@vsecgod:
@Derelict:
Note that you don't have to do every subnet on a firewall port. You can do just the VLANs that you want to restrict, like the guest network.
This would entail, in a nutshell:
Remove the layer 3 vif on the VLAN in question from the switch.
Tag the VLAN to pfSense
Create the VLAN on pfSense
Assign the VLAN to a pfSense interface
Configure the layer 3 characteristics of the pfSense interface
Configure the firewall rules to pass what you want passed
If I'm understanding correctly, my current config is all vlan's routing on my sg300 switch. You're saying remove the vif (virtual interface? forgive my noobness) from my sg300 and put it on the pf box. So if I do this, basically other vlans still route thru my switch and traffic on the guest vlan route through the pf box?
Yes.