Thanks now it works flawless. ;D ;D

Well, I've learned a few things on this journey: Endian looks nice. However it's buggy, and unsupported. Optimum Online sucks. Pfsense has a lot of cool features I wasn't even aware of. I missed pfsense. I left Endian working over the weekend, and the connection was perfect over the weekend. So, I put in Pfsense to see if I could play with settings and get it working, but it worked fine, and has been fine for the past 24 hours. I was really hoping the problem would still be hanging around, so I'd have a chance to change settings and figure out what was going on. If anybody ever has an idea why this happened, I'd be grateful to know for next time.

@stephenw10: Good result. Interesting thread too.  :) Steve Indeed

To do this using hardware similar to that in the first post you would need to check two things: 1. Your wifi APs must be able to assign different virtual APs (SSIDs) to VLANs. This is a feature commonly found in enterprise grade APs but not often cheap wifi equipment design for the SOHO market. You may be able to add that feature by using an alternative firmware (dd-wrt, openwrt, etc). 2. Your switches must be able able pass vlan tagged packets. They probably do but it's worth checking first. Then you assign some vlan interfaces in pfSense and use the same VLAN tags in the APs. Put in place appropriate firewall rules to isolate the different wifi networks. Steve Edit: The TP-Link TL-WA901ND quoted above does support this: @http://www.tp-link.com/en/products/details/?model=TL-WA901ND#fea: Up to 4 SSIDs and VLAN support, it allows networks administrator to segregate different services or applications to different designated users

Try a pfSense 2.1 snapshot http://snapshots.pfsense.org/

You'll need to reapply a firmware update. You must have installed a package that replaced the ldap library, such as squid, and then uninstalled it, which removed it. Reapplying your current firmware will replace the files with the proper versions and allow them to work again.

Well if it were any other use of the word, you'd be right… but the misspelling made it into the spec and we're stuck with it now. :-)

that would solve your issues if you have rouge dhcp server on the network.  Just the that the rule is not required and keeps the listing cleaner.  No reason for duplicate rules, etc.

How is that pfsense is blocking?  You state when you ping from the wan interface, so your on the pfsense interface or shell?  Blocks are done on the ingress of the interface..  I would have to assume your issues is when your isp, connection between you and 72.30.38.140 not pfsense blocking. Do a traceroute to see where your being blocked or connecting is failing. Just to give an example of my point I blocked that same IP on my lan interface.  Also keep in mind that not allow sites answer ping anyway.. but this one does. Anyway so lan works, then put in my firewall rule and lan does not work.  See the hits in the log where its blocked, but from my pfsense shell I can still ping it, etc. [image: fromlan-fromwan.png] [image: fromlan-fromwan.png_thumb]

http://info.iet.unipi.it/~luigi/netmap/

Unless I've missed something there's no field for "Extended Query" until version 2.1 - at least I can't find it in 2.0.1 - so I'm stuck for the moment.

I can see increase the time interval - every second is a bit much.  Wouldn't 10 be ok? If you do the math, it does add up to a bit of Bytes per month.  Looking a 15 second capture (30 packets) I show 2340 bytes x 4 = per minute x 60 = per hour x 24 = per day x 30 = per month.  Your looking at 404MBytes per month..  And for me it also checks my ipv6 tunnel gateway so x2 your looking at 808MB per month.. I love the graphs and yes they can be handy for seeing when there was an issue, etc.  So I would never turn it off - but changing it to every 10 seconds seems like a nice compromise.

It's a known issue that the X buttons are broken in IE. It's one of many AJAX scripts that IE hates.

For sure the new SMP-pf will be totally a big change. I achieve around 1.8 Gbps with a Dell 2850 and 2 quad nic. The secret rely in BGP, this is how you stop a DDoS. If 100 machines sends 1 Gbps, you have to tell your ISP through BGP to not send you the traffic of these 100 machines and it's free… as long as you have BGP. But, I think that pfsense could block many DDoS and easily scale horizontally with many pfsense machines. If they choke at 2 Gbps, then you put 5 machines at 2 gbps fully load-balance. You will then have 10 gbps around. I am sure they can achieve much more than that per machine.

I used the generator. At first it wouldn't connect and pfSense couldn't get a DHCP IP for the WAN interface. I left it overnight and it was working the next day. Sadly, after restarting the pfSense router, it won't connect again so I'm back to the Sky router for the moment…

@Nobbie: More information required. Are the G729 extensions at the same location as the GSM ones? Are the ports forwarded to the PBX on that network? Are the G729 extensions able to register? Are you able to make any calls successfully at all then lose two-way communication after a certain number of minutes? P.S. Did you make sure you have UDP ports forwarded and not TCP? Other thing, now is not only with g729… All that you say are ok but i had to make some capture on the PBX and i can see the problem though that is too rarely, because i can see the extension registered with the wan ip but the traffic rtp is through private ip. I have a simetric dsl with a static ip but the others places have a adsl connections to internet, they have nat configured on the routers, i tried to open all of ports and create a dmz but anything. I made others test with a client sip by internet on a cell phone and works ok but in adsl or cable modem not work. My configuration in pfsense My LAN is 10.10.0.0/24 WAN 201.204.13.xx i already open 5060 (sip) udp, 10000 - 20000 udp (rpt) I see in the PBX Sip registered with the wan ip 201.203.xxx.xxx but rtp through 192.168.1.2 (This is the private network configured in the adsl) why i see the private ip on the wan interface? and why my elastix registered the extension with the public ip and send the traffic rtp through the private network?

ok, I will get latest snapshot - thanks.

Actually you might have had a stale state in the state table from before the apply took effect, and resetting the states may have been enough to make it live. A reboot would have the same result though.