it's more than likely it's builtin the kernel and not a module. kldstat shows that it isnt loaded seperately: [2.2.2-DEVELOPMENT][root@pfsense]/root: kldstat Id Refs Address    Size    Name 1  10 0xc0400000 1f3c660  kernel 2    1 0xc4d45000 20000    ipfw.ko 3    1 0xc475b000 d000    dummynet.ko it also shows that the ones that are loaded are in the directory you've been looking in: [2.2.2-DEVELOPMENT][root@pfsense]/root: find / -name ipfw.ko /boot/kernel/ipfw.ko [2.2.2-DEVELOPMENT][root@pfsense]/root:

@phil.davis: A couple of things were fixed as per this forum thread: https://forum.pfsense.org/index.php?topic=88956.msg491905#msg491905 Those would all be in 2.2.1-RELEASE Thank you! Post #4 in that thread made it.

For front-end devices like this they are not going to have routes back to places inside your network that you might be coming from. So I put Outbound NAT into hybrid mode and add a rule that has all the source subnets that I ever come from and NATs those out WAN. That way if I come via some site-to-site OpenVPN links, road warrior OpenVPN or… I always get NAT applied out to the WAN. The front-end device sees the connection coming from pfSense WAN IP and can respond to that. Screen shot attached from my home system (that has a bunch of rubbish subnets from testing various VLAN crud... over time, I should clean up one day) [image: Hybrid-Outbound-NAT.png] [image: Hybrid-Outbound-NAT.png_thumb]

I agree that it would be awesome if it did that.  Loosing VLAN's and tunnels is pretty major, as are rules, aliases, etc. As a work around, it's pretty simple to boot up, figure out what the new interface name is, edit the config file to replace the old interface name with the new, copy the config into place, reboot and roll along.  Generally it can be done in less than five minutes IF you expect it and have already figured out where the config file is and backed up before hand.

Most stupid idea contest?

What are you IP address, netmask and gateway for your pfSense WAN and LANs?  What is your local network, e.g. 192.169.1.0, 10.0.0.0…?

@jimp: No idea, the author of the software is likely the only person who can answer that properly. well… i got a response from damien. softflowd will never fill in out_bytes, instead it sends two flows - one for each direction. The reason for this is just history, it matches what Netflow < 9 did. It probably wouldn't be much work to adjust softflowd to do it differently, but I don't have time to work on it anymore unfortunately. -d Jim> thank you for replying.

@stephenw10: Jim created a patch for 2.2.1 you can use with the patches package though it's only one line you need to change: http://files.atx.pfsense.org/jimp/patches/bridge-single.patch And that's been committed for 2.2.2 and newer so no patch is necessary.

Well stuffed now, upgraded pfsense to 2.2.1 and Freeradius 2 will not work, when -I run radiusd -X, I get set START-ENABLE to yes in \etc\rc.conf but there is no rc.conf No Freeradius package in 2.0.3 the best of all pfsense versions, since then nothing but basic stuff seems to work anymore. IPsec VPN does not work and Freeradius does not work.

Port-blocking via the firewall can do that but, depending on the service, you may end up playing whack-a-mole.  Depending on how tight a network you want to run, you could block everything outgoing except approved ports, and even that's not perfect.

pfBlocker -> dead. 2.1.4 -> dead. Good luck. Thanks for the prod, now running 2.2.1 and pfblockerNG. The upgrade went quite well, my IPTV multicast over the iGMP proxy is still working which is what I was scared of.

Thanks again KOM. Another instance of me owing you a beer.  I needed this for another customer firewall.

Use Snort + AppID? http://blog.snort.org/2014/04/openappid-application-rules.html Just an idea….

When FTTC is available in your area, you can just swap the Netgear for the Openreach modem. I run my home setup like that, works great :)

To set up the UML295 you should do the following: On your Windows 7 PC follow these instructions to enable IP passthrough: http://pcdn2-download.vzw.com/win/UML295/UML295_IPPT_UserGuide-v2.pdf 1. Plug the UML295 into the pfsense box 2. Go to the Interfaces drop down and click (assign) 3. Select the ue0 Interface from the Available network ports dropdown and press the add button 4. Enable the interface' 5. Select DHCP for the IPv4 dropdown and save 6. Apply the configuration At this point the interface should work. You may want to ensure that it still works after a reboot, as I've found that it will not. https://forum.pfsense.org/index.php?topic=91907.0 https://redmine.pfsense.org/issues/4589 Let me know how it goes for you.

Yeah, sorry about that. I read it my self and saw how incomprehensible it is. I'll be back.

What version of OS X Server? What is your end goal?  Not what certificates you think you want where, but what do you want to be able to do with them? Certificate handling in OS X Server has always been, shall I say, squirrelley.