Nat – Bridging wireless and wired networks on Linux box

You can keep pfSense doing that. WAN should always point to the side where your default gateway resides. The other network can stay OPT1 or be LAN. Then configure your rules accordingly so users can only hit your VPN and the Internet. May want to disable NAT in that scenario so the edge RVS4000 sees the true source IPs (Enable advanced outbound NAT, delete auto-added rule). Will need static route on RVS4000 in that case.

The difference in the scenario you described is as follows:

• If your pfsense has a dedicated wireless interface, you can tune your firewall-rules in a way which suits you.
• If you hook up an accesspoint to a switch, and someone were to crack into your wireless network, then he would gain full access to that VLAN.

Let me describe what we did when we set up our new headquarter last year.

1. Created two new VLANs on the switches, one for guest access, one for internal access
2. Our accesspoints where able to use this "multiple SSID"-feature (I think this is a Cisco brand term) - so we have a "guest" SSID which is shoved over to the guest-VLAN, and an "internal" SSID, which is put through to the "internal" VLAN. Both SSIDs/VLANs got their own dedicated IP-network.
3. No other machine was allowed to be on these VLANs.
4. The networks terminate on the VLAN-interface of an internal pfsense, which deals with routing and firewalls.
5. The guest LAN was only allowed to use the internet, where the internal LAN was allowed to get access to some servers in our DMZ (Exchange and the such).

So, giving your pfsense a wireless adpater wouldn't be too bad, but if you want to run more than just one SSID you need to find an adapter which actually supports it (I don't know one right now).

To answer your final question: If you hook up the accesspoints to your cabled network, put it in a dedicated security zone (means: VLAN and IP-network) and let your pfsense deal with the routing and firewalling.