@martinjsaunders: When I reload the config the group seems to correctly reflect the new privaleges above, missing the Bridge pages (plus a few others I removed), but the pages are still accessable and I can still Bridge interfaces. Have I done something silly? Thanks very much in advance! M. To answer my own question, if I add a new users in the group Admins it inherits the correct permissions. This is fine but I'd rather disable admin for Bridging as well, is the admin user inheriting it's permissions from somwhere else as well?

Historically, "Load Balancing" has applied to both incoming and outgoing. It's only in 2.x that we've split the outbound LB actions into a separate place (Gateway Groups). Sticky applies to both.

You mean use pfsense as a web server? If so, there is a package for it. if you want to do it by Hand, change webgui port, create/copy lighthttp config and start it as a second web server.

Thanks. I'll take the risk, as the web interface is only accessible on a private LAN and through VPN.

….whoops - 3000 is nTOP

Hi ! First things first. Check out this page: http://www.pfsense.org/ This somewhat implies that "2.0-Rc3" is abandoned. So: upgrade  ;)

That's a fairly old version of the code, but yeah that's the part. It actually works fine on Android which is odd because Android's browser and the iOS browser are both webkit. Though the theme may work, the other theme does tend to handle better on small screen devices anyhow, it's really easy to miss the menus when they drop-down.

@cmb: That has no relation to #637 but may be a separate issue, open a new ticket in redmine if you can reliably replicate that. done, Sir! :D -> http://redmine.pfsense.org/issues/2253

Hi, I think that I'm near solution for my problem. As I mentioned I'm using Option Icon 225 3G modem and that is the problem. This modem need its own driver not the one compiled in pfsense (u3g). I compile correct driver (uhso) on freebsd 8.1 to get uhso.ko file, I put that file in boot/kernel and in kernel.conf I added the line uhso_load="YES". When I attach my usb card it try to use uhso driver but it get detached immediately and than reattached and load u3g driver. Can I, somehow, disable u3g driver? This is driver compiled with kernel. Thanks, Nikola

Ok, found the problem. Firefox was defaulting to http.  added https://externalwaipip:8443 and it works! Didnt need the NAT rule in the end.

Really was scratching my head on this one not to worry I was just trying out HTTPS trying to get my router a little more secure so to speak. I accidentally yea locked myself out as I said, but couldn't work out why I couldnt get in when I'd reset for some strange reason it had made 2 rules of the same exact settings for HTTP, hmm weird but oh well I will leave it be for now and when I get back home will work out why. There is an option when I do a setting in the SSH login (remotely in my case) to reset back to HTTP and reset the password but I can't remember actually thinking back to which one includes the HTTP reset, but it did work and thank you again I mean I just deleted the first rule I had of HTTP and it let me back in weird though oh well least it's working now. Thank you ever so much for your help, Jeremy.

Thank you I didn't look deep enough on the firewall rule set. Coming from another FW I didn't have to set any rules to pass traffic.

I do remeber reading something to that effect.Sorry for placing a question already covered. Thank You for your time:)

[Whoops wrong thread] What kind of load is that system under? Does SSH work? Is it fast?

@cmb: Make a list of exactly which parts are missing input validation and open a bug ticket. This would require studying of sources of both pfSense/webGUI and hostapd. ;D But my point is not just about syntax checking, rather than about a major security flaw. What if hostapd crashes while running because of a bug or another issue? What if such issue can be deliberately exploited by an unauthenticated wireless user to crash hostapd? The network would be left widely open to anyone, and you won't know of it until some friendly person receives a warning about connecting to unprotected WLAN and informs you.

Disable gateway monitoring for the gateway in System: Routing: Gateways.

@cmb: Your WAN firewall rules are way too permissive, don't allow SSH from the Internet. what I did is kept the permissions the same but changed the default SSH port, it cut down brute force attempts by 99% also this IP is breaking guiness world of records for brute force attempts and not a single DNSBL registered it yet…. http://ip-address-lookup-v4.com/ip/91.205.189.15