Hi. I really thank you for your comments, I'll look at analysing your explanation in detail so as to understand the correct way to setup and configure.
At the moment, the pfSense firewalls are in production and working fine, so no major changes are going to happen.
But remember this arose from the migration of shorewall to pfSense, like for like configuration, which is why we have it the way it is.
The client ended up fixing the Paypal issue by the way, it had nothing to do with pfSense, just a total coincidence they had the problem shortly after we did the migration and put the new firewalls on-line.
Thanks again.
@johnpoz:
"setup the majority of rules on that LAN interface"
Huh?? Are they public subnets routed to you? I can not believe they are all just running on the same layer 2 if you have more than 1 of them?
Why would you be setting up aliases on the LAN???
If you have /29 for your wan, and then you have more /?? that are routed to this transit /29 then your doing it completely utterly WRONG!!! You would bring up your subnets on lan interfaces and those networks would be behind pfsense. There would be NO vips created..
You would then need to create rules on the WAN the interface connected to the internet to allow traffic to these networks behind pfsense!! Your different routed networks would be connected lan, or optX or vlans sitting on interfaces that are behind pfsense.. The rules on those interfaces would be set to allow the traffic you want them to initiate.
Rules are evaluated as traffic enters an interface from network its connected too, first rule to trigger wins, no other rules are evaluated.
Lets say your transit /29 is 1.0.0.0/29 where your gateway is 1.0.0.1, and pfsense wan IP is 1.0.0.2… You have a /24 2.2.2.0 routed to you... Then on an interface of pfsense setup its IP to 2.2.2.1/24 and your devices connected to that interface would be int he 2.2.2.0/24 network.
You are going to want to turn off NAT for these interfaces - since they are public and routed to you. You would create another interface/vlan for use by say your 3.0.0.0/29 routed network.. Pfsense IP on this interface would be say 3.0.0.1..
You would create rules on your WAN to allow traffic to 2.2.2.100 for example for https if that is the IP your https server is on.