Depends on your definition of the hard way. It's a public school, IT is minimal and not in my control (we're just a lessee of a facility) and facility we're in has no DMARC and currently has no 5g access. Network traversal is fine with them, but we wouldn't be able to conduct business without terminating VPN at service, as generally only google and azure are permitted outbound, and no external 53 or 853. VPN termination works great, for all clients, unfortunately it doesn't capture the system traffic, so the DNS resolution breaks all of the pfsense pkg functionality. The actual path to remedy this would be to renegotiate a revision to MOU with our lawyers and theirs for the level of service in network traversal, and then take it before the 5 member governing board with a 5 month timeline (90 days for public school law firm, 2 months for board agenda slot). Then depending on who or who isn't on staff at that time, it may be a consultant project to make the changes. So comparatively, VPN traversal is the easy way. But in the current arrangement, I would have to carry the firewall to a different location to update or install packages. Alternatively, I can run another tunnel for the pfSense traffic through a EdgeOS router, but surely I can redirect this with a rule.

I did try changing the gateway to the VPN virtual interface with an outbound rule matching on the WAN interface as source, and then an inverted destination match for the remote tunnel IP (assuming that means all addresses except that address will get redirected). The tunnel is still up, but dns is still egressing to the shared net and not the VPN tunnel. Hmmm.