To my knowledge there is nothing you can do. normally it would still work if the mtu is set to automatic in the adapter settings (standard) unless the ISP is blocking ICMP traffic which is needed to automatically adjust the MTU value. (often done to prevent ddos attacks) So you'd have to ask your ISP for a solution.

pfBlockerNG has a proxy blocklist (based on MaxMind data).

Im having the same exact problem, did you finally got it working?

Ah, OK did not realize the difference, was just trying to save a few bucks. Thanks!

dmidecode atleast shows the sn of the board…thanks jimp..will try the rest

Are you using the Custom List box for these IPs? or are you saving the IPs to a file in the pfSense box and adding it to the URL / local file entry? The "state" is only for the URL / Local file entry. The Custom list needs to be empty or it will create a Firewall rule automatically. I'm using a URL (not local) and the file is not empty.  So there's no way to "disable" without deleting the entry?

@chpalmer: So-  your trying to limit access to the firewall pictured from one host with a dynamic address? Yes. This source name is my dyndns host. I need limit access to the only one dyndns host name. THX

…or if the users happened to all be taking a bath...

Beyond LADVD, no… (Doesn't support LLTD if that's what you mean.)

Why not just enable the SNMP service and then use your favourite network monitoring tool?

@divsys: I have no idea if this will help your particular issue, but it may be worth a try to roll forward to the current 2.2.4. There were some IPSec issues resolved in that release. It's only a guess, but reasonably easy to try….... Hi, Thanks for the suggestion. The problem happens in 2.2.3 and 2.2.4. I downgraded to 2.2.2 again and the problem disappears. I'll try again with 2.3. There is something wrong with those versions. I've seen some IPSec related problems reported in the forums. I hope the pfsense team solve this. Thanks..

@firewalluser: Interesting, do you know if its affecting performance of the system elsewhere? I dont run Suricata but I wondered if this might be relevant to your situ? https://forum.zentyal.org/index.php?topic=18893.0 I am not seeing any negative impacts on performance.. Swap usage remains steady at 0%, and the CPU RRD graph looks good, with occasional spikes to 50-60% CPU during rule reloads.. As far as the link you sent – my stats log is being rotated according to the default automatic log cleanup settings under "Log size and retention limits".  I have turned off the hard limit on directory size, and my Suricata logs are staying at around 2-3GB with automatic rotation and retention.

I can try rearranging the interfaces, but I can't exclude re1 since all four NICs are carrying active traffic. I'll report back any changes.

I understood arguments, but… I am very sad  :-\

Just noticed that the NIC is not coming up as 100Mb/Full Duplex on our switch.  It is coming up as 100Mb/Half Duplex.  Both card and switch port are set to 100Mb/s.  When I moved it to a different port as a test and forgot to change the setting on the switch, when the port came up it showed 100MB/Half Duplex.  Messed around a little with the card settings, changed switches, same problem.  Swapped cards with the same model card and same problem.  So, I think I have identified the culprit. Card is an Intel Gigabit CT, which shows to be compatible with FreeBSD.  Intel has some info on their site regarding the card and FreeBSD.  If I find a solution with this card I will post the info here.

I always disable all that stuff without thinking about it.  Usually nothing good comes from them knowing you're behind a proxy.