Yes, you will need to create a bridge between both pfsense to simulate a local config scenario carp checks and sync transfers a lot of packages between firewalls, make some tests to see if this setup will not fill up your link between pfsenses. If you are using vmware, this post may be usefull http://forum.pfsense.org/index.php/topic,45093.0.html

The new speedtouch modem don't seem to be working that well with pfsense config. What you could try with the speedtouch en pfsense is the following. (not a very nice solution but probably works!) Example settings! 1. Make the speedtouch your WAN connection just as it would normally do. WAN has public / LAN is fixed 192.168.1.1 2. Add an exposed host in your speedtouch: 192.168.1.254 3. At the WAN of the pfsense enter a static IP 192.168.1.254 /24 with gateway 192.168.1.1 If the speedtouch has no exposed host search for NAT or DMZ and make sure all traffic is forwarded to 192.168.1.254 This way your pfsense should be able to handle all firewall settings but be aware that due to the NAT in the speedtouch not all incomming traffic to the pfsense will work without problems. I mean when entering a NAT rule in the pfsense.

Please link to the bug or explain the problem. IMO 2.0.1 is just as light weight as 1.2.3, maybe a little more, but still not that much. There are many others including myself that put scheduled rules in place. You just have to remember that you have to think of scheduled rules in kind of the opposite of what you would expect. Rule placement is just as important as the rule.

GNS3 - it will make your socks rock

@luke240778: Ok, so by embedded it is not like DD-WRT that can be embedded on alot of normal routers? No, image size and processor architecture are completely different from wifi routers to i386 machines.

never mind… found my answer... http://doc.pfsense.org/index.php/DMA_and_LBA_Errors

Did you check the windows system really was assigned an IP address by pfSense and didn't just acquire an autoconfig IP address? (You might have needed to release and renew the DHCP lease on the Windows system.) What is the ouput of the Windows shell command ipconfig /all and what is the output of the pfSense shell command ifconfig -a

Workgroups have no relation to your firewall. edit:  what johnpoz said.

No.

Packages can't be used at all. Other than that everything else should be equivalent. But if you're running from USB, use USB flash w/nanobsd version on it, and not a CD drive. Then GruensFroeschli's response applies and not mine.

Apart from the fact that what you want to do is completely illegal.. the answer is yes its possible. There may be other ways to do it (squid for example) but this is simple to do with a RADIUS server.

@bmatic586: great. i ordered from netgate. Netgate is an excellent place to get them. I just wish they would start carrying the new PC Engines enclosure. They have a nice custom one with side antenna mounts, but the new PCE one has front antenna mounts (it's wider), and you don't have to pull the board to swap the PC Card.

If you are using static IPs , you can create 2 Alias, 1 with your 8 heavy users, and the other with the 12 users. Then use "Policy Routing". http://doc.pfsense.org/index.php/What_is_policy_routing%3F http://doc.pfsense.org/index.php/Aliases http://doc.pfsense.org/index.php/Multi-WAN_2.0#Firewall_Rules

Yes this is all on alias form

Hi stephenw10 , thank you for your reply. I've understand and find (ty Google) how to change the monitor IP, in "Advanced" "Routing" ! Is it a way to have PfSense automatically trying to renew/release and so getting back the Gateway up automatically ? In fact I would like to have PfSense automatically do "renew/release" effect on the WAN Interface when my Monitor IP isn't accessible ! If somebody can help me … Thanks in advance, and thanks again stephenw10 ! Sincerely, Alex.

Go to Firewall-> Rules -> OPT1 tab Add a rule to: Allow Any Protocol Source subnet: OPT1 subnet Destination: Any

Excellent!  :) Steve

Not sure on the extracting bit but if you have Squid you should be able to at least block something with a few ACLs. There are various sites which details different ACLs on how to do this. The only problem is the handling of https in the current stable squid package. http://www.buttonclicker.com/2010/06/04/block-facebook-chat-using-squid-acl/ http://www.geekride.com/block-gmail-chat-gtalk-google-talk-squid-proxy/

One suggestion, but this would require some work, is to have some external process that monitors the usage of each user. When they reach their cap, this process should then send a disconnect to RADIUS which disconnects the user. But before it does the disconnect it should switch the users class(room in this example) and this class will have the relevant attributes required to shape the user to the require speed. So when the user reconnects the new speeds are sent to pfSense for shaping.