As far as I see, question is simple as banana.
First, you must understand, do you need pfSense in this scheme or you do not, as mentioned above by bobmc.
Outbound NAT and port forward for your VMs can be performed by ISP modem. So, if you have modem and pfSense, then you have 2 routers. Is it...