Just felt weird leaving OPT2 unassigned while configuring the VLANs underneath it. The first VLAN I actually left untagged, though I suppose I really didn't need to. Attached basic diagram of the layout, and yes it does have three VLAN for WiFi (with 5 SSIDs, to support 2.4 and 5 GHz clients in two of them).To address some of the questions, since I specifically avoided providing too much detail at the beginning: but after much searching and more resets and reconfigs of the Tomato box that I care to remember, I'm still not getting what that is. I know there's something obvious I must be missing here. So it's not perfect, but it's working decently. I found a workaround that suggests putting several commands in the firewall init scripts area, but that doesn't seem to affect the behavior.ДЇor now, I've worked around these by leaving Tomato in gateway mode (of course WAN is disabled) and I've switched to using DHCP on Tomato for the wifi folks, but I've had to manually register some stuff in mDNS that gets auto-registered in the pfSense DNS via DHCP. And traffic otherwise flows fine between WiFi clients and the router (and servers in places they're allowed to).Дў) One config step (to switch tomato from Gateway to Router mode) seems to completely break my admin access to the device (ssh nor web continue to respond). I already have pfSense DHCP working on two separate wired networks, so I don't believe it's a service issue. The issues are two, and they may very well be related.ДЎ) I can't seem to get DHCP Server on pfSense to see dhcp requests from WiFi clients. I defined br2 and br3 as tagged on the same port as I use to uplink to pfSense.ДЄs it stands, this is all 'working'. Even though I have disabled WAN, I actually leave br2 alone, as I'm not interested in that port. Using just ONE uplink cable from Tomato to pfSense (so using VLAN, direct not through switch)ДЇor the VLAN, I leave br0 untagged/default. Tomato handles Wifi AP (one for IoT, one for phone/laptop/tablet, and one for guests) pfSense is primary gateway and all wired networks flow through it I already have this configuration working 80%, but my goals are: I've found a couple of older posts on this subject, but none really addressing an issue that I've run into that I would like some advice about.

Pfsense vlan priority