It seems to have been a DNS issue. The default settings were set to DNS Resolver after factory reset and first setup, which was probably the culprit. I turned it off and turned on the DNS forwarder instead, and now the internet works better than ever! @stephenw10 @Derelict Thanks for your help~ I still don't exactly understand how that was an issue, but it works now. Have a nice day :)

@lewis no problem - glad you got it sorted..

Yes, the firewall rules in pfSense should allow you ping between all the subnets. Or send any IPv4 traffic. The clients in those subnets have to accept traffic from other subnets though.

How is that traffic shaping queue defined? What settings have you used? It could be so restrictive that traffic put into it is failing. Try removing the queue from that rule and retest. Steve

The ISP is handing the gateway as a private IP and that's common for a PPPoE link and not normally an issue. I have that here. But, yeah, using a 192.168.x.x address is far more likely to conflict. However, exactly as I also see, that gateway does not respond to ping. You should set the monitor IP to something further upstream like 8.8.8.8 so you get real monitoring data for the link. Steve

@steveits hi thanks for the reply. I tried what you suggested but unfortunately nothing

@jimp your description fits my case exactly. Thank you very much, this solved my issue. Have a great day, Mauro

@rcoleman-netgate said in Is APU1c good for latest versions of pfSense?: @joea IIRC this is what I did on mine last year. . . . Thanks. Just one more step required.

@stephenw10 Thank you, I was not aware of the « Use non-local gateway » option but setting the gateway using the cli instead of the web interface seems to automatically detect wether it’s local or not and now it working as expected. Thank you all for your time of the explanations.

Yep, you would think. Except errors maybe. But worth checking, we've seen weird things like that before.

Yeah, it returns 'pfSense' there intentionally. Anything else would be uncontrolled if it's not hardware we know about.

You can read through the thread where this was initially diagnosed here: https://forum.netgate.com/topic/173923/strange-error-there-were-error-s-loading-the-rules-pfctl-pfctl_rules I doubt anything can be learned at this point since the reported errors from there will always be 'device busy'. As shown there we need to see the truss output leading up to the point where is gets stuck which is the first time pfctl is run for this that were hitting it consistently. Steve

Not really unfortunately. None that I'm aware of at least.

You would probably want to use the DNS blacklist feature in pfBlocker to filter requests made against the resolver in pfSense. By default pfSense will pass it's own interface IP to use for DNS via DHCP to clients. You can also force clients to use that rather than something hardcoded: https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html You would then add clients you want to be unfiltered as static dhcp leases and set a different DNS server for them to use. Steve

@bob-dig said in Performance on Hyper-V broken by Microsoft Dec 13 patches?: @stephenw10 Is this sysctl. in the pfSense GUI in System-Advanced-System Tunables presant? I don't see it in 22.05. Not by default but you could add it. It shouldn't be needed because the default values there should be to disable the RSC behaviour. It doesn't appear to be here for some reason. Steve

@wintok Hi wintok, I have another option for you that may assist you with overcoming your problem. I have just noticed that FreePBX has OpenVPN available. pfSense also has OpenVPN available. Setup a VPN tunnel between FreePBX and pfsense then let your phones communcate with FreePBX over the VPN tunnel. It should then be a matter of traffic rules to get it all working. Here is a link with some instructions. https://wiki.freepbx.org/display/FDT/%5BHow-to%5D+Setup+VPN+between+pfsense+and+FreePBX Cheers

Yup re-installing on a new hard drive should not be a problem. As long as the NDI doesn't change you will be able to see the upgrade repo and re-upgrade to Plus. Steve

Nice! I think I've used it one time previously. It's not a commonly known feature! Steve

@travelmore Technically, but they do share a cable going from switch to pfSense. Other than that cable, it's a completely separate network. I bet it's enabled on that laptop. Yes. That's what I thought you wanted to do from the start. Won't need a new piHole though, you can just use the existing one but if you want another, go for it. So that's why I said to make that network a /30. A /30 gives you 4 addresses, the network address (in your case 192.168.20.0), 2 usable addresses (.1 and .2) and a broadcast address (.3). If you go into the vlan20 interface, change the name, then change the IPv4 Address from a /24 to a /30. Disable the dhcp server. Then set the WAN on the lab pfSense to 192.168.20.2/30 as a static address. That will give you a lab network with it's own router. You can keep it at /24 until you're ready to connect the router, or keep it that way forever but there's no need since once the router is connected you'll never use more than 2 addresses.

Yes, you could certainly route between the firewalls. But you need to use a separate transport subnet between the two firewall interfaces and then add gateways and static routes between them. That way you avoid asymmetric routing and can properly filter traffic at both ends. If they have separate ISP uplinks you can also setup each as a failover for the other. Steve