Site to site openvpn using extra hardware (separate gateway)

[Gop Tun]

Hi guys,

I need to set up openvpn between two sites using separate gateways (not running on the routers themselves). Both sites have working pfsense installations, and I have two atom-based itx computers to get the openvpn client/server set up. Question is, how do I set them up to speak to the main pfsense router on each site?

Idea is to do something like this

Site A Secure clients –--> openvpn gateway -----> pfsense router-----> Internet <–---- pfsense router <----- site b openvpn gateway <----- Site B secure clients
While still allowing non-secure clients on both sites to get on the internet like normal.

I already know how to set up a standard openvpn instance, it's more the IP configs, static routes and outbound nat i need help figuring out.