So other devices on your lan with a wire get 12mbps ? How do you have this connected?  Is your AP connected to a switch, directly connected to pfsense interface? What? Such a crappy speed would point to a duplex mismatch if you ask me for off the top of my head shoot from the hip ideas to your problem..  What I can tell you is pfsense gives 2 shits if traffic is coming from a wireless accesspoint or a wired client.  Traffic is traffic..  I have 3 different unifi AP setup with pfsense and no issues at all. How is pfsense setup?  Is it a VM running on ???  Or is it running on hardware?  If so what?  Got to have some sort of details here to help you.  So far what you have said is hey mechanic my car is broke, but my other car works.  Can you fix it.

why do you need routing?  Like I said pfsense will already know how to route between your different segments that are attached to pfsense. If your going to run a vpn client on the box in the lan with some sort of default route to the vpn, then sure you would need a route statement on that box telling it to use pfsense IP in its segment to get to other segments in pfsense. You would only need a route on pfsense if you needed to get to some downstream network.

huh?  going to need some more details.. What has 1 nic your pfsense??  Does it have a wifi card - what hardware do you have exactly?  And what does this cisco router have to do with it.. Is it the wifi router.. What model?

It appears that the ath driver lacks support for that specific card. There isn't anything you can do to change that. The OS sees the hardware but since it shows as a "none" device that means no driver attached.

Do you have the older AC pro model from unifi or the new gen2 stuff?  I have the lite, the pro and the lr of their new ac line and be happy to do some testing for you.  I could fire up something that is on the same network via wire as the wifi and do some testing of speed with iperf..  I do have a pci card I could use that is 3x3 on pc, but never use it for anything other than testing since pc got a gig wired connection so no real use of wifi even if 3x3 AC.. Never going to come close to gig wire.. Even at 3x3 80mhz channels short gi your talking 1300 PHY which is only 650ish real world.. I see low 900's with a wire ;) 3x3 clients really rare and 80 mhz not very common either so typically your talking 2x2 at 40 even on AC.. But could do some benchmarks with those PHYs or some lower ones..  Could change over to 40mhz for example.

^ exactly!!!  This desire to have some tiny box that does everything doesn't work well for wifi coverage.  Its always going to suck compared to properly placed AP(s)..  I am glad to see the pfsense store doesn't even offer the internal wifi cards as option on their appliances any more and only external AP.. As we move to 802.11ad the option of 1 device that provides wifi access going to be useless unless your "router" is in the 1 room of your house you want wifi coverage in ;)

@johnpoz: Yes if your going to run vlans you need a switch to support vlans unless your going to just plug the AP directly into a nic on pfsense.  Then you don't need a smart switch..  But smart switches are very reasonable..  You do not need 1000 $ enterprise switch here ;) 8 port gig smart under $40.. I am still researching smart switches, but can you elaborate on how to setup the VLANs using the Unifi AP Pro (just ordered it based on your recommendation) plugged directly into my pfSense 3rd interface?  My pfSense has 4 total inferfaces with two currently being used (WAN & LAN).  I haven't found any  VLAN settings on the pfSense GUI.  I know I have to configure VLAN on the AP, but I don't quite understand what's needed to be done on the pfSense box. I would like the non-guest WiFi to be part of LAN (full access), but the guest WiFi to only have Internet access.  However, I would like devices on my LAN and non-guest Wifi to have full access to devices on the guest WiFi. This is my first foray into VLAN and so I am trying to read as much as possible and put it all together in the context of pfSense.

Thank you, I found it now.

take a look at the unifi new AC line they range from $89 for the lite to $149 for the pro.

The use case is the following: There are 6 holiday apartments which all use the same WLAN. After a preceding law case due to illegal downloads every apartment needs to be monitored for eventually following issues of similiar kind. The MAC addresses change of course in the same frequency as the guests do, therefore assigning static MACs is inapplicable. Technicalwise I might be looking for something like Captive Portal with RADIUS authentication and static vouchers, presumed this can provide the above mentioned features per voucher(user). Any other solution that fulfills the requirements would of course be welcome as well. Is there any chance to archieve that? Regards, royskatt

Thanks, I had to ignore it for a few days but my very first attempt what was you mentioned but I had my proxy setup (which of course didnt work when on a different subnet) so I immediately thought that was wrong. After reading your post and doing it properly it all worked within minutes and seems so logical. Cant believe I didnt figure that out. Thanks!

No, you can't. You'll have to buy a real AP.

I use a asus ac68u router in the US with Tomato ddwrt and it is set to give OVPN on one SSID and clear net on another SSID via a bridged VLAN - so far its working well You also get the ability to restrict or enable access to OVPN via MAC address (don't know how you can do that in pfsense) Anyways, if you have a compatible router Tomato is worth a go - tho you do loose the ability to turn the LEDs off.

Yes you can! The only issue is compatibility and optimization of the wifi card. For example: I connect a mini pci wifi card as my Access point.

I've been playing with this off and on for the past month+, and I'm nowhere closer to success. The device I started out with (0x1199/0x901e) was not recognized by pfSense, nor Centos 7.  Windows 7 was no better – 0x901e is not a popular variant of this card, and no matter what drivers I used (starting with Sierra Wireless, progressing to shady 3rd party 'driver manager' sites, and even modifying inf files of the official SW drivers), I ended up with the card not actually working.  Plus, at no point was there a working serial port provided to any of the OSes, so even if I wanted to issue AT commands to change PIDs, I was SOL.  Because this device was an AliExpress import of questionable origin, I figured I should cut my losses and find another EM7355. Next step: I obtained a less "exotic" variant of the card, a Lenovo part (FRU04X6038) which gave me 0x1199/0x901f.  No better under pfSense (now at 2.3.1_1) or Centos (neither picked it up in a way which I could talk to it, serial or otherwise), though under Windows (10) the drivers obtained from Sierra Wireless picked up the card without having to modify any inf files.  Still, the COM ports it did present didn't actually respond to any commands (trying multiple speeds, etc.) nor did the Sierra Wireless Watcher software pick up the card.  I next tried it in a Lenovo laptop (Win 7) in which the card was supposedly compatible.  The first time around, the laptop booted up, I installed Lenovo's drivers, and things seemed like they were going in the right direction.  However, upon a required reboot (Lenovo Access Connection software), the laptop refused to boot due to what it claimed was an incompatible card.  No idea why it was okay with it at first, but now it was complaining.  VID/PID seemed to be the same. So, I'm pulling my hair out here!  I'd be hugely grateful if someone had some experience with these cards and could give me some pointers on where to turn next.  Sierra Wireless doesn't seem to pay attention to end-users. Ultimately, I'm looking for a T-Mobile (USA, LTE bands 2 and 4) compatible device which I can connect to my pfSense box, either via Mini PCI Express or USB.  I don't want to spend hundreds on a Cradlepoint (or similar) box -- I'd be paying for a router (which I'd rather be pfSense) when all I need is an interface to a modem.  If you know of a device that would accomplish this, hopefully under $100, I'd throw these EM7355's out the window in a heartbeat.