VOIP: Wan + Bridge + VLan or just give up and set up another box?

[hcoin]

I bet others have had this puzzle, but I can't find it if so.  I think it must have come up for other pfsense folks.

VOIP applications are notorious for using large UDP ranges and also coordinating TCP and UDP traffic with the various port/ip numbers embedded within.  There are various hacks ranging from 'bad to ugly' that 'aid in NAT traversal' for these.

They sort of work until a slight breeze occurs then not so much.  And the whole genre is a security disaster.

The 'for sure it works' approach is set up a box with a NIC for each public IP/WAN, another NIC for a private ip range for control and admin, viola, all done.  At the price of another box and fan noise and and and.

Would a nice virtual machine set up on a vlan do just as well as that whole other box?  Why in many cases yes it would.  To do that, create the vlan on the pfsense lan side, create a bridge interface adding the vlan to the various pfsense wans, add some filtering rules so only the traffic to/from the allowed ips crosses the bridge and… done.

But, at what cost?  Would the performance hit be intolerable?  Lags create jitter?  Routing nightmare?  Promiscious mode overheads?  I know the idea is not good, but is it 'worser or better' than maintaining yet another physical box to be the pbx?