HA OpenVPN - Can't reach secondary node

[Elegant]

Hi all,

I'm having issues reaching my slave/secondary node on VPN clients. I found the article titled Troubleshooting VPN Connectivity to a High Availability Secondary Node and proceeded to add the entry as a Manual Outbound NAT:

Interface: LAN
Source: 10.4.10.0/24 (VPN subnet)
Destination: OpenVPNCARP
DestinationPort: *
NATAddress: LAN address
NATPort: *

OpenVPNCARP (alias):
10.0.100.2 (primary)
10.0.100.3 (secondary)

LAN Network: 10.0.100.0/24

I can easily access the WebUI on the primary but cannot even ping the secondary let alone access its WebUI. Is there something I'm missing? Thanks!

[Derelict]

Th destination should be the address you are trying to reach. This solution works.

[Elegant]

The address is the destination I'm trying to reach but somehow any VPN clients on the VPN subnet cannot reach the secondary at 10.0.100.3. My OpenVPN interface has an allow all rule as well which should allow me to reach it yet I never can on any device.

[Derelict]

Yeah. Because the only firewall that has a route back to the VPN clients is the primary that is hosting the VPN server.

https://docs.netgate.com/pfsense/en/latest/highavailability/troubleshooting-vpn-connectivity-to-a-high-availability-secondary-node.html

That solution works.