Any advice out there? Thanks

I don't know.. I've experimented with MTU as far as up to 9000 on the virtual NIC and the VMware switch and have seen throughput up to about 150Mbps but it's wildly inconsistent. I really got into this thread because I found the original post interesting and was able to replicate a similar issue in my personal (home) setup.  It is not, in fact, a real problem for me as I do so little inter-vlan routing on my home network that it doesn't affect me one way or the other. One thing I can verify is that my shaper config limits inter-vlan traffic; disabling the root queue on the DMZ interface allows much faster throughput during a sustained NFS -> local storage transfer on a DMZ machine from a NFS mount in LAN.  But that's for a different forum.

Have you tried "disable Source/Destination Check" on the AWS pfSense instance?  Just a thought.

Hey mate Massive thank you! I created the same rule for OPT1 and my kali box now sees both pfsense and the outside world! Thanks again Scotty

I had a problem with bridged networks after that update. Checking vmware network config I found that there was no bridged network (settings removed). The solution is to reset the setting thus restoring the bridged connection. After that things worked fine again…lesson learned, don't trust MS here is a link to an explanation as to why this happens... https://chentiangemalc.wordpress.com/2015/07/09/windows-10-build-upgrades-break-vmware-workstation-network/

You can't if you aren't directly connected to the LAN-side with no NAT. VirtualBox ruins most of that all the time.

All the answers above are rights. I just would like to add that if you need some kind of sniffing possibilities, you can add another port in your vswitch with VLAN 4095. Authorized promiscuous mode on this port only. Attach to this lan your sniffing machine in stealth mode and you have some kinds of span port on your switch without allowing all machines to enter promiscuous mode.

Thanks that has given me confidence to go forward with just 2x ports.. Is it difficult to setup the vlan in esxi? I've found rough text guides but nothing too detailed, do I need to create a route for the vlan so I can access the network over my main LAN? Thanks again

I've fixed this issue. For anyone wondering it was network drivers on the Hyper-V host (or lack of!)

Update –  I decided to start from scratch without importing the entire backup from the working standalone server. Instead, I created a new VM from the current 2.3.4 and established a working (albeit sparse installation).  From there I restored individual sections of the backup, each time rebooting to assure there was not an error encountered in the restore of the individual section.  As it turns out, all went well and all the sections/modules are now installed again and working flawlessly. With the above, the only thing that I can think of is that the complete restore process has some issues.  Perhaps someone can help with debugging the complete restore process.. Anyway, thanks for the help.

I've had some initial success getting pfSense 2.3.4 running on Oracle Compute Cloud.  It requires several manual changes to the configuration before launching the image on Oracle Cloud A few pointers so far: The interfaces names change from em0 to xn0 because VirtualBox and the Oracle Compute hypervisor use different drivers. Oracle Compute is Xen based and pfSense uses the Xen PV-HVM drivers by default for the nics.  The WAN and LAN <if>setting in the config.xml must match the interface names the image boots with on Oracle Compute</if> If the interfaces are not pre-configured correctly pfSense prompts to start the setup on the serial console, but Oracle Compute has no direct console input so the boot halts without any interfaces setup. Both a WAN and LAN interface need to be defined for pfSense to fully boot.  The LAN interface defaults to 192.168.1.1, this needs to be set to correct IP network interface that the instance will be launched with, note the 192.168.1.1 address can't be used even if you create a 192.168.1.1/24 IP network as the first address is allocated for use for the default IP Network routing The default dhclient for FreeBSD 10.3 has issues with the pv-hvm drivers and Oracle Compute due to an issue with TCP RX checksum offloading, which results in the interface not being able to get its IP from DHCP - one workaround is to set hw.xen.disable_pv_nics=1 in the /boot/loader.conf.local, or use manually assigned IP on the interface If you are using pfSense with the WAN interface on the Oracle Compute shared network all traffic is blocked be default as pfSense filters private and bogon ip address ranges on the WAN interface. The Oracle Compute shared network uses a 10.x.x.x range, with floating public IPs. The fix is to remove the <blockpriv>and <blockbogons>from the wan section in the config.xml</blockbogons></blockpriv> Enable sshd to allow remote administration To allow management over the WAN interface add a rule to enable inbound ssh and http(s) traffic To access the webConfigurator over the WAN interface enable the <nodnsrebindcheck>and <nohttpreferercheck>options in the <webgui>section of the config.xml</webgui></nohttpreferercheck></nodnsrebindcheck> The pfSense dhcpd configuration should be disabled as DHCP is already provided in the Oracle Compute Shared and IP networks

@MaximMasiutin: OpenBSD appears to support the vmware paravirtual scsi driver using the vmwpvs driver. Can this driver be installed into freebsd? No, OpenBSD and FreeBSD are two different animals. OpenBSD diverged from NetBSD which itself wasn't based on FreeBSD. The KPI/KBIs are very different and the drivers from one OS can't be used on the other.

I was able to get SR-IOV running; you need a setting in boot/loader.conf as described here https://lists.freebsd.org/pipermail/freebsd-bugs/2015-October/064355.html Even without using SR-IOV this improves the performance. I am able to measure rates about 8 Gbit/s at MTU 1500 using one system on esxi. However it seems to be difficult to reach more than 5 Mpps using Freebsd on a hypervisor. [image: 170518_Throughput.PNG] [image: 170518_Throughput.PNG_thumb]

You would have to add static routes for the VPN'ed subnets to your clients or, ideally, to the physical pfSense router.

Recently having issues with my IPSec tunnels to my AWS VPC created with the "AWS VPC VPN Wizard", I opened a ticket with AWS support. I ended up sharing my IPSec settings and logs with AWS VPN support. They wrote me back an informed me that the IPSec tunnels were not configured correctly! AWS said that both tunnels were not supposed to be active at the same time, and their logs and my logs showed that traffic was traveling across both tunnels. They said that only one tunnel was supposed to be active and have traffic routed over it, and the second tunnel was only to be a standby to be used if the first tunnel was down or not passing traffic. I have opened a ticket with NetGate (the current developer of pfSense who offers commercial support), to investigate these issues. I'll post back the results of their findings here.