Not entirely sure what you meant there,  :-\ If you've added more firewall rules can we see screenshots of those? Steve

The panic is in something related to the packet filter. It looks a lot like what happens with schedules, but there is another similar panic in some unusual edge case. If the backtraces all look similar to that one, it's a near-certainty it's not a hardware problem. That would exhibit itself in a diff bt, or or varying ones.

Final followup here for me (I hope): Unbound 1.5.2rc1 has just been released, http://www.unbound.net/pipermail/unbound-users/2015-February/003774.html Interesting part of the release notes in our case: This release fixes a DNSSEC validation issue when an upstream server with different trust anchors introduces unsigned records in messages. Harden-glue when turned off allows potentially poisonous records in the cache in the hopes of that enabling DNS resolution for 'impossible to resolve' domains, it is fixed to have 'less cache poisoning', quotes added because it is by definition not secure to turn off harden-glue.  New features are that "inform" can be used to see which IPs lookup a domain, and unbound-control can use named unix pipes. According to Chris in Redmine, this should be fixed in 2.2.1.

If you don't have an old computer handy one of the $100 refurbished ones from NewEgg.com or the like does well. You might even decide to just keep using it for your main machine.

@fraglord: Thanks for the quick reply. Actually I was more like referring to the topic in general. Unfortunately use of a proxy isn't an option for my scenario here. Would it be easier to accomplish this task by using a given IP range (like 95.211..) that is supposed to be accessed through a specific gateway? If you know the IP addresses and/or subnet ranges, then the functionality is all in the base pfSense. Make an Alias with 95.211.0.0/16 etc… Then use it in firewall rules to block, or to pass and direct to a particular gateway/gateway group or traffic shape it or apply a limiter... If you know the actual names in the subdomain then you can put all those in an Alias also: server1.example.com www.example.com mail.example.com The problem, as you are well aware, is when you do not know all the names in the subdomain.

I thought about some inbuilt notification like the "You are on the latest version." check in the dashboard.

@BBcan177: So where do I submit a bug for the "pfSense Bug Tracker" ?  ;D In Redmine's redmine. :)

Hello CMB, The problem must have been hardware related, I picked up a base computer, threw in my NIC cards and installed fresh, then restored from the backup. Been running like a champ. The processor graph had me worried (one spike), the memory one just looks like a system that is restarting. I appreciate you looking into it. Thank you all for your help.

Are you talking to me? There's a saying about only getting one chance to make a first impression. I deployed about a half-dozen engenius CPEs a few years ago.  Constant lockups. Resetting them by disabling and enabling PoE, utter lack of support.  The software in these bridges absolutely sucked. Switched them out for Ubiquiti Nano M5s and have barely touched them since.  The software in the Ubiquitis blew the enidiot crap out of the water - and at a comparable price point. Never looked back.  Maybe they got better or bought another wireless company that could write code.

No.

Nice write-up.  :) Steve

Adding them to the Host Overrides works, thanks. I want the Traffic Graph to show FQDN for hosts on my local network, instead of just the IP addresses.

Yeah wild card of dest any would include the pfsense interface..  So my guess is there was something else in the rule, but it tcp or dest or source of lan net vs opt net or opt address, etc. Change it back to any for dest and you will see..  A rule of opt address is kind of useless if you want anything on that vlan to go anywhere other than that segment.

Update: It's been about a week and my logs are still working.  Cycling the "Show log entries in reverse order (newest entries on top)" setting got my logs working again.  To be extra sure though, an hour after that, I also clicked the "Reset Log Files" button.  I don't know if that made any difference, but at least my logs are still working.

Fair enough. I see the reasons for those features, but it's not really something I need at home. Not at 2-3 times the cost. I've ordered this instead: http://www.supermicro.nl/products/system/mini-itx/sys-e200-8b.cfm

Yeah. Make changes using the GUI and save /conf/config.xml.

Go under the dansguardian service and use the log and reporting page to make your change. You cannot directly edit the files. They will be overwritten. I don't know how many times I need to say it. STOP directly editing the files!

Thank you for the response. I had already researched and saw the page at the link you provided and went through the processes there. It did not resolve the issue. I have set no-logged firewall rules both allowing and blocking the WAN interface (one at a time, not both at once) outbound access to any host, internal or external, using any protocol as well as TCP / all flags allowed, as a test. It still blocks it and logs it, telling me that the rule is not applying. I believe the issue lies with a wireless router I have. I had flashed a Linksys/Cisco wireless router with DD-WRT and used one of their guides to set it up as a "dumb" switch. I then connected it to VLAN16 (192.168.16.0/24). All communications work well to and from the wireless hosts (ping, Internet access, etc). These log entries only appear when a wireless host is connected (such as a laptop or cell phone) and 90% of the external hosts are Google servers (the are all android phones). So, I'm thinking it has something to do with the setup on the router. I'm looking further into it at DD-WRT's website. Thanks again for your response.