This mysteriously started working.  The only thing I can think of is that I a reboot of my Ubuntu Laptop or pfSense server fixed the issue.

Fair enough.  Like I said, though, I am literally the only person who has access to this VPN.  Thanks, I think I will figure out how to secure access from the VPN subnet just to be safe, and remove the NAT rule…

It worked! Thank you for your patience! I didn't even think to change the "LAN" part of that config. I was kind of assuming that once you're VPN'd in, you're part of the LAN.

ah yes… I have later forgot/overseen the 1st change which calls the update routine... --- /usr/local/www/system_crlmanager.php.orig 2013-04-12 16:31:46.000000000 +0200 +++ /usr/local/www/system_crlmanager.php 2013-11-29 23:21:22.000000000 +0100 @@ -107,6 +107,7 @@ } if ($act == "exp") { + crl_update($thiscrl); $exp_name = urlencode("{$thiscrl['descr']}.crl"); $exp_data = base64_decode($thiscrl['text']); $exp_size = strlen($exp_data); @@ -580,11 +581,9 @@ - [" alt="" width="17" height="17" border="0" />](system_crlmanager.php?act=exp&id=<?=$tmpcrl['refid'];?>) - [" alt="" width="17" height="17" border="0" />](system_crlmanager.php?act=edit&id=<?=$tmpcrl['refid'];?>)

Unless you instruct OpenVPN to push a default gateway, only the network you specify when you setup the tunnel will be accessible through the VPN. Since I'm with XS4all I have WebTV and native IPv6. So I'm pushing routes to the webtv network in addition to the local network. All other traffic remains outside the tunnel. Since you want to send all traffic through the tunnel you have to push a IPv4 default gsteway. You can do this in the tunnel setup. To have IPv6 everywhere I push a IPv6 default gateway always. But as you do not have IPv6, don't worry about it. The only thing you have to do on the PFS box is to make sure that all traffic is forwarded through the other OpenVPN tunnel. In my ignorence I assumed it was an IPsec tunnel. As said, with an Atom processor without HW encryption I get 60Mbps.

Completely reinstalled pfSense and what do you know?  It's working. Hypotheses: Corruption of original installation and/or Using older version of OpenVPN Client Export pacakge and/or Some other installed package caused a problem (have installed this fairly lean on this occasion). Thanks to all for your help.  I'm going to snapshot this virtual machine while it's working!!!

Not sure, was thinking would of been nice, but if it really doesn't offer anything over self signed certs, then no reason for me to do it! I have been revising my network and consolidating all admin tools under a domain and using https on everything and so thought why not use the cert on VPN since i have it. I clearly have had the "headache" part of it so far! Appreciate the response.

You have always been able to run OpenVPN and IPsec at the same time. Just not for conflicting networks. You can run them both to different places, but you can't have them both cover the exact same route/subnets on both ends of a tunnel. OK: x.x.a.0/24 to x.x.b.0/24 - OpenVPN x.x.a.0/24 to x.x.c.0/24 - IPsec Not OK: x.x.a.0/24 to x.x.b.0/24 - OpenVPN x.x.a.0/24 to x.x.b.0/24 - IPsec

The only port forwarding rule I have is to make pfsense available to WAN. OpenVPN in pfsense is not configured at my apartment. What info do you want? Thanks.