clients behind IPsec VPN

[DaveA66]

Hi
So my forst deployment of pfSense and it' sin AWS.
Requirement is to use pfSense as VPN device to protect machines in a private subnet in AWS

VPN connects fine and I can ping and establish SSH connection to the machine in the private subnet.
However the machine in the private subnet cannot even ping a client machine on the remote subnet and cannot ping anything on the internet (trying 8.8.8.8 to avopid any DNS issues)
The machine in the private subnet cannot even ping the WAN ip of the pfSense.

I have tried everything I can thing of!

So Private subnet 172.31.16.0/20
Client machine on 172.31.25.183
pfSense LAN i/f on 172.31.25.152

Public subnet 172.31.0.0/20
pf sense WAN ip 172.31.5.240

client machine -- PRIVATE sub --- pfsense LAN - pfsense WAN -- PUBLIC sub --- AWS IGW --- internet

I am assuming AWS routing must be OK as I can ping TO the device in the private subnet, so must be a rule / nat error on pfsense?

No sure what I need to post here for additional infor but any help apprecited!!

Thanks

[DaveA66]

This is now sorted! Outbound NAT rules a small step that doesn't seem to be mentioned in the docs