Technically you should allow "ICMP type 3 code 4" (Destination Unreachable, Fragmentation needed but DF bit set) messages in on your WAN to be able to connect to sites that have reduced MTU for whatever reason. However that's not the only solution and for most of the connections the other solutions will solve the issue for you without having to the open holes in your firewall: https://blog.cloudflare.com/path-mtu-discovery-in-practice/

VPN doesn't need a managed switch. You only need a managed switch that supports VLANs if you want to do it all with only one NIC on your router.

Thank you for the quick response and very useful advise. Unfortunately my ISP (Com Hem) does not provide instructions as they do not support any hardware other than their own wifi-router. I have however found guides on how to set up IPTV services with other providers, so I will try to those together with your advice not to add additional cabling. I will report back here once I have done so.

If you are using the console you may set up first on all three or four points the right numbers; On your appliance (in the BIOS) Serial/COM Port of your PC (if available) Putty (on Windows) pfSense (no need because its the default setting) The default serial console settings in pfSense 2.2 and later are 115200/8/N/1, meaning: Speed: 115200 Data Bits: 8 Parity Bits: None Stop Bits: 1 The you could be sure to get out the right output in the console (read able)!

Thank you : jahonix That is some funny stuff right there i am still working on some of the stuff but have been interrupted for a while have to put my step dads bicycle together LOL will get back to my stuff here as soon as i can I want to Thank All you folks who helped me so far I just not sure how you do that every time i hit thank you it says i already did that so anyway thanks folks for all the help i will try to keep you all up to date. Thanks for the Quote i like it

Thanks!

OK, thanks.  I was afraid something was not working correctly.

The NIC's are realtek, both onboard. There is your issue. Freebsd isn't very kind for Realtek NICs. I suggest buying Intel

Windows Firewall? And often it allows ping response from a device in the same network, but not from outside the local network. Or you are on WiFi and the WiFi keeps the various WiFi clients separated.

Then make the pass rule on VLAN10 to be source VLANnet and destination LANnet.

@sneakking: @jezzy: Is there anyway to only route certain local IPs via the VPN (my downloaders..) so the remaining devices don't get bogged down with the VPN speed? For how to handle traffic per host: https://blog.monstermuffin.org/tunneling-specific-traffic-over-a-vpn-with-pfsense/ Thanks, I just setup pfSense and wasn't able to route IPs via my VPN.