I am desperete to get any advice on this. I am strugling with below problem for the last few days.
I have a following test setup on my VMWARE which soon I need to implement to the production enviroment :

Remote Lan BOX <–------------------------------> NET Cloud <--------------------------------------> PfsenseBOX ver. 1.2.2
OpenBSD 4.4                                                                                                                              Host LAN GW
vic0: 172.16.158.101 /24                                                                                            em0 172.30.2.30/24 WAN
                                                                                                                              em1 172.30.102.0/24 LAN
OpenVPN Logical scheme
tun0: 172.30.200.6 ----> 172.30.200.5 <<-------------LINKED----------------->> 172.30.200.2 <----- 172.30.200.1 tun0

All firewall are currentyl setup to allow all traffic - I will harden it later. From NET Clout both boxes (real nics) are pingable.

All connectivity is provided from Remote LAN Box to Host LAN and all hosts inside Host LAN (172.30.102.0/24) are reachable. However whenever I tried to ping (real address of any of the Remote LAN host - packets are not getting through).

I read that this is more likely config bug with openvpn with dynamic routing tables. I am attaching config below - could someone point me in the right direction what its wrong?

If there is anything else needed beside configs please give a shout.

=== PFSense BOX ====

Openvpn config

cat openvpn_server0.conf

writepid /var/run/openvpn_server0.pid
#user nobody
#group nobody
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
dev tun
proto tcp-server
cipher BF-CBC
up /etc/rc.filter_configure
down /etc/rc.filter_configure
server 172.30.200.0 255.255.255.0
client-config-dir /var/etc/openvpn_csc
push "route 172.30.102.0 255.255.255.0"
lport 1199
push "dhcp-option DOMAIN test.lan"
push "dhcp-option DNS 172.30.102.114"
push "dhcp-option WINS 172.30.102.114"
ca /var/etc/openvpn_server0.ca
cert /var/etc/openvpn_server0.cert
key /var/etc/openvpn_server0.key
dh /var/etc/openvpn_server0.dh
persist-remote-ip
float
local 172.30.3.20
route 172.16.158.0 255.255.255.0

CCD folder options for remote clients (as authentication is made with Certificates)

ls -lart openvpn_csc/

total 6
-rw-r--r--  1 root    nobody    35 Apr 29 11:53 sentry2
drwxr-xr-x  2 nobody  nobody  512 Apr 29 11:53 .
drwxr-xr-x  4 root    wheel  1024 Apr 29 11:57 ..

cat openvpn_csc/sentry2

iroute 172.16.158.0 255.255.255.0

ROUTING TABLES after when OpenVPN sucessfully started

netstat -nr |more

Routing tables

Internet:
Destination                Gateway            Flags    Refs      Use  Netif Expire
default                      192.168.222.254    UGS        0    1679    em0
127.0.0.1                  127.0.0.1              UH          0        0    lo0
172.16.158.0/24        172.30.200.2        UGS        0        3  tun0
172.30.3.0/24            link#2                  UC          0        0    em1
172.30.3.128            00:19:b9:81:9a:ef  UHLW        1    4049    em1  1197
172.30.3.140            00:19:b9:71:17:45  UHLW        1        0    em1  1142
172.30.3.254            00:02:b3:9d:de:b6  UHLW        1    1090    em1  1090
172.30.102.0/24        link#3                  UC          0        0    em2
172.30.102.114          00:0c:29:78:82:a7  UHLW        1    1386    em2  1152
172.30.103.0/24        link#4                    UC          0        0    em3
172.30.103.1            00:50:56:c0:00:02  UHLW        1    1136    em3  1110
172.30.200.0/24        172.30.200.2          UGS        0        0  tun0
172.30.200.2            172.30.200.1          UH          2        0  tun0
192.168.222.0/24      link#1                    UC          0        0    em0
192.168.222.254        00:50:56:e0:7f:de  UHLW        2    1090    em0    924

======== REMOTE LAN BOX (openBSD 4.4) Data After Successfully Connected via OpenVPN==================

Config File

float
port 1199
dev tun0
nobind
proto tcp-client

remote 172.30.3.20 1199

ping 10
persist-tun
persist-key
tls-client
ca /etc/openvpn/TNF_VPN_CA.crt
cert /etc/openvpn/sentry.crt
key /etc/openvpn/sentry.pem
ns-cert-type server
#comp-lzo
pull
verb 3

ROUTING TABLES

default              172.16.158.1                  UGS        1    1427    -    48 vic0
loopback            localhost                        UGRS      0        0 33204    48 lo0
localhost            localhost                        UH        1        0 33204    48 lo0
172.16.158/24      link#1                            UC        2        0    -    48 vic0
172.16.158.1        00:50:56:c0:00:08          UHLc      2      404    -    48 vic0
sentry2              00:0c:2989:7c          UHLc      0        2    -    48 lo0
172.30.102/24      172.30.200.5                  UGS        0        6    -    48 tun0
172.30.200.1        172.30.200.5                  UGHD      1      66    - L  48 tun0
172.30.200.1/32    172.30.200.5                  UGS        1      101    -    48 tun0
172.30.200.5      172.30.200.6                    UH        3        0    -    48 tun0
BASE-ADDRESS.MCAST localhost                  URS        0        0 33204    48 lo0

======== PINGS ===================
Remote -> Pfsense box real NIC 172.30.3.20
Success

Remote -> Virtual Adapter of Remote Box 172.30.200.6
Success

Remote -> Virtual Adapter of PfSense Box 172.30.200.1
Success

Remote -> Any host NATted behind PFsense box 172.30.102.0/24
Success

PFsense -> Remote BOX Real address  172.16.158.101
Fails

PFsense -> Remote BOX Virtual OpenVPN  172.30.200.6
Success

PFSense -> PFSense Virtual OpenVPN 172.30.200.1
Fails

port forwarding is turned on on REMOTE BOX
bash-3.2# cat /etc/sysctl.conf |grep forward
net.inet.ip.forwarding=1        # 1=Permit forwarding (routing) of IPv4 packets
net.inet.ip.mforwarding=1      # 1=Permit forwarding (routing) of IPv4 multicast packets
#net.inet6.ip6.forwarding=1    # 1=Permit forwarding (routing) of IPv6 packets
#net.inet6.ip6.mforwarding=1    # 1=Permit forwarding (routing) of IPv6 multicast packets
#net.inet6.ip6.accept_rtadv=1  # 1=Permit IPv6 autoconf (forwarding must be 0)

NAT and PF Firewall Rules on REMOTE BOX to accept all traffic
bash-3.2# pfctl -s rules
pass out all flags S/SA keep state
pass in all flags S/SA keep state
pass in quick on tun0 all flags S/SA keep state
pass out quick on tun0 all flags S/SA keep state
bash-3.2# pfctl -sn
nat on vic0 inet from ! (vic0) to any -> 172.16.158.101

Now I need to be able to reach any machine on the remote network. Could someone advise what need to be changed to actually get it solved.

Thanks for all help in advance.