Figured it out on my own, had to reach the pfSense Book, some googling, and testing on a standalone station. Forum was not much help, honestly.
What I did:
Put a deny all IPv4+6 right above the default OpenVPN allow any any rule
Only permitted the ports needed to allow file sharing and AD authentication (Google them. It should be 135, 137-139, 88, 445, etc. if you have older equipment)
I then made an alias for my client IP, Internal IPs I need to manage, and ports for that management. So ports 3389,22,80,443, etc. It's whatever you need for your situation.
When making new users for other clients I forced them to a single IP within the Client Specific Override and made sure to allow random ports for concurrent connections
Make new users and assign them into groups if they need special access, like IT needs to RDP to a server etc.
DO NOT USE THE SAME USER ACCOUNT FOR ALL CLIENTS, you can do this but it's a liability, hard to manage, and have organized logging. If it's just a few people, I can understand it, but for 50-100? make the users or link to an authentication server
That got me up and going for the most part, I had to work with legacy VMWare, so I had to reinvent the wheel with some of the virtual networking/bridging.
TIP:
Read the pfSense Book first for any questions you have
Understand the rule processing order
Group interface rules are in a higher order than your interface rules, so filter the group first, the interface LAN should be filtered afterwards to follow suit.
This is just what I did to fix my problem, I've found decent guides with these links and this documentation... (see below)
https://docs.netgate.com/manuals/pfsense/en/latest/the-pfsense-book.pdf
https://chrislazari.com/pfsense-setting-up-openvpn-on-pfsense-2-4/
https://www.informaticar.net/openvpn-on-pfsense-enable-access-to-the-lan-resources/
keep in mind that the last two links do not highlight security after making it work, that's what the pfSense book is there to provide. Read page 172 and finish that chapter to understand it. Then, like I said, test it yourself and verify your rules work. I wasn't able to find a direct answer for my question and struggles, so I'm hoping this helps someone too. I've attached pictures too because maybe I'm wrong and there's a better way to do it.
[image: 1596549869660-filteredopenvpngroup.png]
If this is wrong, feel free to correct me and give me a better solution.
Thanks
