To add to what PiBa has mentioned, click this link, this example has a couple of screenshots showing how to use the AS numbers to block Facebook.

I have also added a firewall rule for the associated interface allowing all traffic (source and destination) but still no difference.

@tim.mcmanus: @randomaustralian: does pfsense handle multiple internet connections and load share? If you have more than one WAN link and they are not going to the same gateway, pfSense can use multiple WAN links.  What it will not do is bind together two or more WAN links and aggregate a connection across the combined WAN links.  It can have multiple connections across WAN links by allowing each connection to go over a different WAN link. this is what i was hoping for

I've answered my own questions.  Found info in topics that didn't really relate to mine but something tripped my brain into understanding what was going on.  It's the damn commas that are screwing it up.  That's the last thing I would have thought, that's how sharp I am.  I saw trying sed to attempt to color logs and that lead me to think of just stripping the commas and that works well enough for me.  I just used: clog -f system.log | sed y/,// | ccze Sorry if this was too elementary[it's actually surprising to me that I figured it out.  Yes, it seems I'm talking to myself.  Is that a problem?  No, not unless you start having a dialogue.  Oh, OK.]

I am on the current version, yes. 2.3.4-RELEASE-p1 (amd64)

So you state your AP is pointing to pfsense as its gateway.  Did you verify its mask?  The simple thing that would cause your exact problem is if you have the mask wrong.. Anything larger than /22 would put your 192.168.2 and 192.168.1 on the same network.  So the AP seeing a ping request from 192.168.1.x would think hey thats my network and just answer it vs sending to its gateway.  It would not be able to arp for it.. So if your sniff shows you send it ping from pfsense, and all you see back is arps this would scream the mask is wrong on the AP. This would explain why you can ping other stuff on the 192.168.2 network but anything from 192.168.1 can not talk to the AP.

Somehow you are hitting the GUI and not HAProxy. If those are purely HTTP, it's possible your browser cached the HSTS info sent from the GUI redirect before you disabled it. Clear your browser cache and try it again.

Thank you for the response mats will try it

It has been there as long as I can remember.

And why do you wan't to leave your hyper-v Host unprotected? In my eyes it should be behind the PFsense VM

thanks I will look in to I t

Interesting because the port going to your modem should be untagged on VLAN 100.