https://forum.pfsense.org/index.php?topic=110219.msg615120#msg615120 If your goal is to block any data going to any Facebook-controlled servers, this list is a good start: http://pastebin.com/raw/eKi3jABf

I can answer the question now.  ;) pfSense boot normally and after you connect the USB 3G modem the WAN interface goes up. Try it with pfSense 2.2.6 and 2.3. Perfect, pfSense is really awesome!

1gb ddr2 ram Only a guess of mine, could it be that you are running out of RAM?

thank you, cmb

You can't do altq shaping with Xen PV NICs period.

I was shocked to see that at bare metal I would max out at 550Mb. Me too, but more pending on what you are doing and how do you it are doing. In a VM you haven´t only one CPU core or SoC core for the WAN part, its multi core threated! And on a bare metal installation it is so, that the modem is put at the WAN port and there fore and on top of this together with PPPoE you are now single CPU threated!!!! please don´t forget this. When I install centos on this same machine I get 980Mb off the same interface that under pfsense would only push 500. Where the hell CentOS is doing in any kind of direction NAT / SPI and performing firewall rules? It don´t do that all!!! And there fore on top of this it is multi CPU core usage and pfSense together with PPPoE single treated again. So it can´t be really the true doing that. Its like I have 2 cars one is a Mercedes 600S AMG and the other is a Fiat500, but both have a motor 4 wheels and burning benzine. Forgot to mention no services are enabled this is a fresh install of 2.3 with only pfsense added. This will be really good but only one step of two that should be done! do a fresh install of version 2.3 64Bit configure WAN and LAN part connect the modem and the WAN port to a smaller switch and on top of this a PC or Laptop as iPerf server connect now to the LAN port a switch that is connecting too a PC or Laptop and then acting as a iPerf client. Now do some speed or throughput tests! This would be showing you the real throughput of your pfSense box and nothing more or less. SCP and other programs should not be in usage! Please try out iPerf or NetIO. If the results are not matching you should be tune the NICs, by high up the mbufs size to 1000000. The SG-4860 is similar to the A1SRi-2558 and is able to push 500+ MBit/s over IPSec together with AES-GCM. And your board is able to push nearly 1 GBit/s over the WAN Port as I see it right but perhaps you should understand that a test is not likes other tests. If you own a router with an integrated modem and you will be put your pfsense behind of that it would be more using the static IP instead of the PPPoE and then you will be getting more throughput or speed.

That has worked flawlessly. I am really impressed. Just imaged 2.3 on a spare CF card and imported the old config. Will move on to the next box now. thanks!

There are a lot of changes in the Intel Gigabit Ethernet drivers em(4) and igb(4) in 10.3-RELEASE. I believe all of them appear in pfSense 2.3-RELEASE (which is based on 10.3-RELEASE). It would be unwise to single out this one change from the many.

It requires specifying an IP address there and always had, though it shouldn't anymore. https://redmine.pfsense.org/issues/6239 Fixed in 2.3.1 to allow hostnames there as well.

Well pfsense and 1 simple rule with all your connections as vlans prevents them from talking to each other if that is what you want..  Or you could do that same thing with a L3 switch and ACL(s) This is really basic stuff here.. Does not matter if your locations nat or don't nat if you give them 1 IP or a /16 to work with, etc. A very cheap switch can do this, comes down to how many ports you need..  How many client condo's do you have?

The AP is an Amped Wireless model APA20, I bought brand new.  Running the latest firmware. Would be even the best if the latest WiFi standards are a so called "must be". I thought the AP was just acting as a wireless bridge to my wired network, DHCP/DNS is being handled by pfSense and the AP just passes that through to the clients. In normal, or in common cases when all is running well, this might be not a real problem, but if there are problems mostly they could not so easy solved out then. Last night I tried isolating 802.11B/G/N to the 2.4ghz and 802.11.AC to 5ghz.  I noticed that even though all my devices are AC capable, they were connecting to the AP in N mode on 5ghz.  Curious to see if that helps at all. As told before and a couple lines above this would be the best way to get the newest WiFI standards in usage inside of the network. I'm really hoping that this isn't a problem with pfSense at all… No, not really with pfSense. I guess I just wasn't sure if there were some settings on the firewall that I was missing when having bridges on the network. That´s easy to answer, if it works you are the lucky one and if not it is often better to go with an external WiFi AP likes you have done. If this is only for the private usage no worry, but if also for the public usage you should be activating perhaps the client isolation inside the SSIDs or separate VLANs. Last night I tried isolating 802.11B/G/N to the 2.4ghz and 802.11.AC to 5ghz. You can also try out to put them in separate VLANs with different SSIDs.

@cmb: Briefly, yes, for this site and some other things hosted out of Austin. NFS server problem. All that rain  ;D

As a another example would be the WAN DMZ LAN construction that cames that first explanation nearly. You can also have more DMZ zones and different LAN zones like WAN DMZ WLAN LAN or in other directions and callings likes WAN DMZ WLAN VOIP LAN or whatever the rest was told before.

Here's the scenario: a WiFi network for a university About how many WiFi devices we are talking in that case? and I need to block content such like social networks and porn. And violence will be ok? But this should be your trail, so you could try to work it out with a Proxy server as a caching proxy too. I have been researching and already know about the HTTPS problem with this sites, so I was thinking about a Squid proxy + SquidGuard or maybe a Squid proxy + Diladele Could be a real chance to realize it right. I need to use a transparent proxy because many of the devices that will connect to the wireless network will be mobile devices and in many androids the WPAD configuration doesn't work. Also in many sites says that transparent proxies can't filter HTTPS and in other says that they can, so i need help with this part. nice HowTo

@ktenney: "Newer version available Package is configured but not (fully) installed" Those two lines are the legend for the red and yellow coloured icons you might see next to a package. If the icons are black, they do not apply. You're not the first person to be caught out by this!

what is the advantage to having a separate network/subnet for the home devices and another for the servers? increasing security finding and solving issues and failures faster being able to work with QoS to balance loads I can think of a couple disadvantages. more knowledge is needed more work in normal for you as admin (not permanently) more or more expensive hardware in the LAN & DMZ (switches, APs, ect.) I assume that two separate switches would be required for this set up. Would be a real benefit for the entire network security and also for the entire speed too. All devices over more switch chips and routing CPUs And what about directly accessing the servers from my laptop (ssh/scp for instance). SSH or https would be common in that situations. You can create one or more VLANs for that use case or one switch as the DMZ switch and another one for as the LAN switch. With an viewing eye on the inter VLAN hopping is perhaps the DMZ the better solution to realize it. VLAN10 private LAN devices OpenLDAP on a Raspberry PI or on a Minnowboard Turbot VLAN20 SSID "private" WLAN devices radius server on a RaspBerry PI or on a Minnowboard Turbot VLAN30 SSID "guests" WLAN devices captive portal (pfSense) Web, Mail, FTP, Fax, and VOIP servers into the DMZ Together with Squid, SquidGuard, SARG, Snort, pfBlockerNG and other packets it will be able to secure and control your network for sure with ease.

i configured vlan with cisco switch, and it seems working using class C ip, If this is done in the LAN it would be right. VLANs are also able to configured on the WAN side but more common at all IP Internet accounts with serving different services providing TV, VOIP and Internet services that will be spread into VLANs from the ISP side. In your case it would be right to use internally private IPs. but when i use our public IP provided by ISP it didn't work. WAN is directly connected to modem. Internet –- public IPs --- WAN Port - pfSense - LAN Port --- private IPs --- Switch --- LAN devices What you want to realize in that case with static public IPs internally used? In normal or common use cases this is not really wanted by the administrators. You can either try out to build a DMZ and place there the devices such as servers and/or devices for the public access over the Internet. Or you will be able to set up the static public IP address on the pfSense firewall directly and then route and port forward them to the internal IP addresses of the servers in the DMZ. Would be more secure. But what ever you try to do or realize, you should be providing more details over the entire use case and your network topology.

pfSense Squid SquidGuard SARG Traffic Shaper Captive Portal FreeRadius pfSense DOCs limiters HowTo Squid & traffic shaping Cisco VLAN based QoS Install the WLAN APs and give them all a different static (fixed) IP address from another subnet. Create four SSIDs on each WLAN AP, 2x  in the 5,0GHz for the guest & private and 2x in the 2,4GHz band also for guest & private too. This can be different likes you need or want t it to realize. create VLAN20 2,4GHz private radius certificates create VLAN30 5,0GHz private radius certificates create VLAN40 2,4GHz guests captive portal create VLAN50 5,0GHz guests captive portal Enables QoS priority for the VLANs as you want and not per port please at the Switch and the pfSense firewall All VLANs should be "tagged" based on the behavior of the multi SSIDs or more then one VLAN in use

Hmm ok sounds good! Thanks for the information, I've done the upgrade on my machine but I think it borked the box since most of my services or stopped and it still says "packages are being installed do not make any changes to the GUI". I might just have to do a fresh install which doesn't matter really since I backed up my config but it's strange that the upgrade didn't work. Thanks again!

Thank you all, now I understand the functioning. and a double thanks to dennypage for dpinger  :) Fabio