Thanks!

OK, thanks.  I was afraid something was not working correctly.

The NIC's are realtek, both onboard. There is your issue. Freebsd isn't very kind for Realtek NICs. I suggest buying Intel

Windows Firewall? And often it allows ping response from a device in the same network, but not from outside the local network. Or you are on WiFi and the WiFi keeps the various WiFi clients separated.

Then make the pass rule on VLAN10 to be source VLANnet and destination LANnet.

@sneakking: @jezzy: Is there anyway to only route certain local IPs via the VPN (my downloaders..) so the remaining devices don't get bogged down with the VPN speed? For how to handle traffic per host: https://blog.monstermuffin.org/tunneling-specific-traffic-over-a-vpn-with-pfsense/ Thanks, I just setup pfSense and wasn't able to route IPs via my VPN.

Draw a schematic of your setup & include all involved subnets

It's blank when I do that (i.e. blocked by the default rule)…which it shouldn't hit because of the allow everything rules

Turns out the tech who said I was having router issues was a little less than "spot on". I swapped out my pfsense with a dd-wrt I had around and got the same issues. A complete cable replacement from the pole to my home including a repair to the cable inside and I am good to go. Pfsense wasn't the cause of this issue; but rather, was a scape goat for a tech who was out of ideas…

workgroup in windows has zero to do with shared resources.  All a "workgroup" is what list to put it in the browselist, nothing more - it really is just utterly useless..  Might of be somewhat useful back in the day of windows for workgroups to group machines in specific lists like users, servers, etc.. dept A, dept B, etc.. But they have zero to do with authentication to who can access shared resources off a machine. Might was just leave it at the default workgroup for the name.  The DNS domain that you setup in pfsense is just that the domain part of a FQDN (fully qualified domain name) so when you lookup pfsense.something.tld or whatever you want to call pfsense. Or other machines in your network.

Ok, thanks.

@Harvy66, This happened again today and, knowing network utilization was the likely cause, I was able to track it down right away.  You definitely put me on the right path.  It was as simple as the network being saturated. Specifically, I had a CrashPlan server on one VLAN and it's data store on another VLAN.  When CrashPlan would (deep) compact data, it would saturate my firewall for the duration. Thank you again for the help.

I would suggest simply unplugging the defective USB device.