Thank you for the replies. I did do the things you suggested. It turned out I had two firewall rules for the DMZ. One allowed all TCP traffic. Another allowed all ICMP traffic. Of course, DNS uses UDP. I added UDP to the list of allowed traffic, and DNS worked great. Then I had trouble with Windows Update (Microsoft Update). At that point, I just allowed all protocols, and now that works, too. I'm in the process of figuring out the virtual IPs, and that seems to be working. Thanks a lot!

We'd really need a lot more information.  Nothing you've posted gives any indication of malicious activity or supports your theory.  The IP you posted is a transit IP range internal to APNIC, which clouds the issues further. Exactly what makes you think your network was under attack?

I got it, they changed the IP address from what they use to have. One day a few weeks ago it stopped letting us in. Last night I did a trace route  and the IP came up as different then what I had. I put the new IP in the SNORT: white list and it works. Now everyone can stop yelling at me and I can go back to reading their email.

http://forum.m0n0.ch/index.php/topic,2199.15.html Follow this guide maybe it helps. Beaware that igmproxy isalready in pfSense and is a patched version for working better.

ok, What I forgot to mention is, I'm anticipating the change of our internet line, and might need a decent firewall instead of routers installed now. And I like the package approach of pfsense. is it possible to use pfsense now as squid/squidgard, and after use is a firewall/router ? My main problem is that I cannot setup pfsense as a NATrouter for the moment, but I'd like to force traffic from workstations to go through pfsense to filter/av/monitor what's going on my network. is that possible ? Any hint from where to start ?

jimp, thanks, that is all I was looking for, a simple estimate or basic idea other than when its ready. I must say, this must be a big deal. I don't ever remember at anytime pfsense has not had at least some sort of new beta or RC every other month, so pushing into over a year must mean this new version is going to be somewhat different. I personally have not looked at the 2.0 betas or anything, but if we see an RC by the end of the year that would be awsome. Maybe the RC can be the 2010 Christmas present such as 2.0 going into beta in 2009 ;) Thanks again for your reply.

I can't really say how to fix your ISP issue, it may be a DNS issue, use Google's DNS instead, 8.8.8.8 / 8.8.4.4. Disabling bogons may also help.

Oh lawdy I just had to replug the modem while pfsense was on… which is also stupid, because it worked great on my laptop or any other pc, oh well... that's 4 hours wasted  :P

What are the specs of your pfSense box? Then- Id wonder if you have enough states set…  "System/Advanced/Firewall Maximum States" Default is 10,000. Look at "Status/System/State Table Size" and see what that reports during your test.

Hard to say what might have happened. Might need to see a copy of the config from after configuring the VLANs and before rebooting, if there is any way to get it.

@hassankazmi: If i give static IP on client side i remain unable to access internet services. Not a DHCP issue then, unless you have the DHCP server set to only allow certain clients in an 'allow' list.

I decided to just try a fresh install.  Thanks anyways.