I got my issue resolved and feel quite relieved - but also kind of embarassed for taking so long to find the problem. In the hope that it might save someone else from digging around for days, here is what I found.
Problem was: private IPs will not be routed. All my 192.168.xx.yy/24 networks are private networks and I force-routed them a little way but could not get them through all the way.
Solution was: set an outgoing NAT rule:
[image: 1582831485259-c274d0d7-6f2c-4f73-8f12-75283e7ab6a9-grafik.png]
Again: router A is the openVPN server, it has subnet 192.168.225.0/24. The above setting is for router B, which has subnet 192.168.245.0/24 for LAN. This permits a host in B's subnet to reach a host in A's subnet. A corresponding NAT rule will be required on A for the opposite direction.
I my case server A will assign an interface address to B, so the NAT address needs to be B's openVPN interface address.
What else did I learn?
For one thing, Apple's version of ping supports some really helpful options:
-A will make a sound for each outgoing packet
-a will make a sound for each incoming response
-f will flood the target with ICMP packets. On an otherwise quiet system, this permitted me to see where my packets were going just by looking at pfSense's traffic graphs on the dashboard.
Another thing is, it took me ages to get to the solution but I feel that all the failures I have been through taught me more than I ever wanted to know Keep working on your problems, eventually you will master them!
