Yeah, this is no easy undertaking. I'd say you could only block typical torrent traffic using L7 - but it would be easy for someone knowledgeable to get around it.

No this is pretty much the wrong way of doing things for what you are trying to do. Let's say for example you have 5 static IPs: One WAN IP out of the 5 will be assigned to the WAN interface of the router private IP scheme assigned to LAN interface. For example: 192.168.1.1 Additional IPs for the WAN can either be assigned by adding them as an additional WAN interface on the router or using different routers and plugging them into the same modem in an available port or by using a switch. From what it sounded like you were doing was you were giving internal workstations/servers public IPs.. why bother even using a router then? All internal devices should have private IP addressing such as.. 10.x.x.x 172.x.x.x 192.x.x.x

@nearones: @cmb: The Dan's Guardian package is the only way of doing that I'm aware of. I have no idea how stable or unstable it is, there is a thread on the packages board on it. Thanks all for your efforts for explaining, but my requirement is different and I am using squidguard. This topic went to Dans Guardian, which is different squid server, which i need to configure completely from scratch. I requirement was to block the users when the users is just typing the search catogory, which should get blocked at the sametime when is has pressed enter. And it seems it does not works with a squidguard, it just works with Dans Guardian. Is there any way that I can use both at the same time? I suppose you could use both, but I'm not sure why you would want to. Dansguardian will also do blacklist based blocking (like Squidguard). I think the only thing Squidguard would give you over DG is the ability to do ACL based time restrictions.

I just tried again and it's working now! Looking at the "System Logs", I see the following line for about 60 times spanned over about 2 minutes. ntop[32105]: WARNING RRD: rrd_update(/var/db/ntop/rrd/interfaces/re1/throughput.rrd) error: illegal attempt to update using time 1337163807 when last update time is 1337163923 (minimum one second step) The following line also appears for about 15 times in the same log: php: : The command '/usr/bin/nice -n20 /usr/local/bin/rrdtool update /var/db/rrd/system-memory.rrd N:U:U:U:U:U' returned exit code '1', the output was 'ERROR: illegal attempt to update using time 1337163734 when last update time is 1337163897 (minimum one second step)' Anyone has any idea whether these 2 issues could be the cause of the problem? Thanks

Yeah, will need either manual outbound, or 1:1, to ensure that server goes out on the correct IP.

Take the gig port and put a limiter on it or similar.

It's controlled by the AnyConnect client, there is nothing you can do. It changes the network stack on that host to enforce the policies pushed by the device it's connecting to.

Thank you, dhatz.  I do find these sorts of papers very interesting. There's nothing quite like challenging "the way we've always done it" and providing a significant benefit as a result.

Thank you very much mamoraes!

Hi Steve, So I tested the URL you sent me, but he now calls perl-5.10.1_1. My pfSense that is running is 2.0.1 i386 command in CLI: uname-r 8.1-RELEASE-p6 Regards

Thanks! That worked perfectly!

Some interesting info here and relatively recent: http://ivoras.net/blog/tree/2011-01-29.who-uses-freebsd.html Steve

@stephenw10: I hear you also have excellent beaches!  ;) Certainly I am biased, but the beaches are the most beautiful in the world! ;) Thanks for the info though, makes me wish I spoke Portuguese. Speaking Portuguese is not so difficult … We have some letters and accents more! :) []`s Jack