Me parece que la solucion mas "elegante" seria colocar un switch administrable antes del PFSense y asignar diferentes VLans para cada puerto y entonces asignar los roles correspondientes. Hay bastante info en el foro y los switches ya no son una limitante por el costo. Lo del usb no se me hace buena idea a menos de que lo vayas a tener en casa.

Claro que ceporro!!! el tráfico dns es UDP!!! Vaya tela, lo siento por daros el coñazo y no darme cuenta de una cosa tan básica. Muchas gracias a todos y tema resuelto.

Saludos Yo tengo un problema idéntico pero es cuando instalo por USB (sea de 32 o 64 bits) Es como si la imagen estuviera mala. Ya que probé una instalación con CD y funciona sin problemas. El problema es que el Proxy transparente no funciona, verifique los squid.conf,  las configuraciones, las reglas de firewall por consola. etc, y nada. es como si el nat interno de que todo lo que va por el 80 lo pase por el 3128 no tuviera efecto. Es un caso atípico. Saludos.

@bellera: Publicar un servidor en Internet (NAT entrante, NAT Port forward) https://forum.pfsense.org/index.php/topic,44032.msg239160.html#msg239160 https://forum.pfsense.org/index.php?action=dlattach;topic=45660.0;attach=20516;image Ver (con el mismo nombre) servidores publicados en Internet System - Advanced - Firewall/NAT - Disable NAT Reflection (no si se superan 500 puertos o se usa NAT 1:1) A partir de pfSense 2.2 - Services - DNS Resolver (unbound) - Host Overrides (método recomendado, split DNS) Services - DNS Forwarder (dnsmasq) - Host Overrides (método recomendado, split DNS) https://forum.pfsense.org/index.php/topic,43113.msg223228.html#msg223228 https://forum.pfsense.org/index.php/topic,33289.msg173400.html#msg173400

@bcalvo: estaba poniendo DNS que no tenían salida a Internet ¡Me alegro de que encontraras el fallo! Los errores DNS son bastante habituales y pensamos en que es alguna regla, el proxy… pero no. Muchas gracias por la ayuda lo del Aliases funciona muy bien. ¡De nada!

La cantidad de usuarios es un dato relativo, pues depende de lo que hagan. Un solo usuario con P2P (Ares) puede tirarte por el suelo una conexión de 5 Mbit/s Además… @bellera: ¿ Proxy transparent (intercept para squid 3.x ) + Portal cautivo ? No creo que funcione eso. Piensa en un equipo para portal cautivo y otro detrás para la función de proxy transparente. Puedes virtualizar ambos, si quieres ahorrar hardware.

También vi ese error pero no le hice caso, pensando en que el usuario había "enmascarado" la dirección de correo, a fin de no revelar la real.

@alextech0x: Sin embargo cuando acceso al servidor con HTTPS dice Respuesta Vacia ( tamaño cero ) y todo eso que ustedes seguro ya saben. A que se debe esto? Si es transparente el tráfico https no pasa por el proxy, a menos que tengas squid 3.x y actives SSL Bump (man-in-the-middle) Creo que el error debe estar relacionado con alguna de tus reglas en LAN.

Vuelve a caerse el tunel  :-\ ya no se que hacer. a ver si alguien majo sabe que pasa. 8) Gracias Tengo 2 tuneles configurados Tunel con el que tengo problema, ahora está desconectado túnel 194.xx.xx.xa pero aparece como activo. Tengo cortado el acceso a la ip 195.xx.xx.xx Pero aparecen intentos de conexión. Por otro lado tengo otro pfsense al que no le hago los nateos en el router y conecta con el remoto. De hecho cuando falla la conexión desde este firewall tengo que conectar con el otro (si funciona, que no siempre, dejo la conexión así y genero reglas de enrutado. A veces conecta pero sin trafico y deshabilito y vuelvo a conectar desde el primero y entonces vuelve a funcionar durante un tiempo. Pfsense 2.2.2 May 21 19:43:36 charon: 06[IKE] <59759> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:43:36 charon: 06[IKE] <59759> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:43:36 charon: 06[ENC] <59759> generating ID_PROT response 0 [ SA V V V V ] May 21 19:43:36 charon: 06[NET] <59759> sending packet: from 192.168.150.1[500] to 195.xx.xx.xx[500] (152 bytes) May 21 19:43:41 charon: 06[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:43:41 charon: 06[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:44:02 charon: 16[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:44:02 charon: 16[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:44:06 charon: 16[JOB] <59759> deleting half open IKE_SA after timeout May 21 19:44:16 charon: 16[NET] <59760> received packet: from 195.xx.xx.xx[500] to 192.168.150.1[500] (216 bytes) May 21 19:44:16 charon: 16[ENC] <59760> parsed ID_PROT request 0 [ SA V V V V V V V ] May 21 19:44:16 charon: 16[ENC] <59760> received unknown vendor ID: 4f:45:51:7b:4f:7f:6e:65:7a:7b:43:51 May 21 19:44:16 charon: 16[IKE] <59760> received DPD vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received DPD vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received NAT-T (RFC 3947) vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received NAT-T (RFC 3947) vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:44:16 charon: 16[IKE] <59760> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:44:16 charon: 16[IKE] <59760> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:44:16 charon: 16[IKE] <59760> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:44:16 charon: 16[ENC] <59760> generating ID_PROT response 0 [ SA V V V V ] May 21 19:44:16 charon: 16[NET] <59760> sending packet: from 192.168.150.1[500] to 195.xx.xx.xx[500] (152 bytes) May 21 19:44:22 charon: 16[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:44:22 charon: 16[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:44:42 charon: 16[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:44:42 charon: 16[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:44:46 charon: 16[JOB] <59760> deleting half open IKE_SA after timeout May 21 19:44:56 charon: 16[NET] <59761> received packet: from 195.xx.xx.xx[500] to 192.168.150.1[500] (216 bytes) May 21 19:44:56 charon: 16[ENC] <59761> parsed ID_PROT request 0 [ SA V V V V V V V ] May 21 19:44:56 charon: 16[ENC] <59761> received unknown vendor ID: 4f:45:51:7b:4f:7f:6e:65:7a:7b:43:51 May 21 19:44:56 charon: 16[IKE] <59761> received DPD vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received DPD vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received NAT-T (RFC 3947) vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received NAT-T (RFC 3947) vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:44:56 charon: 16[IKE] <59761> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:44:56 charon: 16[IKE] <59761> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:44:56 charon: 16[IKE] <59761> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:44:56 charon: 16[ENC] <59761> generating ID_PROT response 0 [ SA V V V V ] May 21 19:44:56 charon: 16[NET] <59761> sending packet: from 192.168.150.1[500] to 195.xx.xx.xx[500] (152 bytes) May 21 19:44:59 charon: 11[KNL] <con1000|59586>unable to query SAD entry with SPI ca1cb129: No such file or directory (2) May 21 19:44:59 charon: 11[KNL] <con1000|59586>unable to query SAD entry with SPI 8ef432ca: No such file or directory (2) May 21 19:45:00 charon: 11[KNL] <con1000|59586>unable to query SAD entry with SPI ca1cb129: No such file or directory (2) May 21 19:45:00 charon: 11[KNL] <con1000|59586>unable to query SAD entry with SPI 8ef432ca: No such file or directory (2) May 21 19:45:02 charon: 11[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:45:02 charon: 11[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:45:22 charon: 11[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:45:22 charon: 11[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:45:26 charon: 11[JOB] <59761> deleting half open IKE_SA after timeout May 21 19:45:36 charon: 11[NET] <59762> received packet: from 195.xx.xx.xx[500] to 192.168.150.1[500] (216 bytes) May 21 19:45:36 charon: 11[ENC] <59762> parsed ID_PROT request 0 [ SA V V V V V V V ] May 21 19:45:36 charon: 11[ENC] <59762> received unknown vendor ID: 4f:45:51:7b:4f:7f:6e:65:7a:7b:43:51 May 21 19:45:36 charon: 11[IKE] <59762> received DPD vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received DPD vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received NAT-T (RFC 3947) vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received NAT-T (RFC 3947) vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:45:36 charon: 11[IKE] <59762> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:45:36 charon: 11[IKE] <59762> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:45:36 charon: 11[IKE] <59762> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:45:36 charon: 11[ENC] <59762> generating ID_PROT response 0 [ SA V V V V ] May 21 19:45:36 charon: 11[NET] <59762> sending packet: from 192.168.150.1[500] to 195.xx.xx.xx[500] (152 bytes) May 21 19:45:42 charon: 11[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:45:42 charon: 11[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:45:47 charon: 11[NET] <59762> received packet: from 195.xx.xx.xx[500] to 192.168.150.1[500] (216 bytes) May 21 19:45:47 charon: 11[IKE] <59762> received retransmit of request with ID 0, retransmitting response May 21 19:45:47 charon: 11[IKE] <59762> received retransmit of request with ID 0, retransmitting response May 21 19:45:47 charon: 11[NET] <59762> sending packet: from 192.168.150.1[500] to 195.xx.xx.xx[500] (152 bytes) May 21 19:46:02 charon: 11[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:46:02 charon: 11[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:46:02 charon: 11[KNL] <con1000|59586>unable to query SAD entry with SPI ca1cb129: No such file or directory (2) May 21 19:46:02 charon: 11[KNL] <con1000|59586>unable to query SAD entry with SPI 8ef432ca: No such file or directory (2) May 21 19:46:03 charon: 11[KNL] <con1000|59586>unable to query SAD entry with SPI ca1cb129: No such file or directory (2) May 21 19:46:03 charon: 11[KNL] <con1000|59586>unable to query SAD entry with SPI 8ef432ca: No such file or directory (2) May 21 19:46:05 charon: 07[KNL] <con1000|59586>unable to query SAD entry with SPI ca1cb129: No such file or directory (2) May 21 19:46:05 charon: 07[KNL] <con1000|59586>unable to query SAD entry with SPI 8ef432ca: No such file or directory (2) May 21 19:46:06 charon: 07[NET] <59762> received packet: from 195.xx.xx.xx[500] to 192.168.150.1[500] (216 bytes) May 21 19:46:06 charon: 07[IKE] <59762> received retransmit of request with ID 0, retransmitting response May 21 19:46:06 charon: 07[IKE] <59762> received retransmit of request with ID 0, retransmitting response May 21 19:46:06 charon: 07[NET] <59762> sending packet: from 192.168.150.1[500] to 195.xx.xx.xx[500] (152 bytes) May 21 19:46:06 charon: 07[JOB] <59762> deleting half open IKE_SA after timeout May 21 19:46:22 charon: 07[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:46:22 charon: 07[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:46:42 charon: 07[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:46:42 charon: 07[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:46:46 charon: 07[NET] <59763> received packet: from 195.xx.xx.xx[500] to 192.168.150.1[500] (216 bytes) May 21 19:46:46 charon: 07[ENC] <59763> parsed ID_PROT request 0 [ SA V V V V V V V ] May 21 19:46:46 charon: 07[ENC] <59763> received unknown vendor ID: 4f:45:51:7b:4f:7f:6e:65:7a:7b:43:51 May 21 19:46:46 charon: 07[IKE] <59763> received DPD vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received DPD vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received NAT-T (RFC 3947) vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received NAT-T (RFC 3947) vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:46:46 charon: 07[IKE] <59763> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:46:46 charon: 07[IKE] <59763> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:46:46 charon: 07[IKE] <59763> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:46:46 charon: 07[ENC] <59763> generating ID_PROT response 0 [ SA V V V V ] May 21 19:46:46 charon: 07[NET] <59763> sending packet: from 192.168.150.1[500] to 195.xx.xx.xx[500] (152 bytes) May 21 19:47:02 charon: 07[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:47:02 charon: 07[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:47:16 charon: 07[JOB] <59763> deleting half open IKE_SA after timeout May 21 19:47:22 charon: 07[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:47:22 charon: 07[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:47:24 charon: 07[KNL] <con1000|59586>unable to query SAD entry with SPI ca1cb129: No such file or directory (2) May 21 19:47:24 charon: 07[KNL] <con1000|59586>unable to query SAD entry with SPI 8ef432ca: No such file or directory (2) May 21 19:47:26 charon: 12[NET] <59764> received packet: from 195.xx.xx.xx[500] to 192.168.150.1[500] (216 bytes) May 21 19:47:26 charon: 12[ENC] <59764> parsed ID_PROT request 0 [ SA V V V V V V V ] May 21 19:47:26 charon: 12[ENC] <59764> received unknown vendor ID: 4f:45:51:7b:4f:7f:6e:65:7a:7b:43:51 May 21 19:47:26 charon: 12[IKE] <59764> received DPD vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received DPD vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received NAT-T (RFC 3947) vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received NAT-T (RFC 3947) vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received draft-ietf-ipsec-nat-t-ike-03 vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received draft-ietf-ipsec-nat-t-ike-02 vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:47:26 charon: 12[IKE] <59764> received draft-ietf-ipsec-nat-t-ike-00 vendor ID May 21 19:47:26 charon: 12[IKE] <59764> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:47:26 charon: 12[IKE] <59764> 195.xx.xx.xx is initiating a Main Mode IKE_SA May 21 19:47:26 charon: 12[ENC] <59764> generating ID_PROT response 0 [ SA V V V V ] May 21 19:47:26 charon: 12[NET] <59764> sending packet: from 192.168.150.1[500] to 195.xx.xx.xx[500] (152 bytes) May 21 19:47:42 charon: 12[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500] May 21 19:47:42 charon: 12[IKE] <con1000|59586>sending keep alive to 194.xx.xx.xa[4500]</con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586></con1000|59586> [image: conexiones.png] [image: conexiones.png_thumb] [image: conexiones1.png] [image: conexiones1.png_thumb] [image: conexiones2Phase1.png] [image: conexiones2Phase1.png_thumb] [image: conexiones3Phase2.png] [image: conexiones3Phase2.png_thumb]

Gracias a todos por el aporte…habia olvidado lo de los cambios del "Policy Routing" Gracias @ptt @bellera

Muchas gracias, intentaré instalando un radius.

Voy a hacer estos cambios y comento los resultados. Saludos!

ok pues en cuanto lo tenga montado , os comento como va me pongo a ello, lo hare con 2 maquinas físicas  y os comento los resultados   muchas gracias por vuestra ayuda saludos Jesus

Como comentario/ ilustracion adicional, seria algo mas o menos asi . Se tendria que especificar que el trafico que el trafico de las interfaces MAN no deberan de hacer NAT como lo hace de manera predeterminada.  Y hay que especificar las reglas en cada uno de los firewalls para aceptar o no el trafico que viene de estas interface. Anexo un pequeño diagrama

@bellera: Arriba, en Documentación o Últimas aportaciones a Documentación tienes una entrada que dice: squidGuard con squid3 Ahí tienes cómo configurar y diagnosticar tu squidGuard, paso a paso. Si los procesos squid y squidGuard están correctos postea: 32 bit –-> /usr/pbi/squidguard-squid3-i386/etc/squidGuard/squidGuard.conf 64 bit ---> /usr/pbi/squidguard-squid3-amd64/etc/squidGuard/squidGuard.conf

gracias por la respuesta, soy nuevo por estos lares y quería informarme un poco, por otro lado… es recomendable el almacenamiento extra?

envio ip que sierve aca los chilenos para bloquear el sitio facebook. atte ale.. [image: facebook.jpg] [image: facebook.jpg_thumb]

Para poder hacer la conexión segura se precisa certificado: https://www.loggly.com/docs/syslog-ng-tls-configuration/

Estuve leyendo un poco y al parecer necesitas borrar y crear nuevamente los túneles y reiniciar tus pfs

Solucionado con ayuda de http://unix.stackexchange.com/questions/117023/expanding-the-disk-size-on-pfsense-under-vmware-esxi y https://www.freebsd.org/doc/en/books/handbook/disks-growing.html un saluo