We can't speculate as to what you were doing then -- only you or other admins on that firewall would know. A guess would be that you've used an accented or other international character in a client-specific override description or common name.

Many thanks for your continued help on this, much appreciated and glad we got to the bottom of it! It's been running fine for the last few days, which is great news! They're both running the latest firmware, but, I'm going to provide the feedback to the manufacturer to get their feedback as to why it's happening in the first place. Many thanks once again!

a self signed cert on a imap 143 port ? imap 143 is the 'clear text' version. If you want to use TLS for IMAP you would be suing 993. pop and TLS : 995 Mail clients that send mail should use 587 (TLS possible but now needed) or even better : 465. Port 25 : should be used only for inter mail server communication. This port was never intend to be used by mail clients. It's so wrong to do so. Very soon, ports like 80, 110,143 (21) etc will be out of business for good. Remember : you have a web site on port 80 ? Google won't index you any more. Btw : Modern 'fat' mail clients like Outlook don't even accept self signed certs any more. Maybe, if you imported the CA ans stamped it as 'trusted' you might get away with it.

@johnpoz I have an Asus RT-AC88U as my non-Guest WiFi AP - 1G link to the backbone. Next year I am going to go to an AX router in AP mode for non-Guest. My Synology NAS is on a 2x1G LAGG. And my two older NetGear NAS boxes (for backup) are on 1G links. Cheers! Phizix

@stephenw10 They are Juniper ex2200 24 port GbE switches. They are all rack mounted within the same network closet. They are not stacked as of yet. Juniper uses Virtual Chassis to stack switches, but that has not been configured yet. I am also working on that in tandem with this.

So the problem was I thought you were not natting.. Which prob has something to do with manual nats and all your vpn interfaces...

Provide a network map of your setup and give more details about the pfSense interface settings and rule.

thanks ... ! brNP

That’s what I was thinking. Thanks so much for your answer, Steve!

@Gertjan Thank you! I'll use that for testing the LAN issues. Much appreciated!

The irg entries in top are the queues on the network cards as the OS services them to route traffic. That is also where the actual pf load is shown so that is completely expected. Yeah with several gateway entries I imagine the system selected bogus default route. I'd be confident that was the cause here. The only other thing, potentially, that might behave like that would be Suricata in in-line mode if you were running that on the WAN only. Steve

Have you tried an actual speed test on a local machine? http://myspeed.etisalat.ae/ See if you get better results. I would also ask if your graphs are set for "bits" or "bytes"?

So it ended up being Chrome. I can access it on Edge and IE, which is odd. Cookies and Cache did not resolve it so i guess there is something else going on with Chrome but I can access it now, which is what I needed, thanks!

Thanks for your reply. We didn't remove the VLAN, this lagg0.888 is still in use. Any hints on what these errors are and how can they be resolved or suppressed?

@OpenWifi Intel i340-T4, i350-T4 or their OEM labeled variants. Here's a couple good articles on cards (and counterfeits). https://forums.servethehome.com/index.php?threads/list-of-nics-and-their-equivalent-oem-parts.20974/ https://forums.servethehome.com/index.php?threads/comparison-intel-i350-t4-genuine-vs-fake.6917/ Great info on that site.

@OpenWifi Then you need a rack mount UPS to go into that cabinet. The device you linked to appears to be something you'd build into some equipment, not rack mount. Also, what about redundancy? Since you're providing service to paying customers, you shouldn't rely on a single point of failure. As I mentioned, when I planned power cabinets, there were always 2 rectifiers, usually with AC feeds from separate breakers.

@stephenw10 Hi Steve, Thank you, it worked with reassigning interfaces and a reboot after. Just reassigning interfaces made pfsense start assigning VPN IP on the LAN :( this is what I tried before. After the reboot it made pfsense get back to normal. Thank you and have a great Easter. Guilherme