So… your ISP DNS on WAN is the gateway on OPT? I don't think this is particularly sane... How many levels of NAT are you behind? Also, WTH is the pfSense version used here? Most of this configuration stuff does not exist on 2.1.x, nor on 2.2.x; plus copyright 2004 - 2009.  :o ::)

I'm now back on 2.1.5. (same config) and get no more crashes on "ping -l 2000" across IPSEC-VPN. Also interesting: This specific branch office can successfully ping the gateway of my main office ISP with ICMP length 2000 but I don't get a reply on the next hop, which is the pfsense external IP!? With 2.1.5 I get replies by pinging the pfsense external Interface with fragmented packets which wasn't successfull with v2.2.2.

I'd agree with much of what you say if I was editing a rule, but I'm not 100% sure I had two FF tabs open on the same interface at the same time last night and like you I certainly would not expect to be able to undo anything by hitting the back button, its purely for navigation only. However having written my own webservers attached to various databases along with the stateless "headache" of browsers compared to apps and the javascript employed to force reloads when a user hits the back button which then prompts a reload, maybe like I've said above, could the user experience be improved a bit? Until I recode these windows apps I've got to record everything I do in the browser I cant be 100% its a random bug or user error. If its user error I'll hold my hands up to that but if its not perhaps a bit of extra vigilance is useful considering this https://forum.pfsense.org/index.php?topic=94162.0 is something I've hit upon as well which might be sorted in 2.2.3. All I can say is theres some odd things happening in my systems even when they have been taken down, bioses updated, spin diskswiped before OS's installed and yet these odd things going wrong like my ssd HD pwd which is set using the bios gets changed and its not been forgotten as I've had the pwd written down. Saying that Persistant Back Doors (PBD) are a reality in this world along with other tricks so ultimately what is going on in my system is anyone's guess atm.  :)

Now that you mention security onion I might have an iso I've downloaded … yep I've got 12.04.5 which looks like I downloaded it Sept last year. I'll fire it up and have a look. BTW re the PM I think I got to the bottom of the weird stuff as seen here. https://forum.pfsense.org/index.php?topic=94554.0 so I over the weekend I can look at your blocker again and give that a whirl.

For a while I was having more luck with free proxy servers from around the world but then they stopped working as well often once I logged in so other thoughts as to what was going on did cross my mind knowing what I know.  ;D

@dbennett: PHP Errors: [28-May-2015 17:09:43 CST6CDT] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 260833280 bytes) in /usr/local/www/exec.php on line 240 This is the Diagnostics: Command Promp GUI Page /usr/local/www/exec.php on line 240 Did you run any commands from that GUI page?

@doktornotor: None. Traffic on the same subnet does not go through the firewall. Yes, I know. But 192.168.70.10 (the load balancer virtual server on SRV network) is a virtual IP address on the firewall, so its traffic goes to the firewall and enter in the load balancer. Anyway, I solved. The outbound NAT rule was wrong. The correct one is: Interface: SRV Protocol: any Source: network 192.168.70.0/24 (the SRV network) Source port: empty Destination: network 192.168.70.21/32 (the IP address of the server in the load balancer - I have to create one rule per server) Translation: network 192.168.70.254 (The CARP virtual IP address for the SRV network) Thank you very much! Bye

Good question, great answer. Are there current NICs that do not support VLAN tagging themselves? If so, which?

bump?

Dear fellows, Finally the problem is solved! That was quite a tricky problem, due to the fact that I was trouble shooting it from distance. One of the computers behind the pfsense firewall was running uTorrent with enabled DHT. When the computer was ON and uTorrent was in IDLE mode (no active seeding/leeching, just the app running) the WAN interface was constantly dropping my PPPoE connection. However, when uTorrent was running (actively seeding/leeching), there is no problem, but as soon as it goes to IDLE - pfsense restarts all services. As soon as I disabled DHT on uTorrent the problem disappeared. Unfortunately I couldn't identify why with DHT enabled and uTorrent in idle, pfsense was restarting the services, but at least the problem is gone. More on the uTorrent issue: https://forum.pfsense.org/index.php?topic=93812.0 Thank for all the help. Regards, Nick

Try using a geographic named zone and not that one, and you would at least need to kill/restart charon and filterlog, but a reboot is best after changing time zones.

Just as an update, we were unable to further reproduce the errors. Most probably due to the fact that we have reached our steady -sort of-  set of rules. But we suspect  the process filterdns is messing things up somehow when hierarchical aliases are used. We hope this will be addressed in future releases as PfSense is a great product. BDAB

Hmm. I would think your logic is flawed. I use CARP for failover purposes and send my logs to an ELK stack to visualize firewall entries. Why would I want logs from the secondary host when its in Backup state and not being actively used? And even then, I could just configure the other hosts to use their LAN IP as source? And keep primary as CARP.

@NOYB: Please post packet capture of both the successful Android WoL and failed pfSense WoL. All methods of WoL are not created equal, and it could be very telling as to why one works and the other does not. Will try this as soon as I can… Good advice. Thank you.