This forum is for General Discussion.  if you need technical support, try the Support forums, specifically the Cache/Proxy forum.

Don't rule out that the gateway itself just doesn't like responding to pings. While highly correlated, some hardware accelerated devices can forward packets fine, but actually responding to pings requires the severely limited host CPU to do work.

You could always look for 2Gb fiber from Comcast, but for $300/mo.

;)

Pretty much answered here

https://forum.pfsense.org/index.php?topic=117943.msg653538#msg653538

FreeBSD 11 is making things crazy

So you answered this thread a year later??  Kind of pointless…

am wondering of there is any one trying to help otherwise am still waiting

Perhaps you should post your problems in the pfSense English Support section, and not General Discussion.

By default you will get automatic NAT rules for traffic from each internal LAN as it goes out WAN.
You can change to manual NAT if you like, and then put whatever NAT rules you like (or no NAT rules).
Since server2, server3, server4 have IPs in private address space, then I assume they only talk within your intranet (because without NAT assistance they cannot talk to public IPs). If that is so, then you probably should put block rules on lan1, lan2, lan3 to stop any packets with source server1,server2,server3 and destination public IP. If you don't do that, then the servers can still try to access public IPs, the traffic will not be NAT'd and packets with private source IPs will head out WAN. The internet routers will drop them, but it seems a waste to even send them in the first place.

BBCan177,

confused only two easy list from DNBS EasyList inbuilt?

7.png_thumb
7.png

(Not related to the printer/FreeNAS topic) - you do not need all those "extra" rules on each interface, with source=SOMEOTHERnet destination=THISnet - nothing will ever match those, because traffic arriving from THISnet will have source in THISnet (not in SOMEOTHERnet)

You have general pass-all rules at the top of each net, good for getting the printer/FreeNAS working. But you also have rules down the bottom that direct general traffic to a gateway (those rules will not have any effect just now, because the top pass-all rule will be matching all the traffic). But if you do remove the top pass-all rule at some point, then all the traffic is going to get dire cted to a gateway or gateway-group. That will mess up access to the printer/FreeNAS. So you will need a rule at the top with source THISnet, destination LANnet to pass "local" traffic between subnets without pushing it to a gateway.

Your rules should work OK (and they do, because you can do other stuff between subnets). So you really need to setup your printer to have the pfSense LANnet IP address as its gateway - you have to do that somewhere on the printer setup screen or whatever.

yup its that easy - worth also thinking about using pfblockerng to maintain the lists which allows use of AS numbers which can be helpful for larger sites etc.

Hi, new to this as well. Im going to try this next weekend hopefully.

https://forum.pfsense.org/index.php?topic=110177.0

See the post in the middle by treer.

1.  This forum is for general discussion and not for posting problems.  For errors with the Zabbix package, please look at the Packages forum.

2.  Have you configured it with Server IP, Active Server IP and hostname?  I noticed that it timed out for me until I specifically told it which interface to listen on (LAN instead of all).

anything with enough network cards & other hardware that runs pfSense. (check the pfSense store or the hardware section of the forum)

So you want to stop someone from causing problem by purposely setting a dupe IP for your gateway?  Yeah use a NAC/NAP to prevent such people from getting on your network.

I don't even have to set a dupe to cause problems, just need to flood the network with gratuitous arps pointing to the wrong mac for the IP, or answering arps very quickly with the wrong info, etc.

There is nothing you can do on pfsense to stop this if that is your question.. Since pfsense has nothing to do with traffic that happens on the network of a specific segment it might have an interface in - it is just the gateway off that segment and yeah it can firewall traffic it sees on its that interface for somewhere else.

On a host level you could setup static arps for your gateway or any other IPs on your network, so if someone was giving out bad info you wouldn't pay attention to it, etc.

Indeed boxes accelerating (kind of) protocols like SMB are not increasing bandwidth but are, assuming you have one on each side  ;), sending back local ACK to fight against latency.

Some protocols, like SMB, have been written to work on LAN only and are very verbose, requiring frequent ACK between client and server. By handling ACK at the border of each LAN (faking in fact remote client or server), these boxes are still very useful, whatever bandwidth, if you have network with significant latency.