Thank you. I feel like an idiot!

If a critical service process (dhcp, dns, OpenVPNs…) exits abnormally (system problem like out of swap space, program problem like divide by zero) there is no controlling script that called it that then gets the error code, and can loop around to try and run the program again. These services are forked off into independent processes by the bootup scripts. There is nothing else built into the system that monitors AND restarts them automatically. Yes, there are dashboard displays, but they don't take automatic action. And in any case, what if nobody has a dashboard running. So JimP has kindly made Service Watchdog - in a perfect world it would not be needed, just like a real watchdog. OpenVPN: in my experience the OpenVPN code is very good at trying forever to connect and eventually connecting once the underlying physical links and internet is up and working. I expect that an OpenVPN client would only stop trying to establish a connection if the process has actually crashed, which I have only seen happen because of "killed: out of swap space".

@heavy1metal: I'd go with Kejianshi's idea. Though for social media sites, I'd block every purchased IP range they own, thus blocking both site and chatting features… Google's DNS names for messaging services: https://support.google.com/chat/answer/161980?hl=en restrict access to use only your DNS servers: https://doc.pfsense.org/index.php/Blocking_DNS_queries_to_external_resolvers Regarding the link to the "blocking DNS" entry on the wiki: This: http://www.interspective.net/2012/07/pfsense-ntp-and-network-sneakery.html Can be applied to DNS too. I enable this "feature" sometimes for my girlfriend for facebook when she has to study. The rule to block facbook would look something like this: address=/facebook.com/62.112.159.61 The relevant page in the wiki for this is: https://doc.pfsense.org/index.php/Wildcard_Records_in_DNS_Forwarder

Might also want to reference my original thread http://forum.pfsense.org/index.php/topic,66234.0.html since the backed out patch looks remarkably like the one that was proposed there and where I raised my concerns as to whether comparing the interface address against $vipent['subnet'] will work (I think it won't). If possible, the two threads should probably be merged.

Yes but like I say if you have the same ISP you may end up with the same gateway on each WAN which confuses the gateway monitoring daemon. If you have PPPoE on each WAN you can just change the address being monitored to some other remote IP. If your WANs are dhcp you'll need to take other steps. One possible solution in that case is to leave the modems as routers so that pfSense sees the modem as its gatway. May not be an issue for you. Steve

I know this method based on the gui. I want to do the same from the shell :     1. Restore config.xml.     2. Install automatically packages requiered. Thanks, Yannick

Indeed, everything looks good. Steve

Route changed and connecting fine now.

@kejianshi: Well - I'm either not smarter than you or I'm just hoarding my arcane wisdom.  You decide  :P :|

@Lord_Palethorn: But wouldn't squid help lower the http traffic? (youtube / ustream / steam / ..) so there will be more bandwidth available for gaming? It will to a certain extent but Squid can cause problems for online games that authenticate through http but not for the actual game traffic (Many F2P games do so and I've had it break Blizzard Battlenet as well). Furthermore, you will only save the bandwidth if the data set is repeatedly accessed.

I also see this - could be related as well?: Sep 16 19:38:54 apinger: rrdtool respawning too fast, waiting 300s. Sep 16 19:38:54 apinger: Error while feeding rrdtool: Broken pipe

That will be a WAN interface, effectively, with a private IP. Have you unchecked 'block private networks'? Steve

Ok. Thanks a lot.

Yesterday I decided to do a clean install of 2.1-RELEASE on the same machine and restore a current config with all same settings.  I then reinstalled all same packages with same settings and the issue appears to have gone away for the time being.  Yes, I am using Aliases on a limited basis.