Local Ip = Lan ip 192.168.1.123 - PCs on the local Lan get the best speed and reliably access the zimbra server using the local ip. PC connect through the wan to the server do not have the same reliability issues but use the domain name. thanks for all the ideas on question 2

Actually, that has a dual core (even though firewall only uses one) at 3GHz so that is not the limiting factor. Mine is that I have PCI and it is only half duplex. So the ACKs also have to go back, and if ACK is not received the next packets are held in case a re-transmission is needed. So I only get half speed since I am using 2 PCI buses. I would use the PCI NICs for WAN (Unless it is gigabit WAN) and the PCI-e for LAN. WAN tends to be slower than LAN speeds. Good luck.

@briankkatz: Can we install and configure pfSense version 1.2.3 in a home network.   ??? What would be the Hardware specifications. Hmm. Can't tell if this is spam…. The question seems legitimate if misplaced and basic but the store link seems like spam. [image: notsure.jpg] [image: notsure.jpg_thumb]

yes i am running squid on 3128 and also i tried using it on transparent mode, but my problem is that when a user knows about squid and direct their proxy to 3128 they bypass my cp even if i change its port it can be easily found. is it possible for this setup ? squid "transparent" (192.168.1.1)–-- >CP (192.168.2.1) ------- > Workstation (192.168.2.0/24) is it possible for the workstation to use squid even if they are not on same subnet? and also for this scenario i will be using squid in transparent mode

@Gertjan: Btw, I presume that more then 33% of all the visitors on this site that post messages use IEx … Looks like a lot less… @cmb: IE as a whole is only 15% I guess that anyone who's using pfSense is likely to have at least experimented will other web browsers. Steve

I would say, that it is almost impossible to participate to that survey MySQL server has gone away:SELECT * FROM `lsoc_surveys`,`lsoc_surveys_languagesettings` WHERE sid=69279 and surveyls_survey_id=69279 and surveyls_language='en'

To directly address your question, when I had an issue like this it was because I had saved but not applied my settings in squidblock. Also, I found making a whitelist easy and effective for specific URL's that are being blacklisted I don't want blacklisted. Easy instructions located here > http://doc.pfsense.org/index.php/SquidGuard_package bottom of page, "Exclude domain/URL from blacklist" section. To address your original inquiry, just wanted to put in my 2 cents for anyone who may be going through a similar struggle. I was experiencing somewhat similar issues. I realized that my ram began running out and was beginning to use swap. What I've done which worked great was to remove the pfblocker package with all blacklists there. Now I just use pfsense/squid/squidblock (with the blacklist here http://squidguard.mesd.k12.or.us/ i strongly prefer… all others I was able to find unfiltered porn sites with a simple google search -- found them on the first page of results, actually). The blacklists I use are ads and spyware, this method is far superior to pfblocker for my needs. It not only seems to perform much faster, but it also is extremely useful to give an error message with the included blacklist that's causing the block, rather than just being unable to reach a page completely. I also have found that the blacklist is good enough for my needs to stop using HVAP which has also improved performance. Just my experience, YMMV. Good luck.

Yes, Seems so. I'm installing AVG with the network license we purchased. It's a 2003 server that that I was using to test the pfsense. Dont know why they ran that old os on it, but they usually have good reasons ;) Thread (can be) closed, thanks for answering

Doing aliases you have to create a new alias, of type net, add all the hosts and their ips and then place a rule in the LAN to block traffic to that alias. This is useful also to avoid people being blocked from the proxy but being able to use the chat or other applications.

Duplicate post.

Thanks. I will give NAT a go and let you know if i get it working.

Ok thanks

Thanks CryHavok i will try with latest release kalu

Duplicate of this thread.

Ah ok cool.. i already have done that so good.  I just was wondering if that was right cause i remember with 2.0-RC3 it wasnt updating and i had to change the link for the updates

happen to me 1-2 times when rebooting. dont know what actualy cause this problem

You could add the IPs you want to monitor as gateways under "routing". (even though these probably arent actual gateways). Under RRD-graphs quality you can now see how the delay to these configured pseudo-gateways behaves over time.

/tmp/rules.debug :-) Or, from the command line or Diag > Command: pfctl -sn

Go to system -> advanced -> miscellaneous and set up proxy support