pfSense

The scenario:
pfSense is launched in a cloud provider (like AWS or Hetzner). By default there's only one interface - WAN. There's no way to assign the 1st IPSec P2 VTI to an OPT interface. It's always assigned to the LAN (/usr/local/www/interfaces_assign.php):
/* find next free optional interface number */
if (!$config['interfaces']['lan']) {
$newifname = "lan";
$descr = "LAN";
} else {
for ($i = 1; $i <= count($config['interfaces']); $i++) {
if (!$config['interfaces']["opt{$i}"]) {
break;
}
}
$newifname = 'opt' . $i;
$descr = "OPT" . $i;
}