Another thing, Isn't the purpose of a DMZ to keep that traffic segregated from the rest of your network? You should create a rule on your DMZ to block all traffic going to any LAN IP and make sure its before that allow any any rule.

When is pfsense team planning to release the central management application? I'm interested in this solution

My approach (also in a home environment) is to judiciously hand-select individual rules. I find the ET ruleset quite useful.

@kejianshi: Well the total RAM, HDD and CPU in the VM Host should be equal to what would be required by each machine if it were running on separate hardware.  You can oversubscribe all of those (Except HDD) some what, assuming that all the machines would not be maxing out its resources at the same time. The more OSes you pile onto a single drive, the laggier things will get.  Better to have seperate drives if lots of demand will be placed on them. Basically, you will need to install the VMs and monitor their resource usage to get a clear idea which ones need more and which ones can use less to balance it.  I've found that Windows on hardware is a resource pig, but when I installed it as a VM and limited its RAM/CPU/Memory it runs just fine.  Weird.  My Centos VM, which holds chat server, SIP etc required more than advertised…  Just have to add/subtract til you strike a balance. Thanks! Okay now I really get it ;D

@doktornotor: http://technet.microsoft.com/en-US/library/cc770315(v=ws.10).aspx Brilliant! Thank you mate that's worked a treat!

You have to do the following first: On pfsense (in your screenshot LAN) is always VLAN1 and untagged On pfsense all additional VLANS (in your screenshot VLAN19 and VLAN20) is always tagged So what you have to do on the HP switch is: Use one port which is: TAGGED for VLAN19 and VLAN20 UNtagged for VLAN1 (which is your LAN) Then connect this port with your pfsense. This is what you have to do at least. Without that there will never be a correct connection between pfsense and the switch. If you really want to use dynamic VLANs then you need something which tells the switch in which VLAN the switch should move the computer/MAC-Address. There are probably two possibilities: an external RADIUS server like freeradius (package for pfsense) or Windows RADIUS Server or any other external RADIUS server GVRP which will be probably configured on your switch itself You should search for 802.1X and dynamic VLAN assignment.

No compression. Not sure what the issue was but very happy now. I should mention I'm using 2.1 RC at home I'm using 64 bit at work I'm using 32 bit. Maybe Comcast is doing something? But I haven't heard anything and I work there so I would have probably heard something.

Ahhhhhh the adventure of learning.  Well, at one point we were all there.

Ambiguous and yet accurate answer: It's as close as it can be and as different as it needs to be  ;D We drop some conventions like rc.conf because they aren't needed the way we use it. We use a custom rc script to do our boot-time configuration, and trying to shoehorn our methods into the default model doesn't give us the flexibility we need to get things done. There is PHP everywhere because the project was originally forked from m0n0wall which was using PHP. Also, we know PHP and the libraries for reading the config, etc, etc are all in PHP. If you're looking to run things at startup, use the shellcmd package. More detail on shellcmd can be found here: http://doc.pfsense.org/index.php/Executing_commands_at_boot_time

@stephenw10: @ieatfish: If down the road we need to share something between us, I can make a third VLAN and have it viewable by our two. You could certainly make a third VLAN interface in pfSense and equivalent port on the switch. Then add firewall rules to allow both of you to access that new subnet. You could has a NAS device in that subnet to share files for example. Depending on how you use your various devices you may want to have additional segregation. I have my wireless access point on a separate interface here at home for example. That way I can happily allow internet access to guests without worrying about what they may be carrying in their laptops. With that switch you could potentially have 7 isolated subnets. Steve Awesome, this will definitely open my setup up for lots of options. Thanks.

I have setup OSX Mountain Lion server on Mac mini behind pfSense and have port forwarded L2TP/IPsec to this server. Works great for iOS devices and OSX computers and for me the best setup  ;)

Seriously… I never liked the security suites for Windows. Usually they have a good firewall, but piss-poor antivirus, or the other way round. And then they bundle a bunch of added bloatware that allegedly brings so called "added value" functionality - as usual, for each of those value-added functions a much better, smaller, and cheaper alternative exists. As for the application firewalls - these are so much better done on localhost, I seriously don't get why I'd want the functionality moved to some centralized megabox which does much worse job with much higher demand on resources and is much more difficult to maintain. Huh...

@NOYB: Is pfSense em1 a vlan?  If not then the connected switch port should be untagged vlan 99. That worked. I swear I tried it before, though before I had a D-link web-managed switch on the other end and figured I'd wait until I got another HP for the remote end to eliminated any oddities with D-link or any incompatibilities. I've even rebooted Pfsense and it survived a reboot (the ONE time I got it to work like this before it didn't survive a reboot). I did have to reapply the interface settings (no changes, just a save and apply) before it would pull an address.

I've come to try this one last thing: I've disabled WAN1. Couldn't go to the Internet (link to ISP2 was UP). Set WAN2 on default. Yep, Internet works now. Try to connect using PPTP from an outside machine. FAIL :( Connecting to x using 'WAN Miniport (PPTP)' Rumbles for 30-60 sec. Error 807: The network connection between your computer and the VPN server was interrupted. Yet another message. I'm still with you but PPTP is outside my experience. It has some particular quirks that are not present with OpenVPN, all of which are related to multiple PPTP connections over the same internet connection. I would still be looking for a routing problem, I agree it seems very unlikely the ADSL modem is causing this. I don't believe it's the problem related to "multiple PPTP connections over the same internet connection". As I've said… WAN1 works with multiple connections without a hitch. I also susspect a routing problem... the only thing is: I've watched the logs and it seems like there is nothing in them what would help me (strange). Thanks again :)

Ops! Sorry for the confusion. I was dealing too much of that KBps/Kbps & MBps/Mbps  :o I am referring to 2 MBps and I am only getting 200 KBps (2 Mbps / 20 KBps) download speed. And now, I found out that there's a notification coming from my box saying the NIC MAC Address was altered for some reasons. Is it a hardware problem?

Have you restarted pfSense AFTER changing the WAN to PPPoE? In pfSense configuration files for various services (including PPPoE) are generated at startup (and possibly other times as well) from the configuration file maintained by the GUI interface. PERHAPS the PPP configuration file wasn't regenerated before PPP started. I suggest you take these steps in the following order: 1. Set modem into bridge mode. 2. Set pfSense WAN interface to pppoe0 (in Interfaces -> (assign) page) 3. Check the details are correct on the Interfaces -> WAN page 4. Shutdown modem 5. Shutdown pfSense 6. Start modem 7. Start pfSense If you then see the same report in the PPP log (check the time stamps on the entries to ensure you are not looking on stale reports) then please post the contents of the PPP configuration file (/var/etc/mpd_wan.conf) after masking out the authentication details.