Got myself out of pfsense hell. Finally got this clusterfk going:

- site-to-site wireguard vpn

- remote access to both sites

- both sites and remote access behind mullvad-vpn with no dns leaks