The short answer is yes, although, more specifically... on a fresh install, PFsense allows all outbound traffic sourced from the subnet assigned to the LAN interface by default. However, there's an implicit deny on all OPT interfaces until firewall rules are added.

Darkstat package might be better for you wanting to track something down that is happening now.. You can turn it on and off easy enough.

Thanks for the clarification and updating the target version. I thought I had included the issue number in the clip but missed it. I was not as focused on this particular issue, but more generally.

As @stephenw10 mentioned, using Reject internally is one good reason, but there are also other reasons someone might want explicit block/reject rules, such as: To fine-tune which blocked traffic gets logged / not logged In combination with policy routing rules and the "Skip rules when gateway is down" option so that policy routed traffic will fall through to specific block rules if a gateway is offline To make the ruleset easier to read for less experienced admins who are not familiar with the default block behavior

@stephenw10 Thank you very much for guiding me. Steve Best Regards. SMR

I've done this using a selfmade captive portal page, but thanks anyway for your hints.

That looks to be working fine, it pulls an IP and then renews it every hour. Was it not working at that point?

pfSense is also an enterprise-capable firewall. I don't think you'd want to bet your real business on a Linksys or Asus from Walmart. Looking at it this way, you are getting enterprise-level performance and security for your home net at no required expense except what it takes to learn to manage it. Of course, being open source, you can always get creative and roll your own: https://github.com/pfsense/

Hi, Sagardawa! I do not mean to bother you but the files you uploaded seem to be removed. I am now trying to settle my PPPoE server with a service name so that the clients would not connect to the undesired server. Could you kindly send the files again?

Right but it will be limited to "converting" the media on the other side, which 1Gbit fiber. Not the same thing. If you want the same thing, use a switch to "convert" from fiber to copper.

Glad it's working. Yep, plugging the AP it into the switch is the preferred deployment. However, the other way would have worked also. All you needed were firewall rules on the re0 interface allowing the traffic out and then a NAT entry on the PIA interface for the 192.168.2.0/24 subnet.

Finally tracked the issue down which was with the firewall state sync. This was setup on seperate interface and seperated from normal LAN traffic via 802.1Q VLAN on switches (the two routers were in different areas and weren't possible to run another cable through). No idea why this was causing such problems but disabled now and rather a brief connection interuption if it switches over.

if you have control over those devices: https://docs.netgate.com/pfsense/en/latest/cache-proxy/wpad-autoconfigure-for-squid.html#setting-up-wpad-autoconfigure-for-the-squid-package or you can start messing with fake ssl certificates todo this transparently ... but thats messy

@angdigi said in Remove LAN interface: Isn't this considered "flapping". Maybe it's something on the NIC that's causing the issue and not the ISP.... Flapping is generally a term for when a mac address moves rapidly between different ports on a switch / switches.

@danneh82 said in pfSense halving Virgin fibre connection speed: Swapped data ports (luckily ran extra drops!) and now getting full speed. The problem is probably at one of the connectors. Reterminating the cable should fix that or perhaps there's a bad connector. The cable itself rarely goes bad, unless physically damaged.

Yes, there's no way to do that directly. You can try using the Netflix ASN in pfBlocker to create an alias then use that in a policy routing rule. https://forum.netgate.com/post/848939 Steve

Another vote for replacing the USG with PFsense. I haven't seen anything in your diagrams that would warrant having two firewalls in your environment.

There's no other way I'm aware of I'm afraid. If you need to use source hash you need to use a subnet as the translation so you need to use a set of smaller translation rules. Steve