Thank you! Sounds to me like its more trouble than I want to go to, and more complex than I have time for to be honest. That was a nice definitive answer and I greatly appreciate it.

@verbal: That's why I'm confused about his setup– why make the rule a NOT command and specify an internal subnet when a rule allowing traffic to the WAN only makes more sense? The WAN on my pfSense is directly plugged into my cable modem, which receives a DHCP public IP from Comcast. Your WAN subnet is only a small portion of the public internet (check your current public IP address AND network mask). If you want to allow traffic to the internet you can't do so by allowing traffic to your WAN subnet only. Allowing traffic to NOT LAN subnet is a convenient way of allowing traffic traffic to ALL public IP addresses (AND lots of private IP addresses which you don't currently use). Last time I looked at pfSense firewall rules I don't recall seeing an option to specify "ALL public IP addresses" so you either have to make up an alias for "all public IP addresses" or adopt some cunning such as define an alias for private IP addresses and use "NOT private IP addresses" when you mean "public IP addresses". But that is probably a "more advanced" topic than is suitable for the current discussion.

You might consider to use state-of-the-art hardware instead of outdated stuff. Newer systems can be more energy-efficient. One thing is that a more energy-efficient system can often be run fanless. This not only reduces the noise level, but also increases reliability. Another thing is energy cost - at least for users who don't have an electricty flatrate. The break-even point for newer, mor expensive hardware with energy consumption is typically after two years, compared to "some old junk" which is few years old and you can get for free. I keep the "old junk" with it's noise fans around as backup systems, in case the shiny new modern systems fail. Another point of caution: I have experienced that many switches are unreliable. For example, I have several D-Link gigabit switches lying around which will occasionally just "hang" - network traffic doesn't get through any more and the switch has to be power-cycled. I have found that I can reproduce this phenomen simply by pushing 100MBit/s of traffic shrough the switch; it will "hang" after a few minutes. That sucks. What good is a 1000MBit switch which cannot cope with traffic of 10% link capacity? I currently use Cisco gigabit switches. They seem more reliable. Not "Linksys by Cisco"; I've experienced issues with some of these as well!

The industry standard for doing such things in an ISP-type scenario is Netflow. Several options there.

@mrwho: I was here thinking, can I forget the entire bridging thing and do the following: LAN: IP - 10.0.0.254 DHCP Pool - 10.10.0.1 to 10.10.0.254 WLAN: IP - 10.0.0.253 DHCP Pool - 10.0.10.1 to 10.0.10.254 No, the DHCP pool needs to be in the same subnet as the interface IP address. AND you can't have distinct interfaces in the same subnet. @mrwho: Also, if possible, what could be the drawbacks compared to bridging? If you have two interfaces bridged then broadcast traffic gets forwarded between the interfaces and that helps Windows systems "see" each other. If the interfaces are not bridged then broadcast traffic doesn't get forwarded between the interfaces and systems can generally still see each other with the right incantation but not as "transparently".

@webdawg: Could you not resize it with gparted? with tools along those lines it may be possible, I've never tried that with UFS file systems. May be faster to reinstall and restore.

Thanks, ya I'm going to just format and do a full re-install as I noticed after a factory reset there's still package folders and random things still there.

@Aaron: Now I'm trying to determine the most efficient way to pass traffic from my static IP to the firewall that's sitting behind the pfsense IDS. You mean you're using a pfsense box to run the Snort IDS and have another system (presumably also pfsense?) to do the packet filtering ? pfsense's main strengths are as a firewall / NAT gateway and VPN concentrator. And while I haven't yet found the time to test the Snort-pkg improvements by bmeeks, until recently pfsense's Snort-package wasn't "production-ready". If you need/want a single-purpose machine to run IDS, then I would suggest to simply run Snort on a dedicated (typically Linux) box. Btw putting the IDS on the WAN before the fw will pick up lot of "noise".

Did you setup the port that pfsense is connected to as a trunk port?

@azeemmasghar786: hello smith, when we use single WAn interface then traffic going and incoming perfectly but in multiwan condition request go to the server through one wan and come back through 2nd wan.mean ip change.when ip change then account logout. What email service are you trying to connect to?

I configured pfsense with dial on demand and idle timeout zero and it seems to be working.  The checkbox instructions are misleading. Web.

You should be able to use the "serial memstick" image to do a full install for a serial console machine if you want, just make sure to choose the embedded kernel when installing. Also if you really want it to stay RW at all times, on 2.1-BETA there is an option to keep the nanobsd disk RW under Diag > NanoBSD.

ah! that makes sense (pun intended)! thx! :)

I do have a Motorola cable modem, the 6121 I believe. I haven't seen any unusual activity on the ESXI machine, but maybe I can dig through the network logs some more. The problem has been intermittent..it went back to normal about a day after I posted this and has been working fine ever since.

Nope! The coretemp driver only reads values from the onboard diode in Intels 'core' series CPUs or newer. To read the fan speed you need to either read values being passed though ACPI or read the SuperIO chip directly. mbmon may or may not be able to do this for you. It's quite old now so it deppends on the design age of your superIO chip. Steve

@webdawg: @magdiel1975: @podilarius: Thought you were further along than that. You might want to disconnect the wireless for now. The DHCP server on it will not allow the one on pfsense to start and would cause problems. Nope still with the same problem..but I will try using a switch.. I think I have one laying around. I was just stuck on how to connect the modem and the router..so I think I now have an idea on how it needs to be connected.. The modem goes on the Ethernet adapter from the motherboard and the switch connects to the 2nd ethernet adapter I installed..then the wireless router connects to the switch..Am I on the right track? It is apparent that you do not know a lot about networking.  Some things you are doing are going to work but they are not supposed to be hooked up like this. Your internet comes in and it looks it comes into an ISP router box.  From this router box you need to connect the WAN interface of pfSense to it.  After that you need to connect the LAN interface of the pfSense computer to a switch.  This switch is where all your devices are going to be plugged into. You WAN interface will attain an IP automatically via DHCP.  Your LAN interface should be something like 192.168.44.1/24.  This means that your router will be at 192.168.44.1 with a subnet mask of 255.255.255.0 .  Your WAN interface should not be the same as the LAN interface.  You cannot have a network that is 192.168.1.1 and have another network that is 192.168.1.2.  The third digit has to be different. (Look up subnetting if you want to know more.) You want to make your LAN wireless?  You can connect the WAN of a router to the LAN of your network but the wireless clients will not be on the same network.  You really should have an ACCESS POINT or configure your routing device to be that.  You plug the access point into the switch. Well.. I wouldn't say it's apparent I do not know a lot about networking…It's pretty clear.. lol - But thank you for taking the time and explaining it the way you did on your last post.. I understand it better now, I think..haha.. I will try and get back as soon as get this going...thank you all for taking the time and for all your patience

It's not rogue, it's what sends your DNS server out via the correct WAN as defined in System>General Setup.

I've been using Pfsense 2.1 Beta1 for about 3 months now. I did a LOT of experimenting for the first 2 weeks. I must have done 7 or 8 clean installs with different package installs in each instance testing various configurations. When things went south they tend to stay south. I believe some of the problems is simply error handling not being at 100%. Maybe its Pfsense or could be the package or a combination of both. I guess if your a Unix Guru and Pfsense did spit out a valid log you would have a hint of where things went south. If no logical error was generated than theirs no way of finding the problem other than jumping into the code it self to hunt it down. My solution and the easiest in most cases, is to perform a fresh reinstall and try not to reproduce the error again if possible. I would not expect error handling to be at 100% as it is a very time consuming task and hey, its open source after all…....Great firewall, would love to contribute, but I have no knowledge of Unix.

You can try it here, but only for one VLAN http://forum.pfsense.org/index.php/topic,58331.0.html

Your network topology? Interfaces setting ?