I again searched the threads and found a lot of stuff, I did not have seen before. So, finally I could manage to route all the traffic through the firewall.
Yes it can.
Take a look at the stickies as there are how-to's on site-to-site and roadwarrior-setups.
In your case you can have multiple site-to-site connections (Shared Key Infrastructure)(multiple instances on the server),
or you have a single server and all clients connect to this one (Public Key Infrastructure).
In the second case you can/need add client-specific commands that automatically add/pushes the right routes.
Copy the files to a safe place. You could copy them carefully into something like KeePass from http://keepass.info where the keys can be stored encrypted.
Well i can confirm Debian box as OpenVPN client to pfsense server has been up solid for over 24 hours now no problem. Link is still solid. This is probably something to do with the client, i will post the client configs tomorrow.
I appreciate what you say about bugs and reporting, i am sure it would have been reported also and maybe this is something i have done wrong but one things for sure i have seen weird stuff like this before like with OpenWRT and netfilter working ok with NAT redirects for 24 hours and then randomly remapping to a different port for no reason!
You might be interrested in this:
http://openvpn.net/index.php/documentation/install.html?start=1
Notes – Firewall on the Windows client
In general, it's a good idea to always protect a VPN client or server with a firewall.
The important points for setting up firewalling on a Windows system running OpenVPN are:
1. Make sure that your connection to the internet is always firewalled, especially when you are running a VPN. VPNs create trusted relationships between geographically disparate networks, and if any network on the VPN is compromised by a virus or worm, the exploit has the potential of jumping across the VPN and infecting other machines.
2. You can enable firewalling on a given network adapter by going to Control Panel -> Network Connections, right-click on the icon that represents your link to the internet, select "Properties", go the the "Advanced" tab, and enable "Internet Connection Firewall".
3. If you are running OpenVPN as a server on a Windows machine, you will need to configure your firewall to allow incoming clients to connect to OpenVPN's port number which is "UDP 1194" by default.
4. In general, running OpenVPN as a client doesn't require any special firewall configuration, provided you use the --ping option to preserve the state of the OpenVPN connection in the firewall.
5. In general, you don't need to enable firewalling on the TAP-Win32 adapter. Once an IP packet appears to be "coming in" on the TAP-Win32 adapter, it has already been decrypted and authenticated by OpenVPN, even though the connection between OpenVPN peers might transit an untrusted network such as the internet.
6. One case where you might want to firewall the TAP-Win32 adapter is if you are connecting to an untrusted machine, or a machine which will route or bridge your connection with an untrusted network.
Make sure you are using unique users for each client. If you login with the same user from another location the old session will be disconnected. It's the same for PPTP for example.
