The SG-1000 will not push 80Mbps of encrypted traffic unfortunately. Not yet at least, it does have hardware crypto for which a driver has not yet been developed. No figures for that yet though. You would be looking at the SG-2220 to do that on our hardware. Thanks, Steve

To reach PC2 pfSense will need to have a static route to 10.2.0.0/16 via the other router. Unless that is it's default route. The inverse is also true. The other router will need a route to 10.1.0.0/16 via pfSense unless that is it's default. Obviously you will need the right firewall rules in place to pass that traffic too. Check the firewall logs to see if anything is blocked. More information needed to diagnose further. Steve

your doing a downstream router.. Yeah there are a few things that have to happen.  And this downstream router is on a lan side port right. your not using it as your wan on pfsense? While I like your /30 transit.. Your other segments - why are you using /16?? There are quite a few threads that go over downstream routing with pfsense.  I should prob put something up on the wiki, seems to come up quite often as of late. Your going to need to create a gateway on pfsense pointing to this /30 IP of the downstream router.  And then a route for the network behind the downstream router.  Your then going to have to adjust the rules on your transit network to allow the downstream.  And your also going to need to alter your pfsense outbound nat rules if these downstream networks are going to use pfsense for internet access, etc.

Is there anywhere else to specify a "default gateway" for the internals of pfSense?

Last come back here but yeah it sounds like you can just hand external DNS servers to DMZ clients if they only need to resolve unfiltered external hosts. No need to bother with dual DNS on the firewall etc. Steve

If your WAN is not multi-100-megabit and the realtek is reliable, it's a good choice to use the realtek on WAN. If it gives you problems, move it to intel.

OK.  So, since I haven't ever renamed the "copy" when I'm in there, it just doesn't do anything with it?  I would have expected the "copy" button to generate a copy with "copy" or something appended, and then I'd have to edit that copy.  Thanks. EDIT:  Confirmed it.  The behavior is as you described.  Thanks, again.

That worked! I also had some issues with adding it back but i think i know how the link agg options work now! Thank you for your time and for saving mine!

Uh. There is no such "feature". WTH.

There's no other practical way because redirecting locally originating traffic isn't possible with PF, only static routes work. There is the setfib(1) system that can be used to assign an alternate routing table to a process but it's not exposed trough the pfSense GUI in any way. The gateway selection for the DNS forwarders (at the General Setup page) are using static routes, that just isn't spelled out for you. The reason static routes are a working solution for the DNS forwarders is that you'll never enter anything else but raw IP addresses as the DNS forwarders, each of the entered forwarders can be redirected individually by static routes. With NTP peers it's more complicated because the NTP service in a default setup will contact multiple peer candidates that you don't know in advance and can't be caught with static routes, you'll need a manual setup with raw IP addresses as the peers if you want to use static routes to redirect the traffic to a different gateway.

Ok, so please fix this in the next release.

Ha, I hear ya.  :) I confess I've done that in the past where a real switch would be much more appropriate. Good to know it can be done if needed even though mostly it shouldn't. Steve

@jimp: Packages and updates for Factory and CE use different sets of backend builders and repositories. Builds happen at different times and depending on how things happen, an update may not be synchronized from one side to the other until a later build run. It's usually very temporary when things are out of sync in that way. As always, Thanks Jim! It was just an anomaly that neither BBCan177 nor I could account for other than the Factory build.  I knew from history they eventually show up… BUT, we were trying to test something invoked by the PR and I needed the _8 release to test.  I tried to keep it out of gen pop but someone had other ideas.  I know better now. Rick

^ true if the client was running the vpn through the router to the pfsense as a road warrior sort of connection then no you wouldn't have the asymmetrical issues.  That is not how I understood what he was suggesting on doing. But then every client wanting to use the application would have to run vpn client.

I understand. It's pretty secure out the box, everything is denied on WAN, but you can add block rules or remove the default allow rule on LAN to tighten up outgoing traffic. Keep asking questions if you have them.  ;) Steve