I was able to install Avahi on the Alix box (running 2.01) after disabling the RDD graphing so I suspect that it may simply have been a lack of free memory that was causing the problem.

I also wouldn't put it outside the realm of possibility that an ISP that is idiotic enough to intercept 53 would also intercept 5353.

Try without the "–"  ;)    ???

alias=2a01:111:f406:1006::81,65.55.18.81 bogus-nxdomain=2a01:111:f406:1006::81

It's in pfSense 2.1

I don't know how widely used/tested it is, but it's there.

If you want a dirt cheap unmanaged gigabit switch, take a look at dynex 5 and 8 port gigabit switches. 
They seem to pay customers to take them off their hands.  I have 2 for kids that are going strong for several years.
Last night I was playing with iperf on the kids computer from his room and pulled about .8 ~ .9 gigabit connection across one.
Works ok if you just need more ports and not VLAN off it.  (Not sure where the other .1 gigabit got too.  I'm looking for it)
Ebay…

Works like a charm with 2.1 RC1, lots of good improvements btw thanks !

Hello,

That's exactly what it was - duplicated IP address of a PC on the LAN clashing with the firewall. Traced it by watching the mac address of the gateway (pfsense) appear to change from the perpective of the client as it dropped off the arp tables.

Did not notice it earlier as the admin was done via another interface and that stayed up.

"I've 2 AD-DNS"

I assume those are Windows – upgrade those to 2012, there you go failover dhcp without increase in your number of windows servers.

@Craigusoz

Looks like you are absolutly right. I do not see any reason why blocking other DNS servers on firewall rules if you have a NAT rule setup.
But I never tried it myself.

But I think that the wiki shows a way to block DNS servers other than pfsense - but not redirect these requests.

Well its not sucky suddenlink. It has to be pfsense. I did a total restore of Version 2.1. It worked, as soon as I change the DNS from google to opendns it started again. I installed 2.03 like I used to use and it works great. Might be a bug might not be… Could be a setting that I did. Not sure either way 2.03 works great.

Use captive portal with WAP2.

This way, in the future, a person standing to the side can't sniff the unencrypted packets, get your MACs then use the MACs to get a free ride on your wifi.
It won't prevent one of your customers from sharing the WPA2 key though if they purposely want to do that.

@wallabybob:

pfSense should update addresses every 25 days or on a change.

How soon is "TOO SOON" and how long is "TOO LONG"?

Updating more than once within 600 seconds results in a TOO SOON error. The problem is it never attempts to wait and update the address again when receiving this error. So unless the address changes yet again after 600 seconds, it will never be updated.

Basically it doesn't retry after a delay when receiving a TOO SOON error.

Yeah, exactly… A rather heavy approach would be setting up static DHCP leases for everything and configuring the static ARP for everything as well. However, that could be usable in enterprise environment, not with
open wlan, I'm afraid.

Yes I do have static DHCPs mapped.

FWIW, these are those D-Link Green switches. I believe they do stuff with the power to each port in order to conserve energy. I'll look for another switch to test it out.

In tinydns, "Enable recursive DNS responder" means to enable dnscache, its partner in crime that handles recursive queries.

They can't both bind to the same IP, so you tell tinydns to bind to some interface/IPs, and you have dnscache bind to others.

I much prefer the pfSense DNS forwarder (dnsmasq) because it actually works. It's not dnscache's fault it's mostly broken, but few have been interested in fixing that part of the package to get all of the files/syntax correct. And now that it's not really necessary, it may be better to just remove that option.

@kejianshi:

Sounds good, although I doubt the OpenDNS guys would like to think of themselves being "inflicted" on hosts. 
I've been thinking to do something like this myself so that I can not "NEED" Dansguardian on most installs.
I like to keep firewalls as uncomplicated as possible.
If I can selectively apply DNS rules to clients and remove a process from my firewall I'm happy.

I got this working today.  Created a new VM running 2.1-RC0.  Imported config from the old VM.  Then I set up another Linux VM as the 2nd DNS server using BIND in a chroot jail.  Two forward zones: one for the internal network domain which forwards those requests to the pfSense resolver and another for "." pointing to the OpenDNS servers.

I logged into the OpenDNS control panel and set up the content filtering.  Then I set up a new DDNS profile in pfSense to update OpenDNS whenever the WAN IP changes.

Finally, I used the DHCP config options in 2.1 to set the 2nd server as the DNS for the hosts I wanted to filter.  I also tweaked the max TTL cache time on the 2nd DNS to 5 min.  That way when I need to whitelist a domain the users don't have to wait long for it to go into effect.

Now I just need to set up the firewall rules to prevent back doors and I'm done.

Yes, that works nicely.

Thank you!

I chose to use /etc/roundrobin for my file. :)