Musste leider feststellen, dass "meine" Lösung wohl nur eine gewisse Zeit funktioniert. Irgendwann scheint es so, dass Windows den "ersten" DNS-Server nicht mehr nutzt und daher interne Namen nicht mehr auflöst.
Habe daher vorerst auf IPs umgestellt.

Now testing the SG-2100 with 23.05.1 for the similar setup but with multiple Wireguards instead of multiple OpenVPNs.
Unbound starts correctly.
I am guessing that Wireguard is faster than OpenVPN starting at boot.
Thanks again.

Is this just a dupe of your other ticket?
https://forum.netgate.com/topic/160507/pfsense-and-openvpn

IMO it's impossible to tell active directory domain member to not look for dns record of domain name.

@hieroglyph With an established s2s vpn you could connect remotely to the server side of the vpn and access both sites with one connection, concurrently.

But this adds unecessary points of failure. And since these are home networks, you could be better off with two openvn servers listening at each site , and connect to each as needed.
A site to site vpn could also co exist, so you don't have to do anything when at home.

of course you can have it all. S2s, two openvpn listening at both sites, and access to everywhere no matter where you connect.

Happy tweaking.