I found the issue. It turned out to be a bad switch. There was an unmanaged ethernet switch between the modem and the WAN, I replaced the switch and haven't had a drop since.

You can't set the media type on a PPPoE interface (or any type of virtual interface) you have to set it on the parent interface. If you don't have that available because it isn't assigned just add it as an new interface and set it as type 'none'. Then set the media type there. What is the actual hardware the WAN is connected to? Are you sure it's not forced to 100Mbps, have you tried connecting to it with something else? Steve

Those are both FreeNAS issues. The first looks like some problem with jails perhaps? It's trying to rename the virtual Ethernet pair and can't for whatever reason. The second issue maybe DNS related. Read this: https://bugs.freenas.org/issues/4027 Have you recently updated FreeNAS? You will probably have more luck on the FreeNAS forum solving those, though many here run FreeNAS. Steve

Wanted to say thank you for this post, I was struggling to figure out why our new android devices suddenly couldn't load facebook on wifi, and it was draining our batteries trying. I set it to "none" and off I went. Now I will go back and set up IPv6 locally since my ISP does support IPv6 (I have it getting an address on the WAN side, so I'll setup IPv6 on the LAN). Thanks again!

The hardware offloading features available in the System: Advanced: Networking: section of the webgui do not include a complete TOE as referenced in that Wiki page. They only offload smaller functions: TSO, LRO and checksum. It looks like there is at least some support for TOE in FreeBSD but you would need to enable in manually in pfSense. Importantly I have no idea how it would interact with pf. As referenced in the wiki article once you've handed off the entire TCP stack to hardware much of the OS internal networking features are by-passed. It could be potentially completely redundant in pfSense. Steve

All of the methods people use to try to examine and filter the contents of HTTPS amount to a MITM attack.  Which is about the same as breaking HTTPS.

Tell them what you want.

It looks like it's HAVP as when I remove never_direct allow all;cache_peer 127.0.0.1 parent 3125 0 name=havp no-query no-digest no-netdb-exchange default; from the integrations box, it then successfully downloads. I've now added .adobe.com/ to the whitelist and it seems to be working fine. Any ideas why this is happening in the first place? Detect broken executables is turned off.

Good stuff.  Thanks a lot, Jim!

Unfortunately no, and even for me using single Ports the monitor just always shows the balancer as unknown status :(, tried numerous guides and set ups and none of them work for me on my 2.1 box so i just gave up on it.

First thanks for all replies. The strange thing is that this setup is working (apart https). I have luck that my private lan has another subnet than 192.168.1.0/24 (I never use that!). Here is an (censord) extract of netstat -r: default          z.y.x.5.cust UGS        em1 z.y.x.5.cust link#3            UHS        lo0 5.x.y.z/32  link#3            U          em1 As you can see default gateway is the same address of pfsense… but it works! And, I can reach also 192.168.1.1., probably thanks to default route. Now I will try to configure modem as bridge or static ip, anyway I would like to understand this thing. It is a dlink dsl320-b

Hmm, not quite sure what to suggest here. A directional antenna perhaps? An external access point would almost certainly be easier. I'm tempted to suggest a tinfoil hat.  :P Steve

That's definitely what I'm going end up doing. What about the P2P and website filtering? How would I achieve that?

I guess I don't really understand the "filesystem/mounted on:" that is displayed when issuing df. "Filesystem" is the actual device that contains some dirs and files - an actual partition on a disk (these days "disk" means spinning disk, CF card, SD card, SSD or even memory-resident virtual-disk). That is physical space that can (and does) fill up. "Mounted on" is the place in the logical dir tree that the physical "disk" appears - e.g. partition "/dev/ad6s1" files are found in "/var/squid"

Here are my hmailserver settings and my results using mxtoolbox to connect to my mail server. [image: hmailserver-MyComputer.jpg] [image: hmailserver-MyComputer.jpg_thumb] [image: hmailserver_internet.jpg] [image: hmailserver_internet.jpg_thumb] [image: IP_Range_SMTP.jpg] [image: IP_Range_SMTP.jpg_thumb] [image: mxtoolbox-mail-test.jpg] [image: mxtoolbox-mail-test.jpg_thumb]

You may find the 'pftop' console command helpful.  Like the normal 'top', it's interactive by default., but it can be scripted as well.  There's a man page here: http://www.eee.metu.edu.tr/~canacar/pftop/pftop.8.html, though I'm not sure the pfSense pftop is in sync with the one described there.  The help text from pftop in a recent 2.2 snapshot:   pfTop Help       c  - toggle state Cache            f  - set state Filter       h  - Help (this page)              n  - set Number of lines       o  - next sort Order              p  - Pause display       r  - Reverse sort order            s  - Set update interval       v  - next View                    q  - Quit     0-8 - select view directly     SPC - update immediately     ^L  - refresh display     ^G  - clear command entry line     cursor keys - scroll display   Sorting shortcuts:       A  - Age            B  - Bytes          D  - Dest. port       E  - Expiry        F  - From          N  - None       P  - Packets        S  - Src. port      T  - To       R  - Rate          K  - peaK

WAN is everything going via WAN, so if the VPNs use WAN, then yes, the WAN graph would include the VPN's external/transport traffic.