Advise on complicated VPN setup

Hey guys hoping someone can advise on a VPN setup I want to implement.

I have attached an image which helps illustrate what I am trying to accomplish. The IT company I used to work for had a similar setup but they setup each customer with a RODC which connected to a master domain controller.

So the permissions for remote access would be set on the master domain controller and propagate to the RODCs.
I don’t have my clients DCs setup in this method. I believe pfsense can be configured to connect to multiple ADs but I don’t want to complicate things.

Pfsense can be setup with groups and users so the idea is that if someone asks for remote access you just create a new login on pfsense and assign it to the correct group.

I may be wrong and the setup may not be possible, any advice is appreciated.

Technical information:
Each customer has a static IP address and the endpoint is a Juniper SSG5
Pfsense firewall has a static public IP address on its WAN port
Some users are using OSX to remote onto work machines.

Sorry it's been a couple of years since I played with this stuff and I haven't seen the latest pfSense versions, but there is only one thing I am not sure about in your proposed setup:

Will pfSense allow you to configure different VPN users to dial in and see different remote VPN networks?

I have no idea why you would want to do it this way, instead I would let the clients connect direct to their own VPN routers, and only have support staff connecting to your pfSense.

Also if possible I would do some throughput testing out of hours before finalising on a solution. If you are looking at high VPN traffic, you may find it better to run pfSense native rather than on ESXi.

Whatever solution you go for, I would advise first getting a client router and pfSense speaking to each other on the bench, run bandwidth tests on the bench, then install a router at client site for final testing.

IPSEC is the preferred protocol. If your client routers have shitty VPN throughput or haven't got static IP's, then you may wish to think about PPTP, but I believe this is not considered secure.

Thanks for your advise overcarl. I managed to get site-to-site to work to the pfsense box with all the clients. I then configured openVPN on the pfsense box and set it up to route traffic to the specific ipsec tunnel depending on the customer. Its working well openVPN does compression as well which is handy.

I did not setup direct links for clients because it would mean buying an expensive router. OpenVPN is free and considered very secure. I needed a solution which could allow people to remote on their ipads and other devices. I managed to get it to work with DDNS although i force every client to have a static, the server it self is static.

Sorry I'm not familiar with the SSG5, I just assumed Juniper would allow dial up vpn users.

IPSEC can be a pita without static ip's, I looked into OpenVPN but I stuck to IPSEC or PPTP as I found support to be more widespread (well at least with the kit I was using or considering using ages ago).