Thanks @bingo600 and the rest of you for the help.

If you have enough interfaces to assign to "each desired" L2 Lan , then drop the Vlans ... For now.

Where would your normal "Clients go ??"

Remember pfSense makes two default "named" interfaces on install

1: WAN
2: LAN

The additional IF's you create would be "default named OPTxx".

The (2) Lan IF is where pfSense default expect to be managed from , and should be "Fiddled with" with great care ... Aka ... Don't touch until more experienced.

I'd use:

ETH0 - Wan
ETH1 - Lan - Where normal Clients go
ETH2 - OPT1 - OpenVPN - Where OpenVPN Clients go
ETH3 - OPT 2 - IOT -Where IOT clients go

Now you're missing a Lan interface for NAS , and would need Vlans if it's a must.
If beginning to use Vlans , Setup ETH3 for Vlans (and move OpenVPN + IOT there)
Then use ETH2 for NAS.

I suppose LAN + NAS would be "high traffic" , and they should have a dedicated IF.

All Vlans on an interface "share the same Interface (wire) bandwidth" , so ETH3 would offer 1Gb or 2.5Gb shared between all Vlans.
I don't see an issue with that .... OpenVPN is limited by your Internet (Wan) BW , and IOT isn't high traffic)

If/When ready for Vlans
I would get one of these - Cheap and Good - I use them my self.
A Web managed - Vlan capable switch - Gigabit only , not 2.5Gb
https://www.pricerunner.se/pl/167-3200059049/Switchar/D-Link-DGS-1100-08-v2-priser

I have no experience with 2.5Gb switches ...

Edit: You say you don't have switches ?????
Do you mean Vlan enabled switches ??
If no switches at all , how are you going to connect all your devices ??

Edit2: Do you really need an OpenVPN interface right now ??
I'd probably drop that for now , and use ETH2 for the NAS , and other "protected services"

/Bingo

I want to run different networks on ETH1, ETH2 and ETH3 on the j4125 firewall and thought I have to use Vlan.

Like this

ETH0, Wan
ETH1, Lan 10.27.27.1 and DHCP (IoT net)
ETH2, Lan 10.28.28.1 and DHCP (NAS)
ETH3, Lan 10.29.29.1 and DHCP (to OpenVPN provider)

Start by configuring a "Test setup" where you don't use Vlans, and see if it works.

Note:
As mentioned above , you can't be 100% sure that the physical port ETHx will correspond to IGCx.
On one of my Qotoms , physical port 2 was detected (by pfSense) as IGB4 , and physical 4 as IGB2.

Setup DHCP on "All IF's" , plug in a PC to each port and note what ip address the PC gets. The DHCP IP would reveal the relationship between Physical port and pfSense IGCx port.

/Bingo

@viragomann
I want vlan on ETH2 port on my firewall, not on ETH1 port (lan port). But only works on ETH1.

Why are you using a vlan at all? Just put an IP on the interface itself. No switch, no need for vlans

Connected a device to it?
Also configured the VLAN on that device?

Ensure that it is the correct network port. ETH2 on the case does not necessarily mean it's the igc2 port.
Check if the interface is displayed as connected on the dashboard.

I don't have a switch, just use the router

So what do you intend with VLANs in this case?