i fixed it guys. tried the new snapshot and its working now with the rule activated on lan however i had to insert the ip via //ip/share etc because it doesnt seems to auto discovery when click network which is no problem

the other thing i cant decide about, is why if i boot the pfsense cold with no cables, and then plug it in does it work (obivously the openNTP hang is there, because there is no internet). why does it work after a complete boot and cable change, whereas if i leave it all plugged in and boot it that way, it refuses to find the internet and route traffic? unfortunately ive not tried it with 1.2.3, as i need the features in 2.0 in order to accomplish multiple cisco vpn clients to the same VPN concentrator (a customer's requirement… and this part works fine in 2.0-RC3).

All you should have to do is port forward 25, 80 and 443 to you exchange server. That is all I am doing and it works just fine. Did you change something on exchange? Looking at your NAT, it does not look like you are forwarding port 80. Yes, I would start over as well and have only this rule in the LAN Tab LAN net * * * *   Default LAN -> any Just go to Firewall > NAT > Port forward for you Exchange services WAN TCP * * WAN address 80 (HTTP) Exchange 80 (HTTP) WAN TCP * * WAN address 443 (HTTPS) Exchange         443 (HTTPS) WAN TCP * * WAN address 25 (SMTP) Exchange 25 (SMTP) etc. The Port Forwarding will auto-create some rules in your WAN leave them there.

You shouldn't be using 1.2.2, its VERY old.  2.0 is practically released, the RCs are extremely stable.

It would help others if you could tell people how it was solved and what the problem was.

@chpalmer: Otherwise give it an hour or two after you reboot the router. It takes time before the client will trust your server… This - openntpd needs some time before it considers itself accurate enough for syncing clients (why it doesn't log that…another story). If you get a pcap of the NTP traffic you'll see in the response it has the code set indicating that. You have to wait an hour or two after enabling it.

What Joel described, though you'll also need to enable the serial console under System>Advanced.

Professional = paid for your work… Amateur = volunteer... One is not necessarily any better at their job than the other.  :P But that said- If you were to buy services from me Id say the exact opposite-    ;D

Just tested sticky connections with 2.0-RC3 (i386) built on Wed Jul 13 18:38:42 EDT 2011 No improvement.

Thanks. And safe reboot is?

Thank you for your help I will check it out.

Thank you, that helped. So I need to think which interface the traffic is hitting first.

I got it to work after restarting the server (again) and "reinstalling" the tv. (= Thanks, Floddy

Wow… that's very interesting. Yes both were on 2.0 RC3. I tried again just now and it still doesn't work. Maybe it's a bad install? Anyway, thanks for the replies. I'm going to re-download, re-md5, and re-install, to see if I got a bad install. I can always just reload my config... or can I... O.o If it doesn't work, is there a way I can decrypt it outside of pfsense and then send it? Because loading config works just fine as long as it's not encrypted. EDIT: After a full reinstall I still have the same problem. I think I'll just start over from scratch (ugh). Thanks for the help.

Great suggestions wallybybob. Thanks for the help. @wallabybob: Your laptop is using the wrong default gateway? (Perhaps you have another DHCP server on your network and the laptop got a lease from it.) Negative. My laptop IP is manually set. I can ping both the VLAN102 and the VLAN101 interface from my laptop though. Synology is on VLAN101, laptop is on VLAN102. macbook-pro-15$ ping 192.168.101.1 PING 192.168.101.1 (192.168.101.1): 56 data bytes 64 bytes from 192.168.101.1: icmp_seq=0 ttl=64 time=0.058 ms 64 bytes from 192.168.101.1: icmp_seq=1 ttl=64 time=0.092 ms 64 bytes from 192.168.101.1: icmp_seq=2 ttl=64 time=0.096 ms @wallabybob: Your packet capture specified the wrong parameter values? Don't think so. I tried both synology IP of 192.168.101.2 and my IP of 192.168.102.6 with not specifying any ports. I can see 192.168.102.6 traffic, but nothing related 192.168.101.2 @wallabybob: Your access attempt begins with a host name which gets translated to the wrong IP address? Negative there also. I use https://192.168.101.2:5001 to access the synology device. @wallabybob: On the laptop try to tracert (Windows command prompt) or traceroute (Unix shell) the synology to verify path. On the laptop set up a ping to corresponding pfSense IP address for a few hundred packets or so and tweak the packet capture until you can see the ping. Or use tcpdump on the pfSense console as the packet capture. macbook-pro-15$ traceroute 192.168.101.2 traceroute to 192.168.101.2 (192.168.101.2), 64 hops max, 40 byte packets 1  * * * 2  * *traceroute: sendto: No route to host traceroute: wrote 192.168.101.2 40 chars, ret=-1 * Can't see ping traffic on packet capture or ping the Synology device, however, I can ping the interface the Synology is plugged into.