WE have it figured out very well on the IPv4 lists. These are updated successfully each day. The full IPv6 bogons list is a little more troublesome, but it should be complete, dynamic and stable soon.

So basically you're wanting remote VPN clients to go back out of WAN to the Internet? Yeah that's possible, and widely done. Something like running the server-side of a VPN provider, a number of such providers use pfSense.

Lol, is just a home router, plus is such an insignificant thing that I see no harm on doing it. Plus I did this on the secondary router that I am fixing as a spare router, just in case. So for now, this is a toy for me to mess with!  ;D

People may want to be aware of the duplicate question gunan asked.

Please don't start multiple threads with identical questions. I'll lock this thread so that all discussions can take place in the original thread

stephenw10, One of the many options … If the intention is to block a particular browser through Squid, do it directly in the configuration file. Create an ACL like this: BROWSER acl Mozilla browser-i \ (compatible; MSIE ) Should this match MSIE and Mozilla based browsers. []'s Jack

Don't forget to thank the users and everyone else, too. Without the community the project wouldn't be anywhere near what it is today. :-) (And an ever-growing list of Donators/Contributors help, too!)

Local Ip = Lan ip 192.168.1.123 - PCs on the local Lan get the best speed and reliably access the zimbra server using the local ip. PC connect through the wan to the server do not have the same reliability issues but use the domain name. thanks for all the ideas on question 2

Actually, that has a dual core (even though firewall only uses one) at 3GHz so that is not the limiting factor. Mine is that I have PCI and it is only half duplex. So the ACKs also have to go back, and if ACK is not received the next packets are held in case a re-transmission is needed. So I only get half speed since I am using 2 PCI buses. I would use the PCI NICs for WAN (Unless it is gigabit WAN) and the PCI-e for LAN. WAN tends to be slower than LAN speeds. Good luck.

@briankkatz: Can we install and configure pfSense version 1.2.3 in a home network.   ??? What would be the Hardware specifications. Hmm. Can't tell if this is spam…. The question seems legitimate if misplaced and basic but the store link seems like spam. [image: notsure.jpg] [image: notsure.jpg_thumb]

yes i am running squid on 3128 and also i tried using it on transparent mode, but my problem is that when a user knows about squid and direct their proxy to 3128 they bypass my cp even if i change its port it can be easily found. is it possible for this setup ? squid "transparent" (192.168.1.1)–-- >CP (192.168.2.1) ------- > Workstation (192.168.2.0/24) is it possible for the workstation to use squid even if they are not on same subnet? and also for this scenario i will be using squid in transparent mode

@Gertjan: Btw, I presume that more then 33% of all the visitors on this site that post messages use IEx … Looks like a lot less… @cmb: IE as a whole is only 15% I guess that anyone who's using pfSense is likely to have at least experimented will other web browsers. Steve

I would say, that it is almost impossible to participate to that survey MySQL server has gone away:SELECT * FROM `lsoc_surveys`,`lsoc_surveys_languagesettings` WHERE sid=69279 and surveyls_survey_id=69279 and surveyls_language='en'

To directly address your question, when I had an issue like this it was because I had saved but not applied my settings in squidblock. Also, I found making a whitelist easy and effective for specific URL's that are being blacklisted I don't want blacklisted. Easy instructions located here > http://doc.pfsense.org/index.php/SquidGuard_package bottom of page, "Exclude domain/URL from blacklist" section. To address your original inquiry, just wanted to put in my 2 cents for anyone who may be going through a similar struggle. I was experiencing somewhat similar issues. I realized that my ram began running out and was beginning to use swap. What I've done which worked great was to remove the pfblocker package with all blacklists there. Now I just use pfsense/squid/squidblock (with the blacklist here http://squidguard.mesd.k12.or.us/ i strongly prefer… all others I was able to find unfiltered porn sites with a simple google search -- found them on the first page of results, actually). The blacklists I use are ads and spyware, this method is far superior to pfblocker for my needs. It not only seems to perform much faster, but it also is extremely useful to give an error message with the included blacklist that's causing the block, rather than just being unable to reach a page completely. I also have found that the blacklist is good enough for my needs to stop using HVAP which has also improved performance. Just my experience, YMMV. Good luck.

Yes, Seems so. I'm installing AVG with the network license we purchased. It's a 2003 server that that I was using to test the pfsense. Dont know why they ran that old os on it, but they usually have good reasons ;) Thread (can be) closed, thanks for answering