@Tantamount & @johnpoz: Thank you for responding!
Tantamount, your response is very helpful. I have responded to your observation and advice below. Please tell me if I am on the right track:
–------------
It looks like you've got two internal networks -- one for regular internet traffic (ISP) and one for VPN traffic (VPN). Each has its own subnet. I assume you use different SSID's and have to manually change between these depending on what your want your lan devices to use -- in other words you want the networks isolated from each other.
So now you want to make pfsense be your first line of defense.
Absolutely correct – that is exactly how I want to setup
Start by making sure that the dhcp server on the pfsense is using the same subnet as (ISP). Then for the (ISP) wifi router, configure it to dumb AP mode. That should mirror your current setup -- lan devices would get ip addresses in the subnet they're familiar with, and you only have one nat translation occurring -- except now it's happening at pfsense and not the (ISP) router.
In my current setup (Fios via Ethernet), I do not have any ISP supplied equipment. I connect one of my Cellspot (Asus) routers directly to the Ethernet cable. Ethernet from Fios ONT comes in directly to the WAN port of Router 1.
So as I understand:
Connect the incoming Ethernet to the WAN port of psSense box. Then change Router 1 to AP mode.
From pfSense LAN port, connect AP (LAN to WAN?)
Change pfSense LAN to 192.168.1.1 (Do I need to change AP to 192.168.1.2 or let psS DHCP handle that?)
This just leaves the (VPN) router and that network. Plugging the wan port of (VPN) into the lan side of pfsense should work the same as how you originally had things before pfsense was added. Traffic coming into the LAN or wifi side of (VPN) would go through the VPN tunnel. This tunnel is natted first from the (VPN) router to lan pfsense, and then natted again from lan pfsense to wan pfsense. pfsense shouldn't be causing any issues with this. As far as it knows, a single device on the lan network (VPN router) is trying to connect to something on the internet.
I tried this past weekend however I think I could not get the OPT1 (2nd LAN port in pfSense box) configured correctly so I was getting no packets.
Do I need to configure any rules? I copied the ipv4 connectivity rule from LAN to OPT1 but still couldn’t get connection
I create a second subnet : 192.168.2.1 on OPT1 - Do I let pfSense DHCP handle the VPN Router? Or should I configure it to 192.168.2.2 ?
Did I get the above correct? If not, please correct me. (Thanks!). If I missed stuff, please feel free to add it in.
As johnpoz mentioned however, this is making things more complex then it needs to be.
Ideally what you'd want to do is configure openvpn to work with AirVPN in pfsense. Then have all internal vpn traffic go through a second LAN port of pfsense out to the other (VPN) router -- now in AP mode.
This is what I ideally wanted, and perhaps once I am more confident of my abilities, I will attempt it.
I did I quick search for AirVPN and it looks like there are all kinds of instructions for getting it working with various equipment, such as dd-wrt (Another router similar to pfsense). If you cannot translate these instructions for pfsense, I suggest looking to see if AirVPN has a forum where you can get the help you need because this is definitely doable.
You'll almost certainly get better performance this way due to the better hardware running pfsense vs that wifi router.
Here is a link to a very comprehensive guide that I found on the airvpn forum for psSense 2.3 (https://airvpn.org/topic/17444-how-to-set-up-pfsense-23-for-airvpn/ ), however I think, at this time it’s a bigger bite than I can chew. Unfortunately I cannot have my network down for over an hour, and this isn’t something that I am confident of being able to achieve within that time…
