Reply to PPTP originated traffic exiting via default gateway

Hi all,

I have problem with routing as described in the subject. Even if this is running on pfSense, I am trying to understand what is going on in shell with tools available in vanilla FreeBSD, so this is not so alien post here. I also have spare HW to test proposed configuration changes with FreeBSD instead of the pfSense.

pfSense 2.3.2-RELEASE-p1 (nanobsd) running on the ALIX platform with 3 LANs. One is uplink to ISP with DHCP client, second is one customer, third second customer, who is not part of our problem. First customer needs more public IP than his ISP can allocate to him, so he negotiated /28 network from another company, to which we "call" using PPTP. MPD5 can connect there, however I am not able to force system to take gateway associated with this link into account. When I have traffic incoming via tunnel for firewall self (PTPP endpoint), to addresses from allocated /28 subnet mentioned above or originating from firewall, for example ping from tunnel endpoint address, everything is outgoing using vr0 where default gateway resides. I tried to do nothing, only allow all traffic in the firewall rules, setting gateway to other PTPP endpoint for given traffic on the PPTP interface, doing the same but as floating rule first in list and I am getting out of ideas now. Do you have any input where to look for error or what to try next? Do somebody have similar configuration running - FreeBSD 10.3, PPTP client, some traffic going to tunnel, other to upstream using default gateway?

May be of some interest:
- Remote PPTP endpoint and gateway for this tunnel has address and WAN (on vr0) has with 137 being default gateway, but it is /29 network