PfSense and MikroTik site-to-site OpenVPN

  • Hello everyone,
    I'm trying to use pfSense 2.2.4 as a gateway and OpenVPN server in main office and MikroTik as a gateway and OpenVPN client in remote office.
    Network in main office
    Network in remote office
    Tunnel network

    I have fresh pfSense with default configuration and OpenVpn server in Peer to Peer with ssl/tls mode with configured Client Specific Overrides for remote MikroTik.
    OpenVpn tunnel is established but I cannot ping any hosts on the other end of tunnel.
    When I try to run traceroute it stucks on first hope.

    This is my server config:

    dev ovpns1
    verb 11
    dev-type tun
    dev-node /dev/tun1
    writepid /var/run/
    #user nobody
    #group nobody
    script-security 3
    keepalive 10 60
    proto tcp-server
    cipher AES-128-CBC
    auth SHA1
    up /usr/local/sbin/ovpn-linkup
    down /usr/local/sbin/ovpn-linkdown
    client-config-dir /var/etc/openvpn-csc
    tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'GW01+OpenVPN+Server' 1 "
    lport 1194
    management /var/etc/openvpn/server1.sock unix
    max-clients 20
    push "route"
    ca /var/etc/openvpn/
    cert /var/etc/openvpn/server1.cert
    key /var/etc/openvpn/server1.key
    dh /etc/dh-parameters.2048
    comp-lzo no

    This is Client Specific Override configuration file:


    I see pushed routes on MikroTik but any of them does not work.
    When I try to connect that MikroTik to other OpenVpn server based on Debian everything works and I can ping any hosts on any sides of tunnel, so I think that I have missed something in pfSense configuration.

    Any ideas why it's not working?

    Many thanks in advance.

    ![OpenVpn server.PNG](/public/imported_attachments/1/OpenVpn server.PNG)
    ![OpenVpn server.PNG_thumb](/public/imported_attachments/1/OpenVpn server.PNG_thumb)
    ![Client Specific Override.PNG](/public/imported_attachments/1/Client Specific Override.PNG)
    ![Client Specific Override.PNG_thumb](/public/imported_attachments/1/Client Specific Override.PNG_thumb)

    ![OpenVPN status.PNG](/public/imported_attachments/1/OpenVPN status.PNG)
    ![OpenVPN status.PNG_thumb](/public/imported_attachments/1/OpenVPN status.PNG_thumb)
    ![Routing Table.PNG](/public/imported_attachments/1/Routing Table.PNG)
    ![Routing Table.PNG_thumb](/public/imported_attachments/1/Routing Table.PNG_thumb)

  • MikroTik routing table

    ![MikroTik Routing Table.JPG](/public/imported_attachments/1/MikroTik Routing Table.JPG)
    ![MikroTik Routing Table.JPG_thumb](/public/imported_attachments/1/MikroTik Routing Table.JPG_thumb)

  • Hello Taras,

    Could you please provide for me some how-to-document?
    I am completely lost How did you achieved site to site between pfsense and mikrotik.

    I am trying to do the same but without any luck.
    I was following this guide

    But after that I am a bit lost.. I don't know what to do…

    Thank you in advance!

  • Hi taras seems like the routing table on the pfsense is trying to send traffic to  as the routing table is showing ( last line ) but your endpoint client is receiving the ip address , maybe that is the problem.

    this is the tunnel ip interfaces.
    ifconfig -> real

    maybe the 20 max client setup is the cause. If the setup is ptp maybe changing this field may help. or try to force the ip of the vpn client to

    Mikrotik is receiving the ip address and sending traffic to that is OK , but the ip is not Ok.


  • Hello,

    the MikroTik OpenVPN isn´t supporting the full features and options from the OpenVPN it self!
    MikroTik RouterOS is only supporting OpenVPN with TCP but not UDP! This could be the hint
    in this game, as I see it right.

    I really don´t know where, but there is an option to set up "use TCP only" that must be chosen.

  • Tunnnel is up , no traffic between sites. I think is a  routing issue.

  • Tunnnel is up ,

    TCP only?

  • Why not ?

    I have 8 remote mikrotik routers with tcp tunnel , no problem.

  • Hi everyone.

    acriollo can you help me setting up an OpenVPN Server in pfsense and a Mikrotik OpenVPN Client?

    I can't get mine working…

    Thanks in advance.

Log in to reply