VOIP: Wan + Bridge + VLan or just give up and set up another box?
I bet others have had this puzzle, but I can't find it if so. I think it must have come up for other pfsense folks.
VOIP applications are notorious for using large UDP ranges and also coordinating TCP and UDP traffic with the various port/ip numbers embedded within. There are various hacks ranging from 'bad to ugly' that 'aid in NAT traversal' for these.
They sort of work until a slight breeze occurs then not so much. And the whole genre is a security disaster.
The 'for sure it works' approach is set up a box with a NIC for each public IP/WAN, another NIC for a private ip range for control and admin, viola, all done. At the price of another box and fan noise and and and.
Would a nice virtual machine set up on a vlan do just as well as that whole other box? Why in many cases yes it would. To do that, create the vlan on the pfsense lan side, create a bridge interface adding the vlan to the various pfsense wans, add some filtering rules so only the traffic to/from the allowed ips crosses the bridge and… done.
But, at what cost? Would the performance hit be intolerable? Lags create jitter? Routing nightmare? Promiscious mode overheads? I know the idea is not good, but is it 'worser or better' than maintaining yet another physical box to be the pbx?