You can replace the private IP with public IP if you are using the local authentication. Or using radius to assign an IP address to client, this would be better than the local authentication because you can also have usage report from radius. One think it cant do now is set a rate limit/speed limit by radius attribute on the PPPoE, tried a few option but all didn't work. You can achieve this by setting up a limiter on the shaper and apply a firewall rule using the limiter per client. You will be using the PPP radius attribute instead of the WISP. And dont forgot to turn off the outbound NAT for the PPPoE or it will still go via your PFsense WAN IP.

@jimp: It was a "double fault" which is unfortunately vague. In a few cases those can be software or driver related but usually that is hardware/memory. Well that's slightly inconvenient :)  I appreciate you looking at it

Installing the right version of php-mysql (which was needed) did the trick ;) pkg_add -rfiv http://ftp.uni-erlangen.de/mirrors/FreeBSD/ports/packages/databases/php53-mysql-5.3.27.tbz pkg_info -r http://ftp.uni-erlangen.de/mirrors/FreeBSD/ports/packages/databases/php53-mysql-5.3.27.tbz /etc/rc.php_ini_setup reboot

@johnpoz: Well for starters I have to assume if your behind dd-wrt that your natting there, and then again at pfsense?  Why?  its hard to forward protocols like ike through nat, you can use encapsulation so that IKE and ESP use udp port 4500. Double natting is not going to make it any easier.  Can you remove dd-wrt from the equation.  Why can not just use pfsense as your vpn endpoint? Well, everything behind pfsense is lab computer. I want to  be able to shut down the server, so I can sleep. :) And I prefer windows VPN. Nothing against OpenVPN. Maybe I can put it like this DMZ DD-WRT -> Pfense -> Win svr.

Got it…some sort of problem with client, other clients work fine. have a good day all!

A customer have a 120 plugged into bigger draytek router which auto load balanced two adsl lines but found it sluggish as well. I suspect one of the reasons why the 120 is sluggish is the MTU is not 1500 but just under I think 1496 from memory (its back in Jan I last worked on that system) and the UK (BT) adsl uses the full MTU of 1500 unlike elsewhere like the US which uses just under. FWIW.

Bingo. Thank you, Jim.

You can just use rules on the pfsync interface to only allow from the pfsync subnet as a source. pf is smart enough to not forward spoofed packets if they enter the "wrong" interface.

Just to bump this as I'm also getting this error since I plugged the wan into a new router with dhcp on the router. AMD64 2.1 release with openvpn. Nov 14 04:00:22 check_reload_status: Reloading filter Nov 14 04:00:22 check_reload_status: Restarting OpenVPN tunnels/interfaces Nov 14 04:00:22 check_reload_status: Restarting ipsec tunnels Nov 14 04:00:22 check_reload_status: updating dyndns WAN_DHCP Nov 14 04:00:03 php: rc.interfaces_wan_configure: The command '/sbin/dhclient -c /var/etc/dhclient_wan.conf msk0 > /tmp/msk0_output 2> /tmp/msk0_error_output' returned exit code '1', the output was '' Nov 14 04:00:03 php: rc.interfaces_wan_configure: The command '/sbin/ifconfig 'msk0' inet delete' returned exit code '1', the output was 'ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address' Nov 14 04:00:00 check_reload_status: Configuring interface wan Nov 14 00:05:59 kernel: re0: promiscuous mode enabled Edit: Should add that going into the wan interface and clicking save then apply brings the nic back up again, so a sort of work around but not ideal for the hours its down until its checked and the above action carried out. Gonna try it without openvpn servers installed and see if that makes a difference for now as openvpn isnt essential for the next few weeks. Edit2 Dont know if this is relevent https://groups.google.com/forum/#!msg/tunnelblick-discuss/NVJunGLxngE/EkjCRMgHfzYJ "2013-06-20 08:16:17 /sbin/ifconfig tun2 delete ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address 2013-06-20 08:16:17 NOTE: Tried to delete pre-existing tun/tap instance – No Problem if failure"

Can you make the value you want to change an alias? If so, it's fairly easy to change… You can change the value of a URL alias by doing three things. 1.) Change the file the URL points to 2.) Change the file that is used to load the pfctl rules 3.) Reload the pfctl rule You need to do both 1 and 2 because pfSense occasionally does the update via a cron job (/usr/bin/nice -n20 /etc/rc.update_urltables). If you don't do both, it will overwrite your change. The following shell code will do it. tbl_name=your_alias_name new_alias_file=/some_directory/some_file www_alias_file=/usr/local/www/some_directory/some_file pfctl_alias_file=/var/db/aliastables/$tbl_name.txt # update the file used for the URL alias cp $new_alias_file $www_alias_file # update the file used for the pfctl rule cp $www_alias_file $pfctl_alias_file # force update of the alias /sbin/pfctl -t $tbl_name -T replace -f $pfctl_alias_file 2>&1 Now the more difficult option… You could also start hacking away at the rule edit screen and create a screen that does what you need... but it would take a little work. The two php files to look at are firewall_rules.php and firewall_rules_edit.php. Passing the correct "id" to firewall_rules_edit .php will bring up the rule for edit - you'd just need to find the rule first. The custom page can be added to pfsense by modifying fbegin.inc (all of these files are in /usr/local/www).

I haven't used it, but I've noticed that "Install on gmirror" or similarly worded option appears in the installer if 2 or more disks are available. So you should be able to add 2 or more virtual drives for the VM and setup a gmirror during the setup.

Gateway to a local subnet.

Great. :) I see that they abandoned their original plan to use off the shelf hardware because it wasn't capable of more than 60Mbps. I can't find what their custom board can do though.  :- Keep us updated with your experiences of this interesting product. Steve

That is correct. And if it was selected before, you will most likely need to reboot to make sure the module is unloaded properly.

To fully proxy https traffic you need to run a man-in-the-middle like you said. If you have the correct certificates in place though your users won't see any warnings and hence probably won't know anything about it. Perhaps tmg inserts the correct certs without you doing anything? Steve

Similar? http://forum.pfsense.org/index.php/topic,64527.msg349711.html#msg349711

No, relayd is only acting as a port forward (to put it simply) – if you want that kind of control, you'll need a proxy/lb package with more features such as HAproxy.