The connectivity issues were remote users weren't able to log into any of the servers in the LAN.  They got a "server is not available" error.  All these were virtualized on one particular machine.  When trying to log in to the virtual machine itself via either the vSphere client or web client, the connection timed out.  I logged in via OpenVPN and managed to RDP into the DHCP server, then I could use the web client.  (I installed VMWare tools on the machines that didn't have them already and for some reason they had connectivity again.  Still working on why that happened, too.) The servers are now reachable as they were before, but the vSphere client and web client are still nonfunctional from outside the LAN.  I saw the DHCP address and thought that might have been my issue, but I'm guessing that it isn't. Time to figure out just what else could have made this happen.  I appreciate your time, jammcla.

Sorry for the delay in responding.  The remote user malfunctioned and didn't do it right.  Uninstall of client and reinstall solved the problem.

As has been said, you do not need anything in custom options to do what you need to do. Are you trying shared key or SSL/TLS? If shared key you have to duplicate reciprocal routes and tunnel network settings on the client side. You cannot push to the client when using shared key. If SSL/TLS you can push them to the client from the server. If using a tunnel network larger than /30 and are using SSL/TLS you ALSO have to set a Client-Specific Override on the server for the client setting the remote network there.

@johnpoz: What is your link speed? FastEthernet LAN between my pfSense box and my ISP Internet gateway. ADSL WAN link encapsulation IPoE 8000/500 Kbps dl/ul on my Internet gateway

have you figure out the problem can you explain what you have done to get the freenas under openvpn running as i am unable to access my nas under openvpn though i can run my dvr and printer remotely but no way for my nas4free

Is what about what better than what?

Hmm, even with rules that allow everything, still no success..

You referred to an article that referenced setting separate, static addresses. That's what was provided. I do not think there is another way to set another pool in a CSO. I could be wrong. I would just run another server for that.

Hi, Thanks for the reply. You are correct: it does work out of the box. T he probleem seems to be just ONE system (and that happened to be the one I was using as a reference to check if it works) that cannot be reached. I will further investigate the problem with this one system but it is probably not of interest to the community what the problem is so we can close this thread. regards.

I found a solution. Set the IP of your LAN interface to none and set the firewalls IP on the BRIDGE interface itself. I did this by downloading the config, editing the XML and uploading the config again. I tried doing it from the WebUI but accidently broke my network because I couldn't remove and add the IP to to the other interface at the same time. Hope this helps.

Is there any way we can get manual updates to vulnerable packages or are we just expected to wait for the next major/minor release? For a system that sits on the front lines of a LAN, I really would prefer that it's as secure as possible. According to 'pkg audit', I have 4 packages that need patched in pfsense v2.3.4.

Connect the vlan 3 to the vpn connection.

It may have the same cause as the problem at https://forum.pfsense.org/index.php?topic=127274 "Short hostnames not working on 2.3.3" There you have to make a change in the dns forwarder settings to get it working properly after a reboot. It does not matter what you change. It looks like some post-boot trigger is missing somewhere.