I worked with PFSense for around 2 years now @ home then @ work. Here's my feedback, hoping this will help.
1- The most important thing to keep in mind is to carefully choose your network card if you are going to run a big network. (for fine-tuning, when you have no choice, you can try these tweaks: https://doc.pfsense.org/index.php/Tuning_and_Troubleshooting_Network_Cards )

2- There are few restrictions when it comes to redirection of specific traffic through site-to-site VPN tunnels (when you want your site-to-site remote tunnel to act as a proxy for specific traffic only, full "proxy-ing" works)

3- SNORT is always a good idea as an Intrusion Prevention System

4- for more security, you can run the network anti-virus (ClamAV or others)

Cheers,