Hmm, not much response on this issue...
I have been doing a lot of further investigation, and it seems it's impossible to do any kind of firewall filtering based on users/groups if you are using Mobile IPsec VPN.
I'm very disappointed by this as Mobile IPsec VPN has the MAJOR advantage it works with the built in VPN client in Windows, MacOS, iOS, Android....
There are some "workarounds" if you start using OPENvpn instead, but even that is not implemented very effectively.
You either have to send ACL rules from Radius, or assign static IP's/user, or implement several OPENvpn instances (Each with it's own Firewall ruleset, and assign users to the fitting OPENvpn instance).
Quite choking that pfSense does not have a mobile VPN solution that supports user/group based rules....
Feature request: How about implementing a little service that add's a clients VPN ipaddress to a builtin FW Alias group if the user authenticated with a user belonging to a usergroup? Then we could make VPN usergroup firewall rules by using aliases as usual.
If this was done upon VPN connect, and removed on VPN disconnect (needs a bit of state handling as well), it should work regardless if the user authenticates with a local database user, or via a Radius user if the Radius returns the groupname with CLASS attribute.
