Yep, the dyndns log entry is just a symptom of the WAN going down. Note that the apinger logs don't show the line going bad slowly with excessive ping times or packet loss gradually building up. They show the WAN going down directly. What sort of WAN connection do you have? Does the time, 19.42, equate to anything you might have done? What time was it you last reset your modem? Steve

i haven't tried it myself but you could tried to configure IGMP Proxy

If you have a samba server or windows server that is up 24/7 then just have that run a WINS server and add it to the DHCP configuration in pfSense so that all clients register with it. These sorts of problems usually occur when you have a network of windows boxes behind pfSense but no domain controller and no WINS service. In that situation one box will become the 'netbios name server' but if it's turned off it can take ages for another machine to take over that duty and longer for it to have a complete list. It's been a while since I've had to deal with that I could be skipping a few steps!  ;) Steve

I have seen similar errors caused by something as simple as a card that had become unseated in it's slot. Also bad cable or bad switch, anything that might stop the NIC actually sending packets whilst still being connected enough to show up. Steve

Yep, you shouldn't be swapping, ever. Not if you want any sort of decent performance anyway.  ;) Quite why running a public IP would require more memory though is odd if that is the issue. What hardware are you running? I see you have 256MB RAM, are you running any packages? Steve

If you work with it alot then yeah, it would be difficult to understand.  I hit that bump often myself.  Even just a little confirmation dialog would probably help alot.

Yep, looks like it's included in FreeBSD 10: https://svnweb.freebsd.org/base/head/sys/dev/usb/net/if_urndis.c?view=log Don't know whether it made it into 2.2 though, I'll have to re-fire my test box. Also I can't find what devices it supports. Edit: Looks like it uses a generic USB vendor/product ID so it should work with a variety of hardware, all Android though  :-. Some older man pages list some known hardware: The urndis driver provides support for Ethernet access over Remote NDIS.     The urndis driver should work with all USB RNDIS devices, but the     following devices are known to work: o  Google Nexus One           o  HTC Dream / T-Mobile G1 / ADP1           o  HTC Hero           o  HTC Magic           o  HTC Tattoo           o  HTC Wildfire Steve

I haven't checked the bios as I don't have a reliable RJ45 to console cable, my rigged one let me do the install but the firewall is away from any other machine right now. I've modified the dash, that was easy enough, I'll try the make on a clean install, I've tried CC but it failed to compile, that may have been why. Thanks

Not sure if this will help but here goes.  I am not familiar with elastix but I had registration issues on my asterisk box until I made some changes in sip_custom.conf (sip.conf)  the file may be named different on your system (I use piaf) here is what mine looks like externip=put the ip of your wan interface here localnet=192.168.150.0/255.255.255.0 localnet=10.0.5.0/255.255.255.0 localnet=10.0.8.0/255.255.255.0 nat=yes promiscredir=yes all the local net entries are for the different internal (local) networks I have that contain phones.  Some of the are vpn I only have the default outbound rule in pfsense and my wan nat/fw rules look like the attachment below (192.168.150.201) is my local asterisk box My gut feeling is that this is probably an issue with the config on the asterisk box and not necessarily the fw.  Once I got everything on my piaf box configured it has worked smooth for a very long time.  (knock wood) [image: 2014-07-13_150110.jpg] [image: 2014-07-13_150110.jpg_thumb]

"does pfsense intercept dns traffic if clients set their own DNS servers?" No but my ISP does this all the time and forces me to use pages that they have cached even when i use OpenDNS for the upstream server. Bit rude of them when I have elected not to use their DNS server but this means that they are also having to isue fake SSL certificates too and are doing a Man-in-Middle to speed up pages and to save themselves money on the upstream bandwidth. Does not seem legal to me

Once you get the pppoe connection working you will have to decide how you are going to use the two wans, either independently or in a load balancing configuration. After that you have set up firewall rules on your lan and other interfaces to direct traffic accordingly.

A common cause of high CPU usage like this is opening the dashboard on some client somewhere and forgetting to close it. Though that would not usually be for more than a day.  ;) Steve

Can anyone confirm for sure that this is the correct way to do this, and if it's working? This is how I have ours set up – 2 domain controllers (.2 and .3) but I am not sure how to tell if it's actually doing the right thing without forcefully shutting down one of the DCs. [image: 40f72dc5.png]

It won't be gone for long. Reinstalling won't stop that kind of issue. It may prolong its life for some period (because just a power cycle could kick it back into shape temporarily), but I'd have a spare drive on hand as it's likely it won't last long.

@MarkVLK: Would it be possible to just install Snorby on the pfSense box and have Snort + Snorby both running on it? Probably not without adding a lot of dependent libraries.  I do not recommend doing this on your firewall.  It adds way too many attack vectors with all the extra stuff like shared libraries.  You can also run out of CPU horsepower pretty quickly with a MySQL server, Snort (or Suricata), Snorby and then basic firewalling as well.  Much better to do this on a different server.  You can use a physical machine or a virtual one. Bill

@cmb: It's that package, not country blocking in general, that's no longer supported or maintained. pfblocker replaces it (though its data is very old at this point, other options better if you need data with a very high degree of accuracy). The country lists in pfblocker stopped being updated when countryipblocks stopped distributing data for free. There will be an alternative to that coming before too long though, stay tuned. I disabled the Countryblock package in the repo since it's been so long no one should be using that anymore. Thanks for the explanation!