I know this doesn't resolve the question itself but if you are downloading 2G files in Firefox, I would recommend installing the DownThemAll extension to assist you with it.  It does a great job of multi-threading, error recovery and will search for mirrors of commonly downloaded files.

The problem with your current design is double-NAT - never a good idea.  A second NIC in the ESXi host will save you from potential hassles related to that.  Well worth the investment. Unless you have told pfSense that the 172 network is its LAN, you probably just need some rules in pfSense to allow traffic in on that interface so they they can get access to the Internet.  Only LAN has an "allow any" rule by default.  All others are "deny all" by default. If you've told pfSense that 172 is the LAN, you're going to have to allow traffic through its WAN interface in order to access your VMs from the PCs in the 192 network.  You'll also have to allow traffic from private networks, specifically your 192 network, on its WAN interface. There are almost certainly other things you'll need to do as well but I can't think of them just now.

@cmb: though unless you're changing your config around a lot you won't see it much. I am running 2.0.1-RELEASE (i386) built on Mon Dec 12 17:53:52 EST 2011 FreeBSD 8.1-RELEASE-p6 my system has been up a bit under 11 hours and the system log is littered with these messages: [2.0.1-RELEASE][admin@pfsense.example.org]/root(15): clog /var/log/system.log | grep "Bump sched" | wc -l     326 [2.0.1-RELEASE][admin@pfsense.example.org]/root(16): About 30 times an hour seems excessive! Is there a sysctl that could be tweaked to significantly reduce the frequency?

Does anyone know if pfSense NTP passes the local timezone or does it pass UTC time? NTP only deals with UTC.  Hosts are responsible for adapting it to their own timezone/ You should never use a VM to set the time on a ESXi.   Either have ESXi sync the time on the VMs through VMware Tools or have ESXi and each of the VMs sync themselves to an external time source. The HP 1810G (J9449 at least) has a pretty crappy implementation of SNTP and so does the Netgear GS108T.   They poll the NTP server too frequently and eventually get a Kiss of Death.  Luckily, switches don't really provide much that's worth logging anyway.  If you're not logging, accurate timestamps are a bit pointless. EDIT:  You really should not use a Stratum 1 server as a reference unless you own it or it's part of pool.ntp.org

It depends how it's connected. I would expect it to be some sort of USB connected adapter in which case it would appear as /dev/da* Steve

@jimp: See the last line of my last post. I didn't know what gitsync meant  :-[ I did the gitsync that also fix the ntp server timeout … great tool  ;D Thanks for all

There are no build/compile tools in pfSense. To install all the required components is a complex task that will likely break something. If you want to compile something to use in pfSense do it on an appropriate FreeBSD install and move it across. See: http://doc.pfsense.org/index.php/Can_I_compile_software_on_pfSense Steve

Thanks Exolon

Thanks stive all are working fine thanks for your valuable suggestion

reachrishikh you can set up pfsense with help of youtube .search how to in youtube ,if trouble occurs post in forum

@jimp: entered things correctly, would be the user's name. I'm not that familiar with BSD/Linux codes  :'(. I've seen/downloaded samples but with not the use of PFSense i also need a detailed one. I'm still working with my examples yet i don't know how to apply it and that i might failed and crash the network. I also found that you can edit this from PFSense the question is how? /usr/local/etc/lightsquid/realname.cfg I used GUI on my laptop and the server/router is the PFSense. Would you mind setting an example i would really appreciate your help. And sorry for my english. Thanks

his new thread for those curious: http://forum.pfsense.org/index.php/topic,61616.msg332302.html#msg332302

well i have a problem with the same, i have bridged lan to wifi on pfsense and static mac id/ip pairs set with static arp and deny unknown client ticked, i use a tp link TL-WA850RE wifi range entender and wifi clients get the proper ip but with staic arp wifi clients r not able to surf at all untill i untick that, any solution to this

I think you're going to have to define those two concepts before anyone can comment on that in any detail. I don't imagine any firewall specific code is deliberately designed to be anything other than as secure as it can be. You could say that because Astaro is offering a wide range of services it offers a wider attack surface to potential hackers. Steve

@rakeshvijayan; i appreciate your reply but the "ouapapaladam" is asking about allowing the facebook for about 5mins. Assuming ouapapaladam has already blocked  it using squid either using a proxy mode or manual ip list in squid! In my case I am not able to block https with proxy .ouapapaladam did you check in your client side with https facebook . Hi  srk3461  you point a good knowledge to me also I will try it on my virtual machine for testing purpose thanks

Glad to see your reply. I can't understand your explain,but… I add my local domain in here,the dns is answered correct. Services -> DNS forwarder -> Domain overrides Thanks so much. YOU DONT NEED TO ADD ANY SETTING OVER THERE YOU HAVE TO INSERT THE CORRECT DNS ENTRY OVER THE GENERAL SET UP SELECT THE CORRECT GATE WAY FOR THE DNS . OR TRY TO INSERT GOOGLE DSN FOR CHECKING 8.8.8.8 AND SELECT GATE WAY YOU WISH ,THEN TRY TO PING TO GOOGLE FORM THE DIAGNOSITC TAB ,BY THAT YOU CAN REALIZE IF IT IS DNS PROBLEM OR NOT  .Services -> DNS forwarder -> PAGE YOU HAVE ONLY PUT A TICK MARK ON (ENABLE DNS FORWARDING TAB)