@viragomann: There's no need for advanced options to pushing routes. This is done by "Local Networks" option. The idea to put a route  in server advance config comes from this guide. It makes the difference, without that route I cannot access internal subnet with the user who has client specific overrides. The client configuration was ok since the beginning, a route print from windows command line shows it knows how to reach 192.168.1.0/24, the IPv4 Local network of the client specific override. Don't know how to check the routes on firewall: it can reach 192.168.5.0/28, the Ipv4 tunnel network configured with OpenVpn server, but I suspect it has no route to 192.168.6.0/28, Ipv4 tunnel network of the client specific override. Adding that route manually traffic flows as expected.

The pfSense Book is now available for just $24.70! vvv

Thanks, but it seems it's "generate, then package" approach, e.g. same file. Anyway, the main purpose of this post was to understand if it was a pfSense issue or not. Believe the answer is "yes". One possible explanation for the different behavior over time is "fix and re-introduce" has happened. Appreciate the link from the bug database and the guidance provided.

I tried other TCP ports and same results….I see the firewall passing the traffic UDP is working as it should...same server config..just different protocols. Can anyone just confirm they have 2.3.4 routing traffic using OpenVPN TCP? (this is a clean install just done...no upgrade from older versions) Need to make sure before the rest of my hair falls out..  :) thx

Not sure why images are not showing but if you right click and open in new page the links seem to be fine.

did you get tgis to work? im doing it slightly different. got A <ipsec>B <openvpn pki="">C and trying to access A from C. Added the P2 on A and B and pushed the routes on C and still can't get this to work. If you do let me know. Thanks</openvpn></ipsec>

The "bridge fix" package has not been necessary in many, many years. The changes added by the patch are included in any current version (or even somewhat older versions).

@Derelict: Something like this? https://www.infotechwerx.com/blog/Creating-pfSense-Connection-VPNBook This looks very interesting. I have some reading to do. Thx.

This is now working. Looks like it needed a reboot after I'd created the interface. Now to try and work out how to rotate the servers..

What I use as a kill switch is a firewall rule that blocks all traffic on the WAN interface.

Will do, thank you. I think I know what I am looking for. Can you give me an idea of what diagnostic to use to see what is happening or where that routing issue might be corrected? I'm not a newbie but I'm no where near a power user yet. Thanks.

Are the users sharing the users certificate? Each user should have a unique cert. If you want them to share the cert check "Duplicate Connection" in the server settings.

I switched to Shard Secret mode and now it's working just fine.