Are you certain the user is being put into the correct group? I can't think of any reason why that privilege wouldn't work from LDAP unless the user wasn't actually being detected as a member of the group that included the privilege.

Incoming traffic on WAN is blocked by default.  LAN is wide open.  Any extra interfaces like OPT1 will have to have at least one rule added to allow access out. https://doc.pfsense.org/index.php/Main_Page

Huh… No, restarting webserver does no network damage.  :o

Ipsec may be a more hopeful possibility with the TZ210. You might post a question in the IPSEC forum about creating a connection with Sonicwall. I would like to just install openvpn on the phone and PC but, she still needs access To other network resources. If you create a RoadWarrior setup and install the client on your wife's PC she can have access to anything at work and at home as necessary. One useful piece of information - the TZ210 is now EOL as of 2015-06-01. Might be another reason to switch to a better supported firewall (hint hint).

Except that https works fine with some mixed case domain names.  Such as https://www.Team-CYMRU.org/Services/Bogons/fullbogons-ipv4.txt for instance.

What a pain in teh ass.  You would think they would incorporate a defrag/compaction feature into the virtual machine definition like VMware does.

You need to segregate those clients on a separate LAN (or VLAN).  That means: A second WiFi Access Point, or a WAP that understands VLANs and lets you assign the different SSIDs to different VLANs A switch that understands VLANs, or a separate interface on the pfSense firewall box I'm doing a mix of the two methods, I have VLANs on my network switches, and one of those VLANs is for "guests".  The guest VLAN connects to a cheap consumer WAP which doesn't understand VLANs, but the network switch handles that issue. Now that the guest WAP is on a separate VLAN, I can assign limiters in the pfSense firewall rules to any traffic coming from the guest VLAN and going to/from the internet.

A little update since I stumbled upon something good recently: Using LibreOffice Draw and the VRT Network Equipment shape set is great. The shapes are open source, available as a LibreOffice extension, and they have a decent license which includes an exception from the attribution clause for their intended use (meaning you don't have to put their name/link on all your diagrams) My main nitpick is that connector placement/adjustment in LibreOffice Draw isn't as good as Visio, but things can still be tweaked into acceptable places.

I have had switch/router devices before that would stop responding to ping on an interface if the interface was physically down - from memory it was Cabletron/Enterasys gear. Once you knew the behaviour, it meant you knew when the cable had fallen out at a remote place.

Thank you for your answers, at the moment I can't reprogram the software and I need connection. I'll try to create a VPN server and a routing table to fix it. Thank you,

I don't really have an environment to test that. But the static IP machines are not going to be getting any settings from a DHCP server. Normally the DHCP server would send them some default domain information that lets them learn a domain to use. So you probably need to either: a) Explicitly set the domain somewhere in the static clients or b) Set up some static mapping in the DHCP server so that those clients can use DHCP, and will thus get the domain name along with their static-mapped IP. Or I don't really understand the whole combination of systems/settings and someone else will have a good idea :)

I block the youtube with blacklist youtube.com and googlevideo.com.

$5/mo is pretty cheap for a static IPv4 address.  I'm being charged $20/mo for that with Verizon FIOS (who doesn't yet do IPv6).

Or consider installing "monit" on the pfSense box as a minimal tool.  You'll have to do it from command line.  I prefer Monit for small independent boxes, much easier to setup then Nagios/Zabbix/Icinga.

I used the OpenVPN client on my Android phone to troubleshoot my own OpenVPN setup. #1 Disable WiFi on the phone #2 Fire up OpenVPN client and connect to my VPN #3 Do testing on the phone That was enough for me to figure out whether OpenVPN was configured properly on pfSense. (I'll have to try the Android phone as a WiFi hotspot idea as well.)

Yes, it seems to be the modem - what a piece of shit! The MAC address is key… if I hadn't had a 'virgin' Alix box, I don't think I would have ever got this working. I've replicated its MAC to both fw1 and fw2, and they now both work fine; they can reach the 'update' site. The perverse behavior of this modem would seem to completely rule out using the failover feature - if it was ever possible on a bridged modem. I've still got one question: Is there any historical data on the pfsense box that the cable modem could access during DHCP? I ask because when fw1 (and subsequently fw2) was connected to the bridged cable modem, I observed that pfsense reported a gateway address that it used when it was connected to another gateway device (the router for the fixed-IP service). I totally don't understand how pfsense could report such nonsense.

Watch, Charon isn't flagging memory pages to not be paged out then the kernel attempts to access said memory locations.