Hi, Yes indeed this is not the correct parameter. :-( I can't figure out which parameter to use. But this is a freebsd question. Thanks a lot. At least I have the confirmation where this parameter should be added on a pfsense box. Cheers.

How can I use squid as a transparent proxy ?  one of the groups use console applications that require internet access and there is no option to configure proxy for them

Not sure if this will apply.  If you are running 2012 server and desktops are 8.1 or newer, and last but not least your domain controller is across a VPN tunnel you can now use a feature in which even though the printer share is setup on the remote machine,  printing is done directly to the printer. Also maybe I missed it but is the printer USB or network capable?

With the ISP router which is doing NAT (1) and the pfSense is doing also NAT (2) and on top the other firewall is doing also NAT (3) you were creating a triple NAT situation and related to this this your problems exists. You have two choices to get rid of this issue. Set the ISP router to the so called "bridge mode" that the router is only acting as a pure modem if this able to realize, it would be the fastest and most stable way. Or buy a plain and pure modem. Cons: no Pros: You have then only created a double NAT situation with which you can live. Or you should bridge the LAN port from the ISP router to the WAN port from the pfSense firewall as suggest from @viragomann, that pfSense is acting as a fully transparent firewall then. Cons: Port flapping, packet loss or packet drops Pros: fully transparent firewall which is invisible

https://forum.pfsense.org/index.php?topic=107947.0 I had a TOPIC there and thanks to johnpoz  he found the problem wich is from the ISP dns

I agree about using ubiquiti unifi.  You can't beat the price point!  If you are in US you can get best price from Amazon.

Yeah I missed that in your screenshot. Sorry. Glad you found it.

You only have TCP traffic enabled.  What about UDP?  You can get rid of rules 1 and rule 2, unless you run IP6 traffic on your network.  Edit rule 3 so that it's using wildcard for everything and any for protocol.  You say you can ping websites but not access them.  Can you resolve any hostnames?  Is DNS working properly?

pfSense is based on FreeBSD (10.x and climbing now) so that's where your hardware requirements will come from. Usually they imply some kind of x86 processor and NIC interfaces, not sure if your device fits that bill. What are you hoping to do with pfSense?

Update - after all clients disconnect, I can then access the Web admin UI page. But when any IPSec client is connected, it will continue to hang, if I have previously tried viewing IPSec status page.

Well, I did a lot of test and I can't find the problem. Definitely, it is not a problem of pfsense. As divsys said, I'm going to use another AP to see what happens. I did these tests: No vlans No security in TPLINK DHCP in tplink or DHCP in pfsense Review of logs… TPLINK allows these operation modes:  (1)Access Point (2)Multi-SSID (3)Client (4)WDS Repeater (5)Universal Repeater (6)Bridge with AP I tried with 1 and 2. Should I try with another one? Thank you all for you help, I learnt a lot. Regards.

If you are talking about a subnet routed to one of the addresses on your /28 you will be fine. You can: Just use the addresses on pfSense WAN as virtual IP addresses Assign the routed subnet to an interface behind your WAN and put hosts on that subnet with public IP addresses. This is probably preferred especially since you can use the other addresses on the /28 as VIPs if you need them. You would get the benefit of pfSense as a firewall to all the hosts and you would have no NAT. But, as always, it really depends on what it is you need to accomplish.

More CPUs have integrated GPUs, so I just wondering if it would be feasible to do in pfsense. Why they should write code for something that is really long times available from the lower bottom to the highest top? There are cards that can be easily used for this with much more power like the internal GPU of a CPU. Home and SOHO till Pro and Enterprise Intel Atom SoCs, Xeon E3 and E5 CPUs with integrated AES-NI instruction set (free of charge) SOHO Soekris vpn1411 for older system with 100 MBit/s ports (fully supported) ~$72 Pro and Enterprise Netgate Intel QuickAssist adapter without additional LAN ports ~$1100 Pro and Enterprise Netgate QuickAssist adapter with 4 additional LAN ports ~n/a (call) ISPs and bigger companies Intel QuickAssist adapters