Just an update on this, I have only just got round to re-doing the network, and it works perfectly :) With the same network diagram shown here; [image: index.php?action=dlattach;topic=72925.0;attach=41289]

Dear Jimp, many thanks for your hint. Erasing all logs did the job, so this one is currently solved. To further avoid a log stall, do you know of a method to do so? In particular, would a syslog server like syslog-ng do the job? I will have post another question on the release depends here: https://forum.pfsense.org/index.php?topic=74897.0

Double check your rules.  It might not be an encapsulation problem as so much as a rules issue.  I have just setup a Cisco to PFSense GRE tunnel and was having trouble.  I searched the forums, found your post and started thinking I was having the same issue.  But when I looked at my interface status, I saw that I had packets coming into the GRE interface but they were getting blocked.  I put an "any any" rule on the opt interface that I associated to the GRE interface and the tunnel came up to my Cisco 7206 router.  It turns out GRE needs to be allowed not only through the WAN but also the OPT interface you assign to the GRE interface.  I see this posting is several months old so if you still need any help post back and I'd be happy to assist.

Hi, Have you tried contacting their support about this? The phone number is 877-880-0055. I am sure they can help get your service restored. Thanks, Vinny

I just disabled it.  That works for me.  Thanks.

You can set it but it appears to get ignored and the pppoe1 interface always gets set as 1492. Last I heard jumbo frame support didn't get added to the FreeBSD version of PPPd (2.4.6) until January this year.  But I'm unaware if the latest update (pfsense 2.1.1) includes this newer version. I know if I manually ifconfig pppoe1 mtu1508 packets still get fragmented,  which is a shame.

@casoah: You realize I can just toss the setup away at any time right? Yes, so do it… yesterday was too late. @casoah: EDIT: I got it, I just had to disable ip masquerading on openwrt. You guys could have mentioned that instead of bashing btw You have been told at least twice that you are double-NATing.

If your trying to access your public IP from the local network you want to enable the nat-proxy in advanced settings. IF your having trouble even pinging your public IP I suspect you are suffering from double-nat ( is your modem a router as well? )

I can help you brother send me a message. @PostalPreacher: If I were to leave my webserver on the same lan as the rest of my network (workstations and webserver would all be on the .49 public address), would I still be able to do NAT reflection with pfSense?

You have 4 different WAN gateways? That is do say, you have 4 WAN subnets, right? So add your subnets to WAN interface in Firewall > Virtual IPs. Than add the 4 gateways in System > Routing. After that you can go to Firewall > NAT > Outbound, mark "Manual Outbound NAT rule generetion" and click the save button. Configure the outbound NAT rules for each of your servers to use the gateway you want it to use. Now it's should be done.

Lets not forget that there is no scanner on the planet that detects all bad files. I have to wonder how your "server" would get infected to be honest - other than some worm running on your network.  Why would you be browsing or executing anything other than trusted exe on a "server" in the first place?

It's not possible currently, CARP does not support an active-active configuration at this time for load sharing.

The anti-lockout rule is there to make it more difficult to lock yourself out especially if you're not very familiar with the firewall. You can still tighten up the LAN rules though. You can still lock yourself out.  ;) Steve

thanks bro, its has been solved :)

nanobsd is the way to go

Thanks, I submitted a bug report for this issue.