pfSense sits at the edge of the network and does two jobs: it's the firewall enforcing the VLAN boundaries set up on the switch, and it's the endpoint for remote access back into the lab when I'm not home.
Firewall & segmentation
pfSense is where the VLANs defined on the switch actually get enforced — rules controlling what can talk to what between segments, rather than trusting everything on one flat network. It's also the first thing to check whenever something on one VLAN can't reach something on another.
VPN & remote access
Remote access into the lab runs through pfSense's OpenVPN server, tied to a DDNS hostname managed through Cloudflare rather than a static IP. That decision came out of a real failure: the OpenVPN client config originally had a hardcoded IP address, and it quietly stopped working the day the ISP handed out a new one. Rebuilding it around a DDNS hostname means the VPN keeps working even when the public IP changes — a small lesson that mattered more in practice than it sounds like it should.
What's next
- Review and tighten the inter-VLAN firewall rules
- Document the OpenVPN client setup end to end