Thank you both. This was the "not an expert" qualification, although this seems pretty basic so I am embarrassed! It would appear that this traffic is simply between source and dest and pfSense isn't seeing anything. I don't have a managed switch, though will be getting one soon to set up VLANs. Maybe I can try again then.

@Forced2b: …I do not need a year or years of support that pfsense offers, i need a one time setup and access to future support if needed... Isn't "access to future support if needed" exactly what a commercial offering does? Anyway, as others have mentioned already, maybe post your basic network layout and things you need to get done so we have an idea of what you are talking about. Right now it can be anything from a single WAN/single LAN home setup to a perimeter firewall for a Fortune500 company.  ;)

You're welcome. Please know we also offer support and official pfSense appliances which might be of interest to your educational environment. Thanks!

It's fixed!  2 things fixed it (in my opinion). Removing the modem/router box from my ISP in the middle.  Today my ISP provided a media converter for glass fibre to RJ45 so I don't need their modem router anymore.  Even though I had PPPoE Passthrough enabled on their modem, I have a feeling it was somehow blocking my own router getting through. Setting trunking on the VM switch port/group.  I would never have thought of that! Thank you so much It's now working beautifully.  500Mb down and 750Mb  upload with an MTU to google of 1500. Thanks so much.  Matt PS: if anyone is interested in my settings I can try to write them down, just reply here and let me know if there's interest in it.  Running pfSense on Esxi VM directly via F3100 media converter to xs4all glass fibre

@Shuh: Ip cameras are in the office, but nvr are out of the office. I need to record from these cameras. ((( Then use a VPN, there is no excuse for opening these devices to the world.

what have you entered in your /boot/loader.conf and /boot/loader.conf.local? do you use the realtek shipped with pfsense or a newer one? you should try the tip with the new driver on this post: https://forum.pfsense.org/index.php?topic=103841.msg766227#msg766227

Ok so to update; I wanted to go to 2016 anyway, along with other NICs, virtual and physical, along with VPN apps doing who knows what to 2012. I decided just to go to 2016 and start from scratch. All is well now!

Diagnostics > Packet Capture.

I've got a comcast business modem where I have put the Sophos XG WAN interface in the DMZ and everything works just fine when packet filtering is turned off on the pfsense side. The goal is to use pfsense to isolate/route between the different vlans and have sophos maintain the firewall aspect. I have gone through that and haven't had success even with pfsense as the Edge and in the DMZ of the comcast modem the problem persisted. From what I can tell I don't see a NAT issue (Sophos XG is handling correctly, and PFsense does not have NAT enabled) but are there other areas in PFSense I can check for that? –-Topology Update--- Comcast modem <> Sophos XG (Edge Firewall. This is listed in the Comcast Modem DMZ) <> PFSense (Handles vlans and inter-vlan routing. Currently has both packet filtering and nat disabled which is causing the vlans to be able to speak to each either versus follow the rules that are in place.) <> Various vlans.

Yes, of course you may assign additional IP aliases to WAN and forward it to the server. It would also work if the primary is pulled from DHCP. So if you have a static mapping it will be fine to provide a service. However, the IP aliases have to be static.

OK, so I got it working But it seems there's DNS leaks. Anyone know how to get rid of them?

In what scenario would you need/want to create a bridge on a vm?  Zero sense..

interested in this too… current deployment is on an island that suffers from downtime, would be nice to implement and let guests/staffs know that the ISP is having issues @crisdavid: Hello, Not sure if this has been talked before but I would like to know how it would be possible to redirect a user's web browser to a local page to indicate the WAN connection is down. Had a ASUS router with this feature and would like if pfSense could handle this. Any ideas, guides or help is appreciated crisdavid: were you able to find a solution to this??

@ecfx: I am just absolutely disgusted what I have found here: http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2017-1828 http://web.archive.org/web/20160314132836/http://www.opnsense.com/ no comment.  :-X I don't care about legalese. The trailer was LOL, RELEASE THE FILM. Make Movies Great Again!

I would take a look at the 3100 if you want an update.. It just came out few months back really, and should be good for a few years to be sure. And is way under your budget.

Hi, Unfortunately the problem seems to still occur. Although a lot less, I noticed something though``` em1: <intel(r) 1000="" pro="" network="" connection="" 7.6.1-k=""> port 0xe000-0xe01f mem 0xff840000-0xff85ffff,0xff820000-0xff83ffff irq 17 at device 0.1 on pci1 em1: Using an MSI interrupt em1: Ethernet address: 00:1b:78:5c:4f:99 em1: netmap queues/slots: TX 1/1024, RX 1/1024 vgapci0: <vga-compatible display=""> port 0xf140-0xf147 mem 0xff900000-0xff97ffff,0xd0000000-0xdfffffff,0xff600000-0xff6fffff irq 16 at device 2.0 on pci0 agp0: <intel g33="" svga="" controller=""> on vgapci0 agp0: aperture size is 256M, detected 7164k stolen memory vgapci0: Boot video device pcib2: <acpi pci-pci="" bridge=""> irq 16 at device 28.0 on pci0 pcib2: [GIANT-LOCKED] pcib3: <acpi pci-pci="" bridge=""> irq 17 at device 28.1 on pci0 pcib3: [GIANT-LOCKED] pci2: <acpi pci="" bus=""> on pcib3 re0: <realtek 8111="" 8168="" b="" c="" cp="" d="" dp="" e="" f="" g="" pcie="" gigabit="" ethernet=""> port 0xd000-0xd0ff mem 0xff720000-0xff720fff irq 17 at device 0.0 on pci2</realtek></acpi></acpi></acpi></intel></vga-compatible></intel(r)> Both NIC's look like they've got IRQ 17? Could this be it?