Hello, Thank you for the reply. I had believe the iptables syntax was the correction solution the above mentioned problem but it seems not. This is an article describing the solution (it's further down): https://community.ubnt.com/t5/EdgeMAX/Removing-Netflix-geoblocking-on-Roku-3-firmware-6-1/td-p/1277865 I had replicated that configuration on my Edgerouter and I'm having no luck at all doing it on pfSense. Problem: Roku contacts Google's DNS (over Unblock-US or Unotelly's) It by-passes them and decides to use Google's DNS Now it won't allow me to view any of the US content, because Google DNS is hard coded into the Netflix application and the only way to make this work is by rejecting/redirecting all the Google DNS requests to Unblock-US or Unotelly I'd think.

Interesting… Well, I can assure you that the limit for regenerated certificates is not < 19.

It was effectively a problem with a config.xml. But in fact it wasn't an issue with the current config.xml but with an old one present in the directory /cf/config/backup. So I moved /cf/conf/backup to /cf/conf/backup.orig and then mkdir /cf/conf/backup and everything came back to the normal. It was really frustrating because even if you just wanna save the current setting, pfsense seems to read the back and if one is corrupt crash…. I hope it could help someone in the future ;) Renaud

Roger that. Thanks.

For hardware compatibility look here: https://www.freebsd.org/relnotes/CURRENT/hardware/support.html

Thanks friend. It helped me..

Don't recall ever seeing that on amd64… <-- your solution, perhaps :P

Probably well worthwhile to update to 2.2.5. In your case there may be a small "risk" in that you don't really know what "fixed" your issue, but the stability of 2.2.5 over older releases is worth it in my mind.

OK I found the answer to b)  is this ICMP traffic normal ? - Yes - its the default for monitoring and can be tweaked in the System / Routing / Edit Gateway section - and it works perfectly.

@Mjennings: I have "Register DHCP leases in the DNS Resolver" checked - why uncheck this? It's the entire reason I am using pfsense as my DNS server Because Unbound is retarded. Check Redmine and/or this: https://forum.pfsense.org/index.php?topic=89589.0

That is for pfSense itself. It is used e.g. when pfSense check for updates or for DNS lookups. You should leave this at WAN address, otherwise the backup gets no response, cause the CARP is used by master.

Depending on his bandwidth, if he has traffic shaping enabled, the 50 packet queue depth is too small and hurts bandwidth. Making a lot of guesses here with not many facts to work with.