Thanks for your answer…
...but the missing tcpmssfix is installed yet a while. Without this or editing interfaces.inc I was not even able to connect. This problem doesn't exist.
I can ping my router from wan-side, I have a dyndns-account which works fine. Some people have access to my net. The alternate monitor-adress shows my external adress (WAN-adress from provider), so this seems to be right. I have no rule forbiddind icmp to my router from internet.
I don't have another router between my pfsense and provider, only a cable-modem. I'm on a 100Mbit-fiberoptic line connected to my provider which ends just in house, so no other hardware between me and the next fiberoptic hop somwhere in town.
Yes, my WAN-connection is via PPPOE.