Создаем ключи PKCS12 для филиалов.

Переходим в директорию и создаем ключи для филиалов №1 и №2: filial1.p12, filial2.p12.
pkcs12 имя файла в формате PKCS#12, содержащего сертификат CA, ключ и сертификат клиента.
Такой файл и команда заменяют сразу 3 соответствующих файла и команды - .ca, .cert, .key

#cd /usr/local/share/doc/openvpn/easy-rsa/2.0/
#sh

Эту команду нужно запускать при следующем создании, новых ключей.

#. ./vars
NOTE: when you run ./clean-all, I will be doing a rm -rf on 
/usr/local/share/doc/openvpn/easy-rsa/2.0/keys/server

Создаем ключ для филиала №1

# ./build-key-pkcs12 filial1
Generating a 1024 bit RSA private key
................................++++++
...........................................++++++
writing new private key to 'filial1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:UZ
State or Province Name (full name) [CA]:Navoi
Locality Name (eg, city) [SanFrancisco]:Navoi
Organization Name (eg, company) [Fort-Funston]:server
Organizational Unit Name (eg, section) []:server
Common Name (eg, your name or your server's hostname) [filial1]:
Name []:filial1
Email Address [me@myhost.mydomain]:filial1@localhost

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:filial1
Using configuration from /usr/local/share/doc/openvpn/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'UZ'
stateOrProvinceName   :PRINTABLE:'Navoi'
localityName          :PRINTABLE:'Navoi'
organizationName      :PRINTABLE:'server'
organizationalUnitName:PRINTABLE:'server'
commonName            :PRINTABLE:'filial1'
name                  :PRINTABLE:'filial1'
emailAddress          :IA5STRING:'filial1@localhost'
Certificate is to be certified until Sep  6 19:20:11 2020 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Enter Export Password:
Verifying - Enter Export Password:
#

Создаем ключ для Филиала №2

# ./build-key-pkcs12 filial2
Generating a 1024 bit RSA private key
................................++++++
...........................................++++++
writing new private key to 'filial2.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:UZ
State or Province Name (full name) [CA]:Navoi
Locality Name (eg, city) [SanFrancisco]:Navoi
Organization Name (eg, company) [Fort-Funston]:server
Organizational Unit Name (eg, section) []:server
Common Name (eg, your name or your server's hostname) [filial2]:
Name []:filial2
Email Address [me@myhost.mydomain]:filial2@localhost

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:filial2
Using configuration from /usr/local/share/doc/openvpn/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'UZ'
stateOrProvinceName   :PRINTABLE:'Navoi'
localityName          :PRINTABLE:'Navoi'
organizationName      :PRINTABLE:'server'
organizationalUnitName:PRINTABLE:'server'
commonName            :PRINTABLE:'filial2'
name                  :PRINTABLE:'filial2'
emailAddress          :IA5STRING:'filial2@localhost'
Certificate is to be certified until Sep  6 19:21:14 2020 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Enter Export Password:
Verifying - Enter Export Password:
#

Создаем ключ для cистемного администратора

# ./build-key-pkcs12 sysadmin
Generating a 1024 bit RSA private key
................................++++++
...........................................++++++
writing new private key to 'sysadmin.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:UZ
State or Province Name (full name) [CA]:Navoi
Locality Name (eg, city) [SanFrancisco]:Navoi
Organization Name (eg, company) [Fort-Funston]:server
Organizational Unit Name (eg, section) []:server
Common Name (eg, your name or your server's hostname) [sysadmin]:
Name []:sysadmin
Email Address [me@myhost.mydomain]:sysadmin@localhost

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:sysadmin
Using configuration from /usr/local/share/doc/openvpn/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'UZ'
stateOrProvinceName   :PRINTABLE:'Navoi'
localityName          :PRINTABLE:'Navoi'
organizationName      :PRINTABLE:'server'
organizationalUnitName:PRINTABLE:'server'
commonName            :PRINTABLE:'sysadmin'
name                  :PRINTABLE:'sysadmin'
emailAddress          :IA5STRING:'sysadmin@localhost'
Certificate is to be certified until Sep  6 19:27:27 2020 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Enter Export Password:
Verifying - Enter Export Password:
#

#exit

Вот мы и создали 3 ключа для филиалов и 1 для системного администратора

#ls /usr/local/share/doc/openvpn/easy-rsa/2.0/keys/server | grep .p12
filial1.p12
filial2.p12
sysadmin.p12
#

В директории /usr/local/etc/openvpn/ccd создаем файла с настройками для Филиалов и системного администратора

Филиал №1

#ee /usr/local/etc/openvpn/ccd/filial1

С содержанием:
ifconfig-push виртуальный IP клиента,
iroute какая подсеть за клиентом

ifconfig-push 10.10.100.2 10.10.100.1
iroute 192.168.1.0 255.255.255.0

Филиал №2

#ee /usr/local/etc/openvpn/ccd/filial2

С содержанием:
ifconfig-push виртуальный IP клиента,
iroute какая подсеть за клиентом

ifconfig-push 10.10.100.6 10.10.100.5
iroute 192.168.2.0 255.255.255.0

Системный администратор

#ee /usr/local/etc/openvpn/ccd/sysadmin

С содержанием:
ifconfig-push виртуальный IP клиента

ifconfig-push 10.10.100.14 10.10.100.13

Перезапустим OpenVPN Сервер

#/usr/local/etc/rc.d/openvpn restart
Stopping openvpn.
Starting openvpn.
#

Проверим работу OpenVPN

#sockstat | grep 1194
nobody   openvpn    29578 5  udp4   *:1194                *:*
#

#ifconfig tun0

tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
        inet 10.10.100.1 --> 10.10.100.2 netmask 0xffffffff
        Opened by PID 29517

Все нормально работает
Не забываем открыть порт 1194 если вы используете firewall
Для pf правило выглядит так

pass in quick on $ext_if inet proto {udp} from any to self port 1194

Для IPFW

ipfw add allow udp from any to me 1194 via $ext_ip