@stephenw10 Seemingly peering at major IXPs around the USA, but it's a small local ISP. And it's not just a gimmick. The bandwidth is very stable and these routes seem to continue to function even when there's regional internet outages. Of course with enough money, you can get your own fiber, but we're talking about each IX being thousands of miles away and the podunk ISP has ridiculously low prices. Private MPLS comes to mind, but I have always assumed that to be very expensive and reserved for high tech companies like Google or Amazon where latency matters. I do enjoy when situations like "Battle.Net is down for the entire Midwest due to routing issues" and I'm unaffected. And peering disputes seem to be a thing of the past. It seemed like once every few months, some congestion issue between transit providers would occur in some of my routes. But now that most everything is just direct peering and all of the traffic is effectively "tunneled" over from private route, it's been an issue of the past. Even without IX peering. Pick a game server on the west coast 1 <1 ms <1 ms <1 ms pfsense.localdomain [10.255.42.1] 2 <1 ms <1 ms <1 ms 192.168.1.1 3 2 ms 2 ms 2 ms redacted 4 2 ms 2 ms 2 ms redacted 5 3 ms 2 ms 2 ms ISP redacted 6 13 ms 13 ms 13 ms 4.71.102.197 7 62 ms 62 ms 62 ms 4.69.202.241 8 62 ms 62 ms 62 ms 4.28.172.102 9 62 ms 62 ms 61 ms 159.153.68.252 Routes look a lot different to me from just a year ago.

So magically my Hyper-V host now has an IPv6 address and IPv6-test.com seems to work for me 100% from it w/o making any changes, not even a reboot of either the host or FW. I still have the issue where my Win10 laptop performs intermittently, but works if I bounce to another access point and continues to work even if I bounce back. Just weird. At any rate, I have noticed that from all machines the test results list my IPv4 WAN address, but all the IPv6 addresses are machine-specific. Is there a short answer to this or is it just how IPv6 works? The range assigned is not the same as the WAN v6 address. Thanks for any replies.

Hi Derelict, Thanks for the answer. I get a / 64 from my ISP and that is also true when I look in the log you mention. And after I have set these check boxes mention above it is working :-)

Why would anyone here know anything about compatibility with sophos, windows server, Cisco and untangle? You generally get a module compatible with your hardware, not the software. You would need to specify the type of fiber, generally multi- or single-mode. Anything from 10Gtek, fiberstore, addon, etc that matches up with your hardware should work fine. You probably want something intel-specific. Why are you asking about a 10G module then listing 1G hardware?

Nevermind, this was my mistake with testing I was trying out different things with the host file as well. Thank you for your help!

@mikeybs I guess it was the VoIP traffic shaing, I removed it and download speeds are now 10MB/s not sure why....

Your saying stuff behind pfsense doesn't have internet.. Just at a loss to why your vip would be .6? Whenever you setup a carp or hsrp or anything where there is a vip that is moved between 2 devices.. It is almost always in sequence with the actual physical IPs .1 .2 .3 would normally be the vip.. .252 .253 .254 would be the vip etc.. Where did you come up with .6???? and .1 and 3 for your physical??? So if your traffic comes in from some other path and not through the cluster, and your trying to use the cluster as your gateway for the webserver - then again NO shit its not going to work.. What I would suggest you do is get 1 pfsense working... Then graduate to a HA setup.. If your going to use some other path to and from internet or other networks, then this path needs to be connected via a transit network off your pfsense box.. Again I suggest you DRAW!!! your network so we are all clear how you have everything connected.. You understand for port forwards to work you would need them to point to the wan carp VIP!! this looks like you have your pf1 and 2 in line with each other? Traffic hits your wan carp vip, and would be forwarded to your webserver IP. dns load balancer >> pf1 - pf2 >> webservers

Here is a generic guide on how to run any VPN provider as a WAN connection: https://www.netgate.com/resources/videos/openvpn-as-a-wan-on-pfsense.html Jeff

Did you reset the states for that ip address to be blocked? Pre-existing states are not affected by new rules or modifications to current rules.

Again it boils down to LAN security, and it's easy to get hung up on endless onion layers when it might be overkill for your particular environment. Is your LAN used by hostile actors? Or is it a home LAN used by you, the wife and kids? Is the data you're trying to secure that sensitive? These are all questions that need to be answered before you can choose the correct approach.

@anttechs said in I got Hacked By Unlock through my Borrower: I did try squidguard but I couldn't get it to stay running so I'm guessing it was because I didn't install squid? Yes, squidguard relies on squid to be installed first.

@chrispeddler said in Combine Internet Speed with Pfsense!: Then you can combine them by grouping together. Still it is NOT 3x10=30Mbps or 2x10+1x20Mbps = 40Mbps. People have to understand that outbound WAN loadbalancing will not double/triple/x-tuple their speed depending on their bandwith but will balance multiple clients or client connections over those links to better saturate every one of them. But you can still end up using a line that is saturated ATM as there is not deeper intelligence in outbound routing that detects e.g. link 1 is used 100% so take link 2 or 3. Also connections that only does single connections will not gain much speed (if at all) and if your application/client is sensitive to IP address changes that can be a PITA, too.