Hi, gilf, hi Scott!
I solved this problem without additional soapbox (hub).
I just mapped LAN interface to ath0, which is "virtually" always on.
*** Welcome to pfSense 1.0-BETA1-TESTING-SNAPSHOT-2-5-06-embedded on pfsense ***
  OPT2(LANBRIDGE)          ->   sis0    ->      NONE
  WAN*                     ->   sis1    ->      172.16.128.11(DHCP)
  OPT1(DMZ)                ->   sis2    ->      192.168.2.1
  LAN                      ->   ath0    ->      192.168.1.1
…and here is my ifconfig output -
sis0: flags=8943 <up,broadcast,running,promisc,simplex,multicast>mtu 1500
        options=8 <vlan_mtu>inet6 fe80::200:24ff:fec5:6ebc%sis0 prefixlen 64 scopeid 0x1 
        ether 00:00:24:c5:6e:bc
        media: Ethernet autoselect (none)
        status: no carrier
sis1: flags=8843 <up,broadcast,running,simplex,multicast>mtu 1500
        options=8 <vlan_mtu>inet6 fe80::200:24ff:fec5:6ebd%sis1 prefixlen 64 scopeid 0x2 
        inet 172.16.128.11 netmask 0xffff0000 broadcast 172.16.255.255
        ether 00:00:24:c5:6e:bd
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
sis2: flags=8843 <up,broadcast,running,simplex,multicast>mtu 1500
        options=8 <vlan_mtu>inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255
        inet6 fe80::200:24ff:fec5:6ebe%sis2 prefixlen 64 scopeid 0x3 
        ether 00:00:24:c5:6e:be
        media: Ethernet autoselect (none)
        status: no carrier
ath0: flags=8943 <up,broadcast,running,promisc,simplex,multicast>mtu 1500
        inet6 fe80::20b:6bff:fe37:579d%ath0 prefixlen 64 scopeid 0x4 
        inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
        ether 00:0b:6b:37:57:9d
        media: IEEE 802.11 Wireless Ethernet autoselect mode 11g <hostap>status: associated
        ssid mms channel 1 bssid 00:0b:6b:37:57:9d
        authmode WPA privacy MIXED deftxkey 2 AES-CCM 2:128-bit
        AES-CCM 3:128-bit txpowmax 40 protmode OFF burst dtimperiod 1
        bintval 100
pfsync0: flags=41 <up,running>mtu 2020
        pfsync: syncdev: lo0 maxupd: 128
pflog0: flags=100 <promisc>mtu 33208
lo0: flags=8049 <up,loopback,running,multicast>mtu 16384
        inet 127.0.0.1 netmask 0xff000000 
        inet6 ::1 prefixlen 128 
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7 
bridge0: flags=8043 <up,broadcast,running,multicast>mtu 1500
        ether ac:de:48:f9:56:39
        priority 32768 hellotime 2 fwddelay 15 maxage 20
        member: sis0 flags=3 <learning,discover>member: ath0 flags=3 <learning,discover></learning,discover></learning,discover></up,broadcast,running,multicast></up,loopback,running,multicast></promisc></up,running></hostap></up,broadcast,running,promisc,simplex,multicast></vlan_mtu></up,broadcast,running,simplex,multicast></full-duplex></vlan_mtu></up,broadcast,running,simplex,multicast></vlan_mtu></up,broadcast,running,promisc,simplex,multicast> 
I think - problem still exists, with two ethernet interfaces and without wireless i need hub again ;(
Thanks, Arnis.