I know i'm a bit late to the party with this but i'm currently looking at trying to beef up security (just purchased a months vpn to try out from P.I.A as a start) and was wondering if something like this could be configured as having 1 wan port connected to my openreach modem then use 2 of the lan ports for 2 seperate wireless routers? I know this may sound a bit silly but i'm just getting into IoT (botnet of things) stuff with the Philips Hue bulbs and would like to keep it seperated from some of my devices which get used for internet banking and the usual buying tat online etc. I did see something mentioned in a Youtube vid about a 3 router solution (1 into modem then the remaining 2 go into the first router) but this seems like it may be a neater/cooler solution.
You can do all that. What you describe can be done with VLANS in pfSense or dedicated ports as dedicated routes. Hang an Access Point (or old router acting as an AP) off one of the NICs and connect your IoT to that Access Point and set routes out. Different AP on a different port for your PCs. Each NIC can be a LAN or WAN however you want, and pfSense can talk to your BT modem.
To be fair if you could do it a lot cheaper with a managed switch and VLANs though