One issue I can see is one I've had myself, which is with trackers.  Some will not record information from two IPs as the same user for ratio information.  Also, as a thought, it might be best to limit BT to one WAN, so you won't have issues with both connections being throttled by BT traffic.

Another thought, not sure if this would help but I saw that you said that the ISP manages the pirelli box.  You could just tell them to open ALL ports and forward them, and have pfSense manage it from there.  That would essentially be akin to putting the pirelli in bridge mode, aside from really being in bridge mode.

It would be similar to some routers' "DMZ" mode.

I'm not a guru by far, but I think you may need to set a static route in pfSense, and possibly sonicwall as well.  Not sure exactly how to go about that, but maybe one of the people that know what they're doing can give further input?

Many ISPs would block outgoing traffic if the IP is spoofed in that way.

There is no way to really tell an "upload" from a "download" if the traffic is all HTTP, FTP, SCP, etc in both directions, but if your uploads vary by protocol, you could just craft some policy-based routing rules to direct out certain WANs based on the port number.

Just to keep you updated: In my case, disabling the scrubbing function did the trick.

Great!

I reconnected my router and I got a new IP and Gateway with 255.255.255.255 subnet mask.

Thank you very much jimp for taking the time for me and my question. No I can enjoy my vacation ;-)

@lsoltero:

I have uploaded a version of the patch apinger for pfSense 1.2.3 to here…

THANK YOU!!!

"Block private networks" Is only available to be selected and is turned on, on the WAN interface.

"Automatic outbound NAT rule generation (IPsec passthrough)" is selected.

The only other firewall rules are for the port forwards  from the WAN to specific PCs

Do both OpenVPN servers know how to route to the remote network, and are they both configured as the default gateway for their networks?

I am sorry for confusion. This case is resolved.

The problem is with crappy IE whatever version.

In FF and Chrome all messahes on PFSENCE are OK. Just did a cron job according http://forum.pfsense.org/index.php/topic,25732.45.html and all is done well.

Thank You Pfsence forum for a great job. This is one of the best forum site with OPEN source ever used. Thank You guys.

Regards,

MST

I don't see anything in your original post that would suggest that you want to bridge interfaces. Unbridge them and make firewall rules as follows:

LAN interface
TCP  LAN net  *  Server  80  *  *
*      LAN net  *  !OPT1 net * *  *

OPT1 interface
TCP  OPT1 net  *  Printer  9100 * *
*      OPT1 net  *  !LAN net  *  *  *

The above rules assume that your server is listening on port 80 and the printer on port 9100; you'll have to adapt them to your situation. Use automatic outbound NAT.

Your hosts don't need any vlan configuration. If you have hosts plugged into ports 11-15 on the switch and you want them to be on vlan 15, you simply set 'switchport access vlan 15' on fa0/11 – fa0/15 in the 3500.

have you considered putting both WAN interfaces on each pfsense box and use carp to failover?

alternatively, you could have pfsense box 2 be tier2 of a failover on pfsense box 1, and vice versa.  You could load balance and failover also.

I have a similar setup.

WAN – x.x.224.55 (pppoe)
LAN -- 192.168.x.x
OPT1 -- x.x.225.178/30

The client connected to OPT1 is x.x.225.177/30.

Automatic NAT is turned off in pfsense and I have created an outbound NAT rule on WAN for 192.168.x.x, so the host on OPT1 is routed without NAT.

That takes care of the routing. Now for the vlans. I'm a little less familiar with vswitches, but on the pfsense side I would use one NIC for the LAN and create 2 vlans on the other NIC for WAN and OPT1. You'll have to do something in esx to trunk the 2 vlans to the one NIC.