Well, I haven't made any changes since I made the original post, however it all seems to be working quite well now. Perhaps something needed to propagate out or clear out of memory or something, but I don't see how since I restarted both machines and manually cleared the state tables multiple times before making that post. Since I doubt that I will be able to find the source of an issue that is currently absent I will simply make a note of what I have found in answer to the latest questions in the hopes that it might help someone in the future. I will keep an eye out for any suggestions that people make for future reference and come back with an update if things stop working again.
Yes, all the states triggering on the LAN interface seem to be going to the WAN at least for now.
The rules for the Rokus and the media PC do allow all ports including udp.
I have not seem any traffic from any of these 3 devices going out to the VPN.
I do not have any static routes set up for anything, however every LANside device on the network does have a static IP address if you think that might be a factor. (This is a home network, so only 25 devices currently connected) I have IPs 192.168.10.100-250 for transients like guest cellphones to be assigned as needed through DHCP.
If the problems return I will try disabling other LAN rules as my next troubleshooting step, but I don't think it would be a productive diagnostic step while everything seems to be working.
One last piece of information that might be useful for others who come across this: The last thing I did before making the original post (and so the most likely factor in things starting to work if it was in fact just something that needed time to propagate) was to switch the outbound NAT mode from manual to hybrid. It does not appear that PfSense made any changes when I did that, but perhaps I missed something there.
Anyway, thanks for the help. Fingers crossed that it is actually fixed and not just temporarily working.
