@derelict I cant give you more than that at the moment...

We havent received any info regarding the expected implementaton.

@viragomann I thought it would not work because the additional encryption domains, are not local to the Sophos either
But thanks, I will give it a try.

@nazar-pc so interface can be slow of no dns.. So while your dns is in the middle of switching over, or something - yeah you could prob see a slow down in the gui..

Lot of times it like checking for a update, and rest of gui doesn't want to load until that is finished sort of thing.

@johnpoz Yah, I just was about to post that I figured it out. Something must have gotten mucked up with the default gateway which was pointing to the MAC address for some strange reason. I just deleted the gateway and added it back again and boom, working!

Hello viragomann,

yes those were typos unfortunately, it should read (Copy&Paste the Lines :D):
LAN1 (192.168.147.1/24) -> Pfsense ETH0
WAN1 (192.168.3.1/24 Fritz.Box) -> Pfsense ETH1 192.168.3.2
WAN2 (192.168.4.1/24 Fritz.Box) -> Pfsense ETH2 192.168.4.2
WAN3 (192.168.6.1/24 Fritz.Box) -> Pfsense ETH3 192.168.6.2

I will try the helpdesk article

thanks a lot!

Ok. I did. And now I post here, because the static route is too permissive, and restrictive firewall rule doesn’t work.

Can anyone help?

@umtsti
These are the same settings as you posted above.
So I'm wondering, why it would behave different now.

Anyway, these settings only affects pfSense Name Resolution normally, If you have configured your Network as you said above.
However, there might some settings be different. That's why I suspected a DNS issued.

@ricardotestamonede
So you have to configure the Fortigate for Multi-WAN.
You should provide a separate network port on pfSense and connect it to the second WAN of the Forti.

On the pfSense interface allow any upstream traffic.
Consider to block access to the local network if desired.

policy based routing service based routing session based routing

Beleza!!!, vou testar e posto aqui depois.
Meu switch aceita sim, é um CISCO SG300-28P, eu já tinha isso configurado antes do PFsense, só não sabia como proceder com as Vlans, pois tentei fazer isso antes e, como vc disse, fiquei isolado do firewall.
Agora com as suas dicas vou conseguir...

Novamente... MUITO OBRIGADO MESMO!!, Forte Abraço
insta: israeljosemaria

Found some solution on the forum and modified sh script which runs every 15 min for.
ping some host available through riverbed. If no answer then reset states.

#!/bin/bash HOSTS="10.0.20.30" COUNT=10 echo "HOSTS: " $HOSTS echo "COUNT: " $COUNT for myHost in $HOSTS do counting=$(ping -c $COUNT $myHost | grep 'received' | awk -F',' '{ print $2 }' | awk '{ print $1 }') echo "counting: " $counting if [ $counting -ge 2 ] then echo "ping ok" else echo "reset states" pfctl -F state fi done #end

@myster_fr Great!! thank you Sir. Looks like is working according your steps.
Thanks a lot for suggesting the steps.

Hi,

One reco regarding your pfSense VM settings in Proxmox : I'd recommend disabling the Proxmox firewall from this VM's interfaces, as it might interfere with the rules you'll set in pfsense.

For instance, if you allow some traffic on the pfSense interface, but did not also allow it on the proxmox firewall for the VM, then you might run into trouble.

As pfSense is a firewall, there's no point in enabling Proxmox's filtering on top of it 😉

In addition, if the 192.168.7.214 interface is the "outside" (WAN) interface of you firewall, all incoming traffic is discarded by default, you'll have to define explicit rules allowing ICMP for instance for your tests.

@johnpoz Yes, I searched the web for the error and came to the same thought. I disabled Both Nortons and also the inbuilt firewall and it made no difference. Also not using VPN at all internally.

@gertjan Thanks Gertjan!

My 2440, one of the problem machines, crashed. I am going to replace it. Perhaps it has been hardware all along. That little box has problems with the clock on the Celeron. Still, having the information on the location of the code and how the code works for SMTP will be immensely helpful for me on the other machine.