OpenVPN re-creates the tun(4) interface at startup; compatibility
with PF is improved by starting it from hostname.if(5). For example:

# cat << EOF > /etc/hostname.tun0
up
!/usr/local/sbin/openvpn --daemon --config /etc/openvpn/server.conf
EOF
