It must not be the CF card then. It started doing this not very long after I built the system, so it's probably not write cycles anyway. I suppose it could be that some hardware was bad out of the box, but it was working fine at first, so I don't know. @cmb: if it were the CF you'd be seeing at least some errors in the logs, and usually a ton of them. Write errors, timeouts, something on adX or daX depending on what your CF device is.

Logging them to syslog is generally preferable. Even logs may not be telling at all though. First it's about general network troubleshooting abilities - what can you get to, what can't you get to, narrow down the problem as much as possible and troubleshoot from there. It could be any of a million things, many of which don't generate logs, from the description here.

I already spent a good 5 minutes searching and i couldn't find the answer, hence the thread.  Had the ISP waiting on teh phone so had to get a fast answer which i did thanks to mibovrd

The rules do not set a DSCP value, they only match a value that already exists in the packet. It would show up in a packet capture if the packets have already been tagged by whatever originated the traffic.

luke240778 - I am still a noob and dont't have your answers.  Since my last post, I restarted snort BUT with the "block offenders" checkbox unchecked.  This wreaked havoc on my system.  I am still reading docs on Snort and hope to be able to enable "block offenders" soon.  I have been running smoothly for 24hrs with Snort running. Sorry I couldn't help further. Brad

and ping is ICMP echo request, allowing only TCP will block pings.

Thank You jimp. My Bad. This makes sense now. Barry

A dissapointing result but hopefully save someone else some time.  ::) I'm sure it could be made to work but whether it would be worth the effort or not is debatable. It would probably be easier to just put an Intel gigabit card in the PCI slot with the case mods that requires. Steve

Hi, changed to a Huawei E1750 modem and pfSense configurations unchanged and now it seems to work like a charm even when the modem gets an update of the IP-adress. The pfSense modem support list says something about that the E173 sometimes does not have a E173 chip inside, maybe that's the problem in this case. Try changing to an different modem and the automatic reconnect may work. Maximilian

You may have to edit/save/apply a gateway under System > Routing.

ok changed to www.fark.com

@wallabybob: Perhaps Disabling pfSense option Allow intra-BSS communication will achieve something like AP isolation mode in DD-WRT (I know little about DD-WRT). Exactly, this is the same option. Steve

@shafqat1991: client got just 12 kbps or max 20 kbps Not sure if you mean bits or bytes here since you also said: @shafqat1991: and i got full speed like 800 to 900 plus kbps. 900kBps (kilo Bytes per second) would be approximately 8Mbps (mega bits per second). Anyway with that sort of difference the first thing I would look for is a duplex mismatch or cabling problem. If you have the Bullet connected directly to pfSense this could easily happen and 12kBps is exactly the sort of speed I would expect to see. Steve Edit: Reading this it appears as though autonegotiation of line speed and dulplex is not the default setting.

what was the solution to this coz same issue for me since a very long time now

As I said they are 'regular expressions' used in unix and other OS's. Many OS's use a subset of the main expressions. A Google search for them will reveal many examples. [image: regular-expressions-cheat-sheet.png] [image: regular-expressions-cheat-sheet.png_thumb]

My experience was MAC spoofing and VLAN tagging does not work together.  To work around my problem I set the spoofed MAC address that I wanted my cable modem to see from my WAN interface, inside the VM setup inside VMware and removed the spoofed MAC address from pfSense.  This way pfSense sees and uses my spoofed MAC at boot time as if it was a MAC address on a physical NIC.  My cable modem sees and locks to my spoofed MAC and all 3 WAN interfaces works correctly on separate VLAN's on the same physical interface. This setup has been working fine for a week now.  I finally have IP's on all three WAN interfaces with the cable modem locked to the MAC address I need it to use. Thanks to everyone for all your suggestions!

what exactly are you setting up? Every method you can use there is easy to get around, control at the switch level if it's a wired network is generally the best if not only way to prevent such things.