Firewall not working with VPN

[blacklungq]

Im connected to PIA VPN. On the old router this meant there really was no firewall. ShieldsUp shows ports as open and closed, not stealth, when connected to VPN

So I set up a Pfsense box. I imagined, or hoped, that the firewall would be after the VPN, so the ports came up as Stealth. Didnt happen

How do I ensure the firewall sits after the VPN so it works?