i reloaded the switch and router, rebooted all the servers and the app tables populated appropriately. thanks!

I just wanted to say thank you to the OP. I was having problems with remote syslog along the same lines. I spent about 3 hours troubleshooting, and your solution eventually resolved my problem. I haven't set up the alias/rules you suggested yet, since setting the IP of the syslog server, rather than the hostname, worked perfectly and is good enough for me. Thank you for posting your solution!

what should i do to connect my pfsense to my switch ? (just from modem to WAN and from LAN to my switch)

Internet –- Modem --- WAN Port pfSense --- LAN port pfSense --- LAN Switch --- WLAN APs and/or other equipment
such PCs or whatever.

should i give my PCs in VLAN: LAN static ip dresses or will dhcp do that for me ?

About how many device we will talk here? Up to 20 devices I would give all of them static IP addresses
and let only for the WLAN and/or VPN service run the dhcp server then.

should i allow wlan to access in lan if i want that people can print through my access point ?

You will be able to st up a VLAN onl for the printer and let them then connect to only that VLAN too and
not to the other VLANs with your private stuff inside. Work with radius and certificates for the private wifi
and st up the captive portal with voucher system for all your guests.

how can i set up my firewall to do the routing and not the modem ?

A pure modem is not able to do a routing job. Only a router will be able to do so. You could
try out to bridge that router into the so called bridged mode and let the pfSense then routing
tha entire WAN and LAN (VLAN) part. (Would be my way do realize it) only if you own a Layer3
switch in your network, then that switch will be better for the entire internal LAN and VLAN routing
it is mostly able to route it with wire speed and this too over all VLANs.

@JKnott:

Does your ADSL modem include a router?  If so, have you placed it in bridge mode, to bypass that router?

thanks for answer, but router have disabled this option, any other option?

Captura.PNG
Captura.PNG_thumb

OK, great! Sounds like it might work! Thanks.

Solved:

Well, now I feel silly.  The printer still had 192.168.1.1 for a gateway rather than 192.168.10.1.

All VLANs are working fine as expected. It is all about the firewall rules setting.

the address 192.168.0.196 is the one that gives me when putting virtual machine a bridge adapter

To solve the adding user problem, I just deleted the user and will use admin for now until PFSense fixed

If I'm understanding your question correctly, the way to do this is to connect via the external IP instead of the internal IP that presumably routes thru the tunnel.  But then you'd have to allow ssh connections thru the WAN interface, which seems like a bad idea.  Why don't you want ssh connections to go thru the tunnel?

Then they are broken or improperly-configured if they are passing broadcasts between VLANs.

And proper configuration should not require anything such as "port isolation."