Old topic I know… It took a bit to wait for some new cables (red for the vlan), and waiting for a good time to potentially break things. But I did eventually do it and so far so good!
It actually went pretty smooth. The hardest part was configuring the switch. I assumed that a trunk would just pass vlans around no problem, which Mike, my Cisco dude confirmed, but my switch wasn’t playing nice until I joined the required ports to the specific VLAN.
The only issue that remains is that when I tried to implement the firewall rules to keep traffic from going over the WAN when the VPN is down, it all just died. I’m not so worried about this, since the VPN rarely goes down and is more of a bounce than anything. I will go back and take a look at some point though, at least just for the education of how pfsense (and I guess pftables) handles things. Sometimes you just need to step back and come back later to get a fresh look, especially when following a guide to implement something. I’m sure it will all make a bit more sense when I go over it later.