Go with an Alix board, they're reliable, inexpensive and rock solid with pfSense.

A number of users have been successful using Cacti with pfSense as well.  Browse the forums for these threads if you're interested in doing this.

Thanks for the Reply, so basically the theory of the guy with the most bandwidth dominates turned logs off thank you since there where ON argg…  At least there is still some margin left on the connection never thought of traffic being blocked causing an issue... Oh well thats why we have redundant paths... Chris

too late  ;D I kicked out the package for the moment. As I'm a bit far away of the machine I prefer to avoid problems :) Just before the last reboot I tried to delete the logs… In my case df displayed the same 101% full even without the files. I had no time to play, the system was already dead :) so... But don't forget to restart snort after deleting the logs to release the disk space and restart a blank log :) thanks for your help !

Thanks for the response.

Thanks for the quick response, I did setup openVPN and PPTP on pfsense and I don't see any log associated to his account. our basic network setup is everything coming from outside our internal network will goes to the pfsense, so I assumed that all connection from outside the building will goes to the pfsense. I did not notice any abvious network change internally, because I thought maybe he setup a wireless router and this is the place where he login, but no there is no physical change on our network I don't see any hidden router or connection internally. I am thinking my first resource to verify this is through the firewall which is the pfsense, assuming that he was trying to access our network from outside the building.

Also, check the output of "ifconfig -m" on your WAN interface to make sure 10baseT/UTP is a supported media specification for that ethernet card. (It should be, but it's worth double checking)

Note to my last post. The disk usage has raised another 2% since yesterday on my first post I made aout this.

So after playing with it a little more, I did a modem swap and last few days it's been working smoothly, got Motorola Surfboard 5101 instead of another webstar. Thanks Cry.

Use the packet capture facility to confirm or disprove this.  If your packet traffic isn't getting to the firewall, then the firewall isn't the problem.  If the packet traffic is getting to the firewall, check to see where its going (run packet captures on all interfaces and see where the pings are going).

why don't you just start by bridging the dsl modem to make things less complicated on you?

Did you test with the same client? Can you try another test machine without a router at all? (connect directly to internet)

If I recall correctly, some readers of this forum have reported that they have had better results using the dhclient program from FreeBSD 8. I suggest you search the forums for dhclient to see if your problem is "similar enough" to warrant trying the FreeBSD 8 dhclient.

Hey, This fixed the issue.  I appreciate the help.  I am closing this thread.

hi thanks for you answer. in HTTP with IDA it work. About Newsgroup, newsleecher use 50 connections (but from same ip)

If your port 80 is opened it means that you are allowing http access to your internal servers or firewall from the internet. If you are using windows you will forever be attacked by viruses, trojans and stuff like that, it is fact of life on windows. PFsense is a firewall which makes access to your internal network more safer if you configure it correctly. I do believe that it doesn't matter what firewall you use if it is not configured properly it will not protect you the way you expect it. It is best to do more research on firewalling and tcpip as you need this knowledge before doing it yourself. Read more Google more Eric

These questions have all been asked and answered in these forums many times.  As time is of the essence, help us help you by doing the relevant research first.

The reason for the alias can be found here.  It was a way to stop the errors being generated. I just noticed that in the "bounty" post, it was suggested to use an alias of 192.168.100.10, not the 192.168.100.1 that I used.  Maybe I'll try that next, especially as I can reproduce this now. Cheers.

The default LAN rule only allows the LAN subnet, you'll have to open that.