@deddric: So what´s opinion on exposing webgui (other port then default) to internet? Never in a million years would I do that or suggest that to anyone..  If you "must" do it then it would need to be locked to so specific source IP that is in your control.

@Jailer: If you have it set up with a domain name then you won't be able to access it locally without NAT reflection.  Wordpress is rather finicky about that. I misunderstood your post and thought you had it running locally on your LAN and not exposed to the internet. Your port forward needs a little work. Change the destination to WAN address and your redirect target IP should be the local IP of your wordpress installation. Do the same for HTTPS and you should be all set. You sir… are a magician. Now my main site works!!!!!!! i just have to figure out why my 2nd site doesn't work.. since it's just the same link with "wedding" as the host name. I'll have to see what else i need to change.

There is a problem like this.

What I would do is create a separate internal network with your DNS server. Create a separate network with a /24 netmask. Ideally physically separate it to your main network. As others have suggested, you can hijack the 53 forward packets to your DNS server in your separate network. Do you have an available network interface in your pfsense router?

You probably want to change the WebGUI port to something different. (it binds to all local addresses… including the VIPs)

I agree with the Realtek assessment.  I was running a pfSense box that would freeze up randomly.  Root cause, Reaktek chipset on one of the NICs.  Replaced the Realtek chipset and it's been rock solid since.

Is this a question or a statement?

Glad you got it sorted out.

Thanks very much for letting us know. Glad it's sorted out.

Outbound NAT has nothing to do with where traffic is routed. It only determines what translations happen when such traffic is already routed out that interface. What you are seeing has absolutely nothing to do with the introduction of Hybrid Outbound NAT mode despite your conclusions. If you are policy routing over the VPN then traffic sourced from the firewall itself is not subject to policy routing because it never enters the interface with the policy routing rules on it. If you are accepting a default route from the VPN provider then traffic sourced from the firewall itself should follow that route while that VPN is up.

It may take it's settings only when it's started in which case enabling it after wards will not have any effect. It's hard to say what the issue is there. Maybe run  a packet capture to look at what's happening. Devices that don't allow you to enter the IP of the resource always seem like the result of lazy programmers to me, relying entirely on auto-discovery. Steve

My pfsense box is now setup properly (i guess). I edited my original post. I am now facing only one problem with the VLAN on the HP Procurve 2920 switch. I do not know if may belong here but you might be able to help me :) I have a default VLAN_DEFAULT with ID 1 on the switch with untagged ports 1-4,25-48. The pfsense box is connected to port 48. Then i have the VLAN with ID 10 with untagged ports 5-24 for computers. When i connect my laptop to port 1 for example, the default VLAN, i have internet and can ping all VLANs. When i connect my laptop to port 5 however, i get an "unidentified network" with "no internet" on my laptop. Do i have to add a NAT rule or similar on pfsense to get this working?

No, that procedure works. You might have been experiencing some extra-special fs corruption.

FWIW, I am having exactly the same NTP widget issue. I will try clearing my Firefox cache to see if that fixes things. Thanks for the suggestion. Update Clearing the cache and reinstalling the widget had no effect, the issue remains. Update 2 Chrome does not suffer from the problem. Chrome keeps perfect time. My Firefox installation continues to suffer, however. Cheers, Pete

anyone got grafana template to share?

I found the malefactor: my p2p client resilio sync on my synology server. This is causing all the trouble with the new router. When I turn the sync off / stop the app it’s working like before. Shortly after turning it on, the whole network Stucks. I think it has something with UPnP to do.

Hi, I have the same problem: Aug 25 15:04:12 kernel pfr_update_stats: assertion failed. Aug 25 14:51:13 kernel pfr_update_stats: assertion failed. Aug 25 14:45:54 kernel pfr_update_stats: assertion failed. Aug 25 14:37:32 kernel pfr_update_stats: assertion failed. Aug 25 14:32:15 kernel pfr_update_stats: assertion failed. Aug 25 14:32:04 kernel pfr_update_stats: assertion failed. Aug 25 14:31:52 kernel pfr_update_stats: assertion failed. Aug 25 14:22:45 kernel pfr_update_stats: assertion failed. Aug 25 14:22:45 kernel pfr_update_stats: assertion failed. Aug 25 14:22:23 kernel pfr_update_stats: assertion failed. Aug 25 14:22:23 kernel pfr_update_stats: assertion failed. Aug 25 14:21:37 kernel pfr_update_stats: assertion failed. Aug 25 14:10:19 kernel pfr_update_stats: assertion failed. Aug 25 14:07:55 kernel pfr_update_stats: assertion failed. Aug 25 13:50:40 kernel pfr_update_stats: assertion failed. PfSense 2.3.4-RELEASE-p1 (amd64) installed on HDD, the only package that is installed is FTP_Client_Proxy. It is a Dell PowerEdge R310 with these network adapters: 2 embedded Broadcom NetXtreme II Gigabit Ethernet (firmware 08.07.26) Intel(R) Gigabit ET Quad Port Server Adapter The problem started with the update from 2.1.5 to 2.3.4_1 (via 2.3.4). The day before I updated the Broadcom firmware to the latest version by Dell, but I did not see this error until I updated pfsense. This was the secondary firewall of an HA firewall pair with pfsense 2.1.5 amd64 full install with package pfflowd. Not complex configuration, but we have many rules. We have 13 interfaces and an interface group, we use carp, pfsync, xmlrpc sync, vpn: more than 60 openvpn and 10 ipsec, lag, vlan, dhcp server, dns forwarder, ntp… I have 2 LAG (whith LACP): igb0,igb1 and igb2,igb3. One LAG is assigned to an interface, the other has some VLANs. One Broadcom is directly connected to the other firewall (sync). The primary firewall has carp disabled, I have disabled pfsync and xmlrpc sync in both firewall and I have tried to shutdown the primary firewall. I tried to disable the only floating rule that we have (deny rule). I have backupped the config and done a fresh install of pfsense 2.3.4, upgraded to 2.3.4_1 and imported the config, but The problem persists. EDIT: I started again primary firewall with 2.1.5 (with same Dell firmware updates of secondary firewall), it worked fine for serveral hours and the secondary firewall with 2.3.4_1 didn't log errors anymore, ok it was in backup state, so no virtual ip, no vpn and no one used it as a gateway, but it received broadcast traffic, traffic directed to its ips and dhcp server has continued working. When I turned off carp on the 2.1.5 firewall, the 2.3.4 came back primary and after few minutes the error appeared again. Any suggestion to fix this issue? Thanks in advance, Gianluca.