@johnpoz That's great JP.

Yes the dig command certainly returns a good visual of what's going on under the bonnet :)

I will never look at DNS requests the same way again!

And I am sold on the concept of having pfsense in Resolver Mode rather than Forwarding Mode...

@wizardofwhere I think you have the pfsense plugged into the wrong place. I would have modem, to pfsense wan, pfsense lan to switch, vpn is going to take some work because that also needs wan access. You probably need the linksys plugged into same switch and rules on the pfsense to forward traffic for the vpn.