I’ve been tooling around with this for a few days now and I think I stumbled into a couple pretty useful things.
1.) having multiple VPN destinations with proton (because proton wont just load balance you to country specific plus servers):
If you already have a working openvpn config you can go to the custom options and add this to it at the bottom:
remote x.x.x.x 1194; remote y.y.y.y 1194; remote-random;
where x.x.x.x and y.y.y.y are different proton VPN IPs or DNS names. I picked plus servers because for some reason proton doesnt have us-plus.protonvpn.com or any country based DNS entry that just does that for you.
I was manually changing VPN IPs when each one would go down for maintenance and that got old quick.
2.) Split DNS
Maybe you want to have your firewall do DNS lookups for VPN tunnel establishment and then have your clients route their DNS through the tunnel to 10.8.8.1 to stream BUT you need your pfsense box to be the DNS option because you have a host override entry for local resolution of a public DNS entry (nextcloud would be a prime example).
System > General Setup add your external DNS servers here (1.1.1.2 and 1.0.0.2 for me). Check box for Disable DNS forwarder and uncheck DNS server Override
Then go to Services > DNS Resolver
Enable DNS resolver
For outgoing Network interfaces you will want your VPN interface
probably uncheck Use SSL/TLS for outgoing DNS Queries but this will depend on your DNS server you are putting in there
In custom options (if you are using UDP:
server: forward-zone: name: “.” forward-addr: 10.8.8.1@53
Hopefully that made sense and is useful to at least one person out there and you don’t need to struggle like I did. Or maybe everyone here is a pfsense guru and i’m just repeating the obvious.