@doktornotor: No, your problem is that WAN overlaps with LAN. Thanks. Any idea how I fix it? :)

The original page is not working for me, I want a specific NAT rule only active if the internet connection (gateway) is down, otherwise the NAT rule must remain off.

What you did is very sensible.  Although, you have denied me the entertainment I normally get watching people jump through crazy hoops for weeks trying to save a couple of bucks.  :(

To just get it working, create the rule on the LAN interface on your eth0 (OPT1??) interface but adjust the source network to the interface network. If you want to prevent captive portal users from accessing LAN assets you will have to create a reject rule on OPT1 that blocks to destination LAN net. Same for anything else you don't want them to be able to access.

@KOM: squidclient -h pfSense_LAN_IP_address -p 3128 mgr:delay Thank you! Anybody ever heard of web-interfaced visual tools for that purpose, such as ntopng?

@stephenw10: I suspect Bluetooth would be particularly badly suited for use in a time source situation. Pretty sure PPS would not pass, though I've never tried it. I probably would though if it did since I have Bluetooth GPS receivers gathering dust!  ;) Steve We'll what are you waiting for.  Get to it and let me know.  This is not a wheel I'm particularly suited to create.  ;)

Yes thank you for all the help so far.

…that's frustrating! Interestingly: On an other box (fiber modem) it's the same, while on a third one (PPPoE) it's logged only once a day, after reconnect... Strange.

I ended up changing the vmware nic's from the e1000 to vmxnet3.  When doing this, pfsense blew up and wouldn't boot anymore.  Tried to change it back, but it didn't work.  I honestly think something happened when I upgraded from 2.2 to 2.2.1. I ended up reinstalling and restoring the config.  It broke the system again, and then did a fresh install and only chose options that I knew were safe (like firewall rules, dhcp, dns, etc).  I didn't choose the packages or system, or parts I didn't use.  I am now back up and running, and the speeds are about 60/12.

802.1x authentication takes place between the client and the switch directly. pfSense will not be involved in the process. Managed switches are mandatory for this I'm afraid.

Hello, please build a DMZ and place the Xbox and the BluerayPlayer then there inside. And use then the Squid Proxy only for the entire LAN or your Servers. So you do not need; open to many ports to the entire LAN the both devices will not be affecting the entire LAN if an error occurs the DMZ will be reachable from the LAN side and from the VPN over the Internet

Not off hand. I would be searching the FreeBSD mailing list and forum using the details from the specific adapter given by pciconf. Steve

Same here… any idea?

In proper routing a route is literally just a destination network range and the gateway used to reach that network range. So you can't have a route without a gateway. Dumping traffic onto an interface is known as a connected network and is using ARP, not routing, to handle traffic. So if you want pfSense to send traffic bound for 172.20.0.0/16 to interface 3 without a gateway then you need to give pfSense an IP in this range on interface 3 and make sure there are no layer 3 devices between pfSense and the client machines on this network. I suppose you could put a proxy ARP device of some kind between pfSense and the 172.20.0.0/16 network and then create another /16 subent between pfSense and the proxy ARP device, but that would just make things complicated.

Just tried that. It did not work.