Firewall rules for specific Vlan to VPN

[xerxes]

unfortunately it is more confusing to me now.
Example:

@userone

The ISP modem is 192.168.0.1 which connects directly to the PFsense firewall (10.0.0.1) when then connects to UDM 192.168.1.0 when then connects to a unifi router.

UDM see’s the pfsense (10.0.0.1) as the WAN IP and UDM as the Gateway IP. UDM has wifi networks that act as the DCHP server assigning ip address (I.E. 192.168.1.0/24 192.168.5.0/24 192.168.3.0/24).

to me this sounds like you have this:

(ISP modem IP 192.168.0.1) — (MODEM interface (IP is what?) of pfSense , LAN IP 10.0.0.1) — (UDM IP 192.168.1.0 (not a device IP!))

if you use /24, 192.168.1.0 is not a device address, but a network address. The UDM then cannot have specifically this address. there must be an IP address that the UDM uses to connect to the pfSense, which you haven’t mentioned. Otherwise, how do pfSense and UDM talk to each other if they are connected with interfaces on different networks?

I think you’d do yourself and the people you would like to help you a favor by drawing a network map as others here have done to be specific about the current setup. Some examples here:

Doing some Unifi Upgrades, need advise

ok, understand what you mean by swopping the Max and the Aggregation. it basically opens up a port on the Aggr which as you said can then be lagging bonded together. Basically make the MAX my core. Not all links shown. G PS I moved the 2 ports on the Max around and also swopped the IP’s. [NetworkPhases 1.1-Cabling 2.1] and [NetworkPhases 1.2-Day 3a]