Here's a few suggestions:
Use a bridge interface from ESXi for your WAN interface as opposed to PCI passthrough
Use a Broadcom NIC, or an older Intel NIC using the em(4) driver. It may sound weird, but Broadcom NICs may be better for PPPoE.
Bit late to your problem, but I'm currently facing similar issue.
What I've found is that private interface at Hetzner has mtu 1450 as opposite to public interface with mtu 1500.
This is a serious problem with dockers as it's default mtu is 1500.
There is a partial solution but not for docker-compose I'm using
I had "hardware checksum offload" enabled, and it needs to be disabled when you use pfSense on AWS (it really should be a default setting on the official image).
This solved the issues we were experiencing.
Based from your use case, IP forwarding looks to be the most probable solution but you will still need to set it upon the creation of the instance.
You can also reserve, assign or delete IP address on a VM Instances. These options can be found under VPC Network.
You can find more information about IP addresses in this documentation.
Openvpn allocates a /30 network from its pool when a client connects. The first address will be assigned to the client, and the second to the server, and all communication between them will go over this link (to simplify routing internally I presume).
In your case 172.21.0.1/30 will be on the client, and 172.21.0.2/30 on the server, and that is why you see ...