You'd best do this on a dedicated Linux or Windows server, assuming the DHCP relay functionality works fine.

What do you mean by "unable"? If it's anything like Workstation, you just choose the physical adapter and a VMnet to bridge in the standalone network configuration tool.

You should consult the manual for a more definitive explanation than my guess: Untagged ports means switch doesn't send VLAN tags and doesn't expect to see VLAN tags on received frames on those ports and Tagged ports means ports on which the switch includes VLAN tags on output and expect VLAN tags on input frames. Therefore I expect you should make port 1 Tagged on VLAN 10 and port 2 Untagged on VLAN 10.

@rider641: Indeed, after obtaining an IP address using DHCP, the device loses it after a few minutes and never seem to get a new address. Sound like a device problem: what sort of device - phone? tablet? PC runinig …?\ What does the pfSense DHCP log say around the time a device "loses" its allocated IP address? What does the corresponding device log report?

Well I have not internal DNS server, I use those provided by ISPs I have three different ISP with different DNS Servers, If I manually configure IP in my laptop with each of these ISP and change LAN rules to send all traffic from my laptop through respective ISP gateway the domain resolves correctly. If I put pfsense as DNS server in manual configuration It resolves wrong. My question is what could I check in order to verify how dns is working? Thanks.

On GitHub, BSDperimeter changed to pfSense a while ago. So the link is now: https://github.com/pfsense/pfsense/commit/8d8f00903f5fe8992cc84ea2cbbc778492038957

"All I am really trying to do is create a DNS entry for our upstream proxy so if the IP changes in the future we just have to edit our DNS entry rather than manually change the proxy settings on the clients." For the ability to point clients of one type or another to some distant server with a changeable IP, consider using some sort of dynamic DNS service at the server side.  In your case the proxy server side.  Thats how most people handle servers with dynamic IPs.

@jimp: Manually naming them won't be an option. On 2.1 they do include the actual interface name, now, so they're easier to interpret. Interface name would be perfect  :D

@jimp: pfSense 2.1+HAproxy-devel + Browser SNI support will let you distinguish based on the hostname, but that's probably as close as you'll get. Thanks for the replies, guys. Also, the information regarding SNI. The NAT rule along with a Firewall rule permitting this is currently working for external users. But I will definitely look into HAproxy and its features as an option for the future.

I was able to install Avahi on the Alix box (running 2.01) after disabling the RDD graphing so I suspect that it may simply have been a lack of free memory that was causing the problem.

I also wouldn't put it outside the realm of possibility that an ISP that is idiotic enough to intercept 53 would also intercept 5353.

Try without the "–"  ;)    ??? alias=2a01:111:f406:1006::81,65.55.18.81 bogus-nxdomain=2a01:111:f406:1006::81

It's in pfSense 2.1 I don't know how widely used/tested it is, but it's there.

If you want a dirt cheap unmanaged gigabit switch, take a look at dynex 5 and 8 port gigabit switches.  They seem to pay customers to take them off their hands.  I have 2 for kids that are going strong for several years. Last night I was playing with iperf on the kids computer from his room and pulled about .8 ~ .9 gigabit connection across one. Works ok if you just need more ports and not VLAN off it.  (Not sure where the other .1 gigabit got too.  I'm looking for it) Ebay…

Works like a charm with 2.1 RC1, lots of good improvements btw thanks !

Hello, That's exactly what it was - duplicated IP address of a PC on the LAN clashing with the firewall. Traced it by watching the mac address of the gateway (pfsense) appear to change from the perpective of the client as it dropped off the arp tables. Did not notice it earlier as the admin was done via another interface and that stayed up.

"I've 2 AD-DNS" I assume those are Windows – upgrade those to 2012, there you go failover dhcp without increase in your number of windows servers.

@Craigusoz Looks like you are absolutly right. I do not see any reason why blocking other DNS servers on firewall rules if you have a NAT rule setup. But I never tried it myself. But I think that the wiki shows a way to block DNS servers other than pfsense - but not redirect these requests.