Rate limiter in pfsense looks pretty easy to use ;) If your looking to rate limit inside your network use your switching infrastructure.. If your saying you limit your client to X that its not working?

http://lmgtfy.com/?q=syslog+server+howto

Is OPT1 your PIA interface?  Maybe try it with DNSSEC disabled and see if that makes any difference? I don't use OpenVPN, but this might help:     https://www.privateinternetaccess.com/pages/client-support/pfsense It doesn't seem like its DNSBL related, but you can use this trick to quickly bypass DNSBL while debugging this issue… Disable Cron in the General Tab Put a # in front of the "Server: include:" line in the Resolver and  "Save/Apply".... To reverse - remove the #, save and apply to re-enable DNSBL. Configure the cron setting. You could try to run a tcpdump command in pfSense to collect all DNS requests, and see whats getting blocked from those specific devices... See the details in the DNSBL Enable checkbox - blue info block icons.

You do not manage users and keys in the shell. Use the GUI. System > User Manager. Add keys in the field. Do not try to use the wheel group. Use the sudo package GUI to grant extra privileges.

Good, glad you were able to resolve this.

So, in this case there isnt way how to find inner ip? Exist something like package for logging with this option and necessary information? Or pfsense isnt able to log it? Our previous system based on linux with iptables was capable for it.

Sorry guys any help would be great please?

Thanks  you sir doktor. How about my suggestion is working?

pfSense University https://www.pfsense.org/training/

@fishy: Hi, Is there any centralized management software for pfsense? Would been very neat as I''m have many instances of pfsense. I did it once to replicate package, rules and config. The replication configuration could also specify what type of config goes ro each managed server. But to centralize logs and alias based on URL table there are some built-in functions.

What on earth do you mean here? This doesn't make any sense. There's nothing to bypass, the traffic will either never hit the firewall if the WSUS server is on the same LAN, or will get routed to another subnet. Are you trying to cache WSUS with Squid or some such stupid idea?

I guess a combination of access hours using firewall rules and then captive portal vouchers that can let users "buy" lengths of time within that period. That might be a bit difficult to let them have, e.g., 2 hours during that period and that period only. If they are issued with a bunch of CP vouchers then they could go on a splurge and use them all in 1 day. Or if you give them out daily, the user can save them one day and use them the next. Administratively you would have to give them 2 hours worth of vouchers each day which expire at the end of that day…

Yes, that will allow that traffic out from the phones on the LAN on those ports. But like I said I would suggest just opening all ports for one phone as a test if you're still have problems. Steve