Not really…  How exactly to you expect that to work out?  Seems like extra work for no added value other than something that could fail. How exactly is a user getting a cert that you didn't give them?  Why would you give them a cert and not put them in the group?

However, when I enable DHCP and NAT on my wireless access point (creating a double NAT situation), my speeds are almost tripled and everything works flawless. For sure this makes sense to me because then the both DHCP servers, one on the pfSense and the other on the WiFi Router are separated each from another and the networks is working well. What's going on here?  I really don't want to enable double NAT but I am completely confused… If you are setting up the WiFi Router in the so called wireless AP mode, to act only as a normal WLAN AP, you must also turn out the DHCP server on the AP or the pfSense, or you must work it out with the DHCP relay option. But with two DHCP servers you might be getting even this or similar trouble again and again. And if on the Switch once more again a DHCP server or helper service is running you might be getting much more trouble that you wont be able to get rid of this. It is the best to ensure that only one DHCP server is acting in the network or you work it out as explained above with the DHCP relay option.

Now on the apu1d4 though I am just running it on a plain Trancend SD card. I would more have look towards to use a mSATA or SSD otherwise perhaps a SATA-DOM that would be giving you the ability to do a full install of pfSense, together with the option to enable TRIM support and PowerD (hi adaptive) that might be a better or faster acting system than now. The interface is so slow. Everything takes forever. My personal mind will be the same as the one from @The Computer Guy, together with some cards pfSense might be having some problems at this time. There's no lag on the wired connections it's really just the user interface. I am running the most up to date version of pfsense This might be but if you are able to set up and install pfSense on a mSATA or even a SSD to do a test it would be also the best at this time as I see it right. Because if this is pending on a problem coming together with some drives you could work it out easily on this way. Does anybody have any ideas? Leave the miniPCIe slot with the SIM card free, insert a mSATA in the miniPCIe slot connected to the SATA Port and insert like you want a WiFi card in the last miniPCIe slot! I also have a lot of trouble with my wireless but I'll make that a different post. As I mentioned above you might be not able to use all miniPCIe slots as you want and for all miniPCIe cards you want in each of them. The miniPCIe slot connected to the SATA Port should be only used to insert mSATA drives in it. And in the miniPCIe slot connected to the SIM slot mostly only modems should be inserted and the the last free slot you might be inserting all other miniPCIe cards such as WiFi cards. So you prevent from many more trouble that could not be solved.

@hguo83: please keep up the great work and don't ever sell pfSense to Cisco. depends… what are the offering?  ;D

NIC1 -> WAN Configure as a WAN port like you need or are able to realize over PPPoE or with a static public IP address. NIC2 -> LAN(WAN) (WAN filtered by FW/SNORT) - servers on this side use global IPs Lets call it DMZ Port, behind this port usually the DMZ switch is standing connected with some or more servers with public Internet connection. Configure it as the DMZ port with matching rules for the WAN - DMZ and DMZ - LAN and vice versa. I suggest to use and go with 1:1 NAT and virtual IPs addresses (VIPs) and than set up the Snort on the WAN Port to filter and sniff all network traffic or set it up for the DMZ port that might be than only filtering and sniffing the WAN - DMZ traffic NIC3 -> LAN3 preferably accessible to a VPN USER A thru WAN This could be a VLAN or a own subnet with his own IP address range likes; a LAN Switch with VLAN support is connected: VLAN10 - PCs - 192.168.3.0/24 (255.255.255.0) a LAN Switch without VLAN support is connected: 192.168.3.0/24 (255.255.255.0) NIC4 -> LAN4 preferably accessible to a VPN USER B thru WAN a LAN Switch with VLAN support is connected: VLAN20 - PCs - 192.168.4.0/24 (255.255.255.0) a LAN Switch without VLAN support is connected: 192.168.4.0/24 (255.255.255.0) VPN USER C would have unfiltered access to the WAN. Set up and configure OpenVPN as the following: 3 different OpenVPN IPs – the first one (A) gets a route only to the VLAN10 or for the whole subnet (CIDR) 192.168.3.0/24 -- the second one (B) gets a route only to the VLAN20 or for the whole subnet (CIDR) 192.168.4.0/24 -- the third one (C) gets full access to the entire LAN, all subnets (CIDR) I mean or all VLANs handled by rules or routes.

Eh. Frankly, I'd run the duplication again.

Thanks I will give it try see how it works  ;D

I have someone going nom nom nom also real memory  = 8589934592 (8192 MB) avail memory = 8171061248 (7792 MB)

Just remember, you don't block data leaving an interface, you block data entering an interface. Make sure you block your undesired data from entering the firewall in the first place.

If you want to start messing around with LAGG you'll probably just need to bit the bullet and get more interfaces. Amazing how you start to chew through switch ports and interfaces when you start down this road. I just had to get a 48-port switch for my home/bench. Ran out at 24.

"through the L3 switch" So you have downstream networks from pfsense..  Does pfsense know how to get to those networks?  Have you setup nat so pfsense nats those networks, do the firewall rules allow for those other networks.  Normally when you have a downstream L3 switch doing routing you would connect that to your edge or wan router with a transit network. While you might have your downstream router pointing to pfsense as its default gateway, how does pfsense know how to get to those downstream networks??  You either need to create routes to them or run a routing protocol so pfsense learns how to get to them.  This sort of setup can also lead to asynchronous routing issues depending how everything is connected.. If for example you have a device in the 192.168.1.0/24 network using pfsense as gateway..  And he wants to talk to IP say in the 10 network, his gateway is pfsense, pfsense sends it to your L3 switch that routes it to the 10 hanging off it.. But when the 10 devices talks back the L3 switch says oh I have that 192.168.1 directly connected and just sends the traffic direct to client on that network.  So you have a asynchronous route - not good.  This is why downstream is normally connected via a transit so you don't run into that problem. Why don't you post a diagram and your network and we can work out where your problem is.. [image: downstreamnetworks.png] [image: downstreamnetworks.png_thumb]

Nice, I'll try it, thank you for the explanation. – Nicolas

@knebb: Anyways, despite of the pfSense doc telling the passwords are stored in cleartext for PPPoE they are not. I found the config.xml file, but there was only a password hash! So how does authentication for PPPoE work if the password is stored as hash? It's not a hash. It's base64-encoded because the config.xml will make kaboom when you put some special chars there. https://www.base64decode.org/

@ptt: Read/Serach about "Host Overrides"  https://doc.pfsense.org/index.php/Main_Page Thank you for your help

Hybrid outbound NAT is probably what you want. You can direct NAT to use any available public address of the proper type as the inside global (mapped) address based on any unmapped characteristics of the traffic (source, dest, etc).

Its ok man, Sorry for this topic. Thanks for your help.

That's all based on essentially just 2 lines there. ffs_clusteralloc at the beginning of the bt, and curthread being c-icap. Plus the entirety of the bt being the same functions on all 3.

Thank you! Both excellent suggestions!

@BlueKobold: You could be trying out to enable the following; PowerD (hi adaptive) Is really urgent to get the power from the CPU that is just in the moment needed increasing the mbuf size step by step You might be having to less RAM inside to do so tuning for Broadcom NICs Could be a hit, but not a must be. Installing better NICs likes Intel server grade net work adapters Would be the best option here as I see it right. Tuning and Troubleshooting Network Cards "System->Advanced“ "Use PowerD" enable hi adaptive I have already tried using Intel (Server) NIC and did not see any difference. For this reason, I'll leave tuning the Broadcoms until later. PowerD was not selected, but was already set at "hiadaptive". I presume checking this activates the daemon and requires a reboot? Edit: Random other information that makes me think this is not pfSense or (my) network related:  Other media (amazon/Netflix) play fine, only Hulu is having the issue.