Hello,
Yes, it is possible.
You may set up the external interface of your PfSense VM in vmbr0 and let him take the outside traffic from there, and set up rules to let it redirect certain incoming ports to vmbr1 for instance, where your web servers VM may be connected. Those in return could connect to database VMs on another bridge through PfSense, say vmbr2, but external traffic would not be allowed to do so.
However, an attacker gaining access to your hypervisor or to your PfSense VM would also gain access to your entire network setup, so the security level you can reach inside a hypervisor can't possibly be the same as when a DMZ is physically separated from other networks.
In any case, I'd advise you to pay particular attention to administration access to the hypervisor itself.
Kind regards,
--
Guillaume Delanoy
