@imthenachoman said in hide false positive blocked/rejected firewall entries: My FW rules are very prescriptive. My last FW rule rejects everything that a previous rule doesn't allow. I was talking about your WAN rules, your screenshot is the LAN or one of the LAN interfaces isn't it as you're doing DNS redirects to the firewall. If you really want to understand whats hitting the firewall send the logs to a syslog server, then look at the data, I send mine to my Synology NAS and can export out if needed to Excel.

@tabmow It's really easy to use, which is why i opted to use it myself, i also don't need another VM or Docker container running when the PfSense box can do this along with the LE certs Do keep in mind HA only works at TCP level, so if you wanted to proxy anything non HTTPS, you might have issues

@stephenw10 Although not ideal, after getting login credentials to the ISP provided router, I moved everything behind their device (which is a calix gigacenter 844e-1 which is actually not a bad device) and speeds are running normal with no weird latency when upload was seemingly capped. Their device provides the option to place my pfsense box in a DMZ, so this allows me to open ports (ie 443) and route things like I need to. I really wanted to figure out why it was acting the way it was directly connecting the the ONT box, but I'll roll with this for now as it seems there is something upstream that is hampering devices that aren't isp devices. Thanks for the information from both of you guys.

As always is the case, I resolved this minutes after posting. It's quite an obscure setting but I needed to also enable Security --> Forged Transmits in the vSwitch. https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-7DC6486F-5400-44DF-8A62-6273798A2F80.html

@johnpoz Nope, but I will check those out to see if they could be of help in the future. TYVM for the reply. Happy new year!

Glad to point you in the right direction. :-) -Rico

@chpalmer Thanks for the quick check! I don't have enough hardware to spin up 2.5 yet, but this may prompt me to throw something together.

Hello Miguel, Are you still sharing your configs? I would be very happy if you could share them so I can properly configure my MEO network with pfSense. Thank you

I'm reminded here of the famous saying (often found in project management): "Good, Fast, or Cheap? Pick any two". In this case we are all getting something good and cheap (free), ergo it won't necessarily be _________. That being said, I'm looking forward with anticipation to 2.5 as well...when it's ready.

If it was managed you might have some logged error to go on. Also managed switches tend to be better made and more resilient. Mostly! If a new replacement failed in exactly the same way though I would start suspecting something in environment. Not necessarily a network problem, maybe a power issue? You swapped the PSU at the same time I assume? If you move one of those 'bad' switches to somewhere else and test it does it still fail? Steve

Thanks for the hint. I didn't realize the traffic wouldn't pass the WAN interface. I'd forgotten that pfsense sort of acts like a router between interfaces by default. I blocked traffic between LAN & VLAN DMZ except for SMTP on the web server and set up a record in my hosts file so email could then be addressed to the mail host directly.

@rulrich Best overall advice is probably to move the pfSense-webinterface to a different port than the default :80 (disable webconfig redirect) / :443 (configure a different port). That way even if haproxy stops for some reason people wont 'by mistake' connect to the webgui.. Other than that check for nat portforward rules perhaps that might take these specific requests?

Tx for replying Steven,.. I have a combined FE/BE.. on a 192.168.3.x network,... and I am trying to connect in from a 192.168.6.x network client,.. I'm currently working on an apache2 issue, (which I believe maybe the issue) with sites available/enabled,... but I will need to do some digging before I get to a solution for my system I will update as I find more out...

OK, you should move to HAProxy. Relayd is deprecated in 2.5, you will not be able to upgrade if you still require it. Relayd uses pf to do the forwarding and since that is multi-threaded in pfSense I would expect the load-balancer to be also. Steve

In case someone has some time to burn: Bonjour overview: https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/NetServices/Introduction.html#//apple_ref/doc/uid/TP40002445-SW1

Ok then, yes, you would need a modem of some sort (or put the hub in bridge mode if it can). Something like one of the Openreach modems or a Vigor V130 for FTTC. Steve

@stephenw10 Ok so when you are not using the ISPs router you're using some other PoE injector to power the wireless hardware? Are you sure that is powerful enough? They gave me the POE power supply so unless its faulty then yes. The first thing shown in that log is the daemon starting the connection but it looks to have started before the previous connection had stopped. No timeouts or errors shown before that, something must have triggered that. Yeah I copied the log from the last time it had dropped out till the current time, but it all looked ok to me but I'm no expert in finding errors in logs. If the wireless device at the dish end is rebooting for some reason you would expect it to lose Ethernet link which pfSense would log in the main system log. You do not see that? I'll have a look through them then and see if anything sticks out. thanks

Still 'when it's ready' You can follow the open issues here though: https://redmine.pfsense.org/projects/pfsense/issues?query_id=106 Steve

@stephenw10 Thank you for the response. Setting the WAN as the default gateway seemed to have helped, it was set to auto. I'll continue to test.

Thanks all! I'll check and then I'll report back.