I have now more interesting details… http://www.cloudshark.org/captures/9ebde8d4aac7 This is a partial capture of a FTP session, fully done over telnet. Partial because greetings and login are missing, and also several previous succesful attemps. I'll explain later. Client is 10.12.3.11, server 10.12.8.136, connected over 10.12.8.253, pfSense box. On packet 21, you can see passive mode is asked. Then on packet 129, LF is sent, to validate a "list /backup/". At that point, I issued a "telnet 10.12.8.136 50065". Packet 133 & 134 are the SYN packet from 10.12.3.11 relayed over 10.12.8.253 to 10.12.8.136. Packet 136 shows the reply (SYN ACK) from 10.12.8.136, and packet 135 shows that 10.12.8.253 tells 10.12.8.136 that 10.12.3.11 is not reachable. Nothing new, was visible in previous capture. (Don't mind that packets 136 & 135 should be inversed). 3 seconds later, then SYN ACK is sent again and ignored. And again 3 seconds later (packet 140) Some seconds later, I issued again a "telnet 10.12.8.136 50065". And what do you see? 146 & 147 are the SYN, and miracle, 148 & 149 are the SYN ACK being routed! And then you can see everything works fine, directory listing is tranfered. Above, I said I had several succesfull attemps, because as long as I try to connect twice to the passive port, the 2nd attemps always succeeds. Interesting, isn't it?

My Static Rules is Interface : LAN Destination network : 90.0.1.0/24 Gateway : 90.0.0.201 yet still i cant manage to get my LAN2 connect to the internet. here my manual outbound.  

we have different subnets like 172.17.1.0  255.255.255.0 gateway: 172.17.1.1 172.16.1.0 255.255.255.0 gateway: 172.16.1.1 172.30.1.0 255.255.255.0 gateway: 172.30.1.1 172.20.1.0 255.255.255.0 gateway: 172.20.1.1 the gateway ips are the vlan interface ip's on the pfsense router.

That worked! Thank you very much!

I have to use the VPN Router from our provider - so I can't move the VPN over to PFSense :-( Flemming

@GruensFroeschli: Without knowing the rb750: to me it seems as if the rb750 has an integrated switch which is not VLAN capable. You simply need a VLAN capable switch. The default configuration is one wan port, and four ports configured as a switch. RB750G can be reconfigured to have five independent LAN ports. In the following manual pages, you can see that the switch chip in RB750G supports VLAN. http://wiki.mikrotik.com/wiki/Switch_Chip_Features Additional VLAN features can be configured in MikroTik RouterOS, for example VLAN trunking (feature called service-tag in RouterOS). http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN RB750G is a very feature rich and powerfull router/switch. If you only need a VLAN aware switch, take a look at RB250GS. http://www.routerboard.com/index.php?showProduct=101

For OPT1 did you add your "allow ICMP' rule as well? Post your LAN– WAN firewall rules ,,,either copy/paste or screenshot them Does WAN work as expected? Barry

On 2.0 you can do it by either picking 'address' for the type, or just enter x.x.x.x/32 for a single IP. On 1.2.3 just do x.x.x.x/32.

thank you very much.

cirkit, Thank You for the informative response! I will give a try what solved this prob for you on our pfSense box and report back when this same problem arises. Take Care, barry