OpenVPN routing issue after upgrading from 2.0.3 to 2.1

[leonardo.horovitz]

Hi everyone. I have a strange routing issue.
I had a 2.0.3 setup working perfectly until I upgraded to 2.1.
The update procedure was a backup, a clean install, and loading the backup.

The setup is:

WAN: (internet public IP)
LAN: 10.0.2.0/24
OpenVPN server: 10.0.101.0/24

On another location I have a OpenVPN client (over internet). The client is a mikrotik router that is not doing NAT (it is routing), and its "LAN" network is 10.0.20.0/24.

The OpenVPN server has a "route 10.0.20.0 255.255.255.0" under advanced configuration.

The problem is I can no longer access the "LAN" on the router since I upgraded.
This used to work perfectly under 2.0.3 but it doesn't work under 2.1.

The VPN is working since I have connectivity with the mikrotik (10.0.101.6).

Am I missing something? Is this a bug?

[phil.davis]

Do you have other policy-routing rules on LAN that pass "destination any" traffic out WAN, WAN2 etc?
From memory, 2.0.n generated rules in front of those to pass "intranet private" traffic to "default" gateway (the routing table), from where it would be routed across the OpenVPN…
This no longer happens in 2.1 (I guess it is more secure for pfSense to NOT write any "hidden" pass rules for you)
You might need to put a pass rule on LAN, above any policy-routing rules, to pass traffic from LAN to the OpenVPN tunnel subnet and remote subnet at the other end. Then that traffic will pass to the ordinary routing table, rather than being pushed out the WAN by a policy-routing rule.