Is there some reason you need broadcast traffic between lan and wifi?  Why do you not just put wifi on its own network, and create firewall rules to allow the traffic you want from your wifi to your lan?  This is much simpler setup, vastly easier to maintain as well. For what reason do you need your wifi and lan on the same broadcast domain?  ie same L2 network?

What you described is the expected behavior. Wireless client traffic does not flow back through pfSense in a way it can be filtered when the clients talk directly. It's the same as any other wired network in that regard. If you want to filter between sets of clients, place them in different networks. Separate SSIDs on distinct VLANs for example.

Have you try to configure Wi-fi again? I would configure the LAN bridge to the Wi-fi interface I think.

72Mbps would be PHY so /2 that real world number.. If your on say 20mbps internet or something guess works..

Yes you will need a switch that supports vlans if you want to use vlans ;)  If all switches supported vlans then they wouldn't be called "dumb" switches ;) heheh There are for sure different levels of "smart" and or what they called fully managed, etc.  But to do vlans not sure I would call them smart for example.  I had picked up a netgear gs108ev3 for like 30$ after rebate or something.  And the switch in my av cab would bug out on me now and then, it was older gs108T netgear. It would work and work and work and then just nothing and would have to power cycle it. So for 30$ what hell replace it.. While it does vlans - that is about it.  No snmp, no sort of log even, can not even set the time on it.. no bells and whistles at all.. But it does do vlans, and can set speed on ports and enable igmp snooping, so while it might be "smart" compared to a dumb switch compared to my sg300 cisco I would say it has an iq of just above moron or idiot.. While the sg300 is bordering on genius level hehehe. So if your going to get a new switch that does vlans, and you might want to play with other stuff in the future like like snmp, ipv6, lldp or cdp, private vlans, rmon, etc. etc.  They you might want to spend a few more dollars on your switch, etc.

There are no cards that will work on two bands simultaneously. Get an external AP and plug it into a separate Ethernet interface. It will work much better and have far fewer headaches.

If you want good wifi coverage in all areas of your home especially if talking N or AC which is on 5ghz and much shorter range your going to want multiple AP. I would look into unifi AP, they are very reasonable in price start at $89 for new gen AC models 2x2 and pro 3x2 goes for $149.  They are poe which allows for easy mounting in the proper locations.  Which would be your ceilings or wall.. Not some router sitting somewhere on a shelf or on the floor under a table, etc. I have a much smaller house and have 3 of them.  Just 1 floor.  While you can talk to the AP on the other end of the house - it does not provide for the BEST speed, especially if your going to have some clients close and others far with much lower rates.  I have 1 in the kitchen near the patio door, and max out my internet without any issues out on the patio 75/10 with AC devices. I have another in the middle of the house hallway and then one in the guest bedroom on the far end of the house.  There is no place in the house that you do not have FULL signal..  And I don't have to share bandwidth with the devices that are on the other end of the house, etc. To proper do wifi in anything the smallest of open areas your going to want multiple AP.. Especially going to the new AC stuff.. Wait til 802.11ad hits your going to really need an AP in every room. How your still using G with that many devices is just nuts..  Talk about SLOW as shit..  What is your internet speed? https://www.ubnt.com/unifi/unifi-ac/

I have the latest 160311

Couldn't find a UniFi device in my price range but found a Cisco WAP4410N on Craigslist for $15 which is working great. The guy even threw in a 2nd one!

Moin, Take a look under Services–>DHCP Server. --> "Deny unknown clients" --> "Static ARP" --> "DHCP Static Mappings for this Interface" https://doc.pfsense.org/index.php/DHCP_Server To add Computers conveniently: https://doc.pfsense.org/index.php/DHCP_Leases

I'm just getting started with pfSense as well and used Tomato Shibby on a Netgear R7000. I can report the VLAN part works very well. In my scenario, I'm keeping the R7000 solely for wifi, and I have 5 SSIDs, split between the two radios. I used just one uplink to a port on my pfSense. On the Tomato default VLAN (1 usually), I configured my untagged SSIDs. I use two tagged VLANs, which are set up as VLAN and bridges (to hook up with the Wifi config). In the VLAN setup, I associated each one with the same port I'm using to uplink, set the VLAN ID to whatever I plan to use on pfSense, and marked it 'tagged". On the pfSense side, I configured the basic interface for the uplink port to assoicate with the default/untagged VLAN (and subnet). Then I defined two VLANs to match up with the VLAN ID I put in my tagged VLANs in Tomato. These are then added as interfaces and similar configuration for the subnets is completed. This all worked very well! I ran into issues with the DHCP Server not serving on all interfaces, which at first led me to wonder if the VLANs were the problem. A bit of troubleshooting proved the VLAN were fine. Hope this helps!

Change your old routers lan IP to be on the 192.168.2/? network your using I would assume /24 Make it 192.168.2.2 for example unless something else is using that IP.  Can not help you with details because you didn't say what old router your wanting to use as AP.

same issue here

In older versions of pfSense we had included a newer wireless stack, but it was crashing on 2.3 when we tried, so we had to roll back. Waiting for 2.4 is one answer, getting a real AP is the better answer. There is nothing else to do.