Client Export vs an Outbound OpenVPN Instance on pfSense

You install the Client Export package, open it, and the server selector is empty. The natural conclusion is that the package is broken or that pfSense cannot act as a VPN client at all, and both are wrong. The selector is empty because pfSense has no remote-access server configured, and the package was never the tool for making the firewall dial outward in the first place. Two different jobs share a word, and the empty list is the sound of one of them being asked for something it does not do.

Decide who initiates before installing anything

Ask one question: which device starts the connection? If a travelling employee connects into the office firewall, pfSense is the server and the employee's laptop is the client. The package you need in that case prepares material for the laptop, because the laptop is the side that dials.

If pfSense connects out to somebody else's VPN service, the firewall is the client and the remote operator owns the endpoint you dial.

Both situations use the word client, which is where the confusion starts. The word describes a role in one connection, not a product category.

The exporter is a server-side helper

Client Export takes a remote-access server that already exists on pfSense and produces the material a connecting device needs. It reads that server's settings, certificates and tunnel options, then packages them for consumption elsewhere.

That is why the selector lists only servers in Remote Access mode. With no such server there is nothing to export, and the empty list is an accurate report rather than a fault. Create the remote-access server first and the selector fills itself. That ordering trips people up more often than any setting inside the package.

The package reference states the dependency plainly. Read it before you assume the package can create the server for you.

The outbound instance is a separate configuration

Making pfSense a client of another service means creating an OpenVPN client instance with that provider's endpoint, port, protocol, credentials and trust material. Netgate documents that separately from the export package, because it is a different object in the configuration.

Installing the exporter does not populate any of those fields, and no export format will generate them for you. If your provider supplies a profile, you import or transcribe its values into the instance you create.

Keep the two configurations in separate mental boxes. One answers other devices; the other asks another server for a tunnel.

Pick the export format the device can consume

Exports come as inline configurations, bundled archives and installers for specific client applications. Choose by what the receiving device can actually import, not by whichever download looks most complete.

An inline file is convenient for a client that accepts pasted configuration. A bundle carries separate files and suits a client that wants a directory. An installer assumes a particular application is acceptable on that platform, which is a policy decision as much as a technical one. Ask which client the receiving team supports before you download anything.

Some exports contain certificates and private keys, and the password protecting that key material can differ from the user's account password. Deliver the material through the approved enrollment channel rather than pasting a full export into a ticket as a configuration sample.

Site-to-site needs roles and routes, not a package

A branch tunnel is a different design again. Identify which endpoint holds the server role and which holds the client role, then define the routed networks on both sides before configuring anything.

Client Export has no opinion about the branch's routes, forwarding permission or return path, because preparing remote-access client material is its entire job.

Get the roles and the route list written down first, and the package question answers itself. Get them wrong, and no export format saves the design. The same applies to the return path: a branch that can reach the centre and cannot be answered is not a working tunnel.