The catch 22 there with NTP and DNSSEC is known, though outside of the system clock being way off on first boot of a new install, you shouldn't be so far off as to cause issues there. The config backup stores all the changes you make via the GUI configuration screens. If you make conf changes outside of that, they have to be restored separately.

If it were me, I would just keep it and leave it disabled. It would just be a good reminder that that's the physical port. I would also probably name my VLAN interfaces LAN-V101, LAN-V102, etc… so you include the name of the physical interface with the VLAN number. This might not be a big deal if you only have two physical interfaces (WAN and LAN), but if you had three or four physical interfaces and multiple VLANs on each, that might help to keep things straight.

Hi, Thanks for the info… I don't like putting the gateway in the so called DMZ+ modes just in order to access the modem's interface. Nothing beats having it in bridged mode. It looks a bit complicated. I'll try it. Would have been nice if such a feature could be enabled/disabled in an automated way by a single field in the new pfSense 2.3 Web-GUI.  :)

BTW my gs108ev3 switch got here last night, it does have a web interface..  Its pretty much the same feature set as my older gs108t..  Atleast it works in firefox now.  Or you can use the util if you want to admin it.. Does not support snmp.  Sucks I normally like to monitor my switches.. For 33$ it will do what I need, which is understand vlan tags in my av cabinet.  I really would suggest you go with the sg300 if your looking for a smart switch with actual features.. You had asked how the sg300 web gui was, etc..  Here is a comparison between brand new gs108ev3 and my sg300..  You can tell from just the menu options that sg300 has way way way more features than these netgear devices.  Now if you do go with the T model, they do support snmp atleast. [image: exampledifference.png] [image: exampledifference.png_thumb]

That's the PTR of this site, it didn't match the forward DNS. I just fixed it so it does.

Bufferbloat is temporary latency due to buffers being filled during moments that data isn't able to be sent over the line. This is often an issue for cable internet customers because of the shared nature of the cable system. It's most noticeable in online gaming, and sometimes in VoIP applications, where low latency is extremely important and a sudden 300+ms delay becomes noticeable, even if it's just for a moment. It's not so much a slowness issue as it is a latency issue. There are a couple of different ways that you can add Codel to the traffic shaper. The best way for you might be different than someone else depending on what other traffic shaping is being done. If you're not doing anything else, then you can add Codel directly to an interface in the traffic shaper. That has worked great for me, raising my Bufferbloat score from a D to a B.

Thanks! I just realized that reply-to is still being set on automatically generated rules for VPN traffic even though I have 'Disable reply-to' enabled in System->Advanced->Firewall & NAT (see my post above showing the rules).  It appears I would need to override that too. EDIT:  It looks like my rules on the WAN interface allowing udp 500 and ESP protocol are overriding those auto-generated rules.  I don't see any packet counts on those auto-generated reply-to rules. pfctl -vsr | grep -A 2 "reply-to" I see all packet counts at 0  "Packets: 0".

"No issues running 2.3.x on esxi 5.1.x" That is nice to hear but that is not a supported configuration from even vmware.. Since they do not support the version of freebsd pfsense is running on.. freebsd 10.x is not supported by vmware until 5.5u2 so while it might work, it is not a combination that should be used..  You need to update your esxi to 5.5u2 at min to be inline with what vmware says their product supports. http://www.vmware.com/resources/compatibility/search.php?deviceCategory=software [image: vmwaresupport.png] [image: vmwaresupport.png_thumb]

This is the method I prefer: https://www.infotechwerx.com/blog/Prevent-Any-Traffic-VPN-Hosts-Egressing-WAN

I found that under gateway > settings > advanced options I enabled it and I got net access in ma pfsense machine. But for lan its not loading any web pages. I cant ping to the given gateway (via pfsense console), but can ping Google. and when I traceroute  Google, It shows * after the public ip (in the gateway portion) and then traced Google.

You seriously broke something in the process. You'll have to reinstall via USB. If you're getting the same end result screen as what you show there when booting from USB, then you aren't actually booting from USB. Probably because it's not a properly written bootable USB drive.

That's almost certainly your modem. 4 ms is too low for it to be traversing the coax and looks to be too consistently 4 ms for that as well. I haven't heard of anyone else seeing anything like that. Though there is some buggy firmware going around on TWC for SB6183 modems, I'd only heard of it breaking IPv6, not doing stupid things with IPv4. See this thread for instance, and the links to dslreports there. https://forum.pfsense.org/index.php?topic=108971.0

@Clouseau: Okey - I have the same problem than diablo266 - should I start a new thread? Not if you actually have the same problem. At this point, this is a well-established known issue, and we don't need any further specifics as we have a replicable test case and are working on finding the root cause. Can follow here for updates: https://redmine.pfsense.org/issues/6296

as my daughter would say "like a boss" worked a treat,  many thanks to you sir :)

If you upgraded from 2.3 beta, you may still have 250ms as the polling interval. This was the default earlier in the beta process. The current default is 500ms. FWIW, by default dpinger uses a data payload of 0 bytes, so the packets are much smaller than a standard ping which is a 56 byte payload.