce réglage ne peut que perturber le pfSense !

Il faut

configurer des réseaux différents pour le client OpenVPN et le serveur OpenVPN, en sus, pour les clients roadwarrior, il faudra ajouter une route (push route) pour qu'il atteigne le site Bureau.

@johnnyfive Yeah this is the problem - what a shame. It would be really great to have full acceleration using QuickAssist!

Somebody please?

@mainzelman Thanks for the reply.

Site B IPSec firewall rules were empty (I assumed this to be ok because Site A and Site B hosts can talk no problems)

I added the rule for Site B and it appears to be now working!
dd6e54f6-fa74-4b38-bf03-a8b3e6c04ec9-image.png

I knew it had to be something simple I missed, thank you!

Do you see it being routed in packet captures or the state table when you try to reach 1.1.1.1?

Where does it fail?

@viragomann thank you for the suggestion, I am gonna give it a try, we should fix the issue by having the remote endpoint add a phase 2 for the openvpn subnet but in the meantime this should fix it as well.

Thank you very much! Your solution fixed my problem! I missed to add the tunnel network to the remote networks on site B.

IMO it's impossible to tell active directory domain member to not look for dns record of domain name.