Ok, so I assume A to B is local traffic, not via VPN? And B to C is also not via the VPN? What speeds to you see from C to A compared with B to C? Is it the same A to C or C to B. I would try testing directly between the pfSense firewalls using iperf3 on each both inside and outside the VPN to see if you can pin down the throttle point. pkg install iperf3 rehash Steve

@Stewart said in Broken unit won't fully boot: pkg-static: Warning: Major OS version upgrade detected That implies it is either running 2.3.X and has pulled in 2.4.X packages or is set the dev channel and is trying to pull in 2.5.X packages. You can probably recover it by doing this: https://docs.netgate.com/pfsense/en/latest/install/upgrade-troubleshooting.html#upgrade-not-offered-library-errors But it will be quicker, and cleaner, to just reinstall at this point. The Suricata package had a bug in it at one point that meant log rotation was not working correctly. You had to go to the log management tab and save the default settings there to activate it. I imagine that's what you hit there. Steve

You haven't added the address range or server address to the PPPoE server config. I'm not sure I've ever tried running it on a numbered interface, certainly not WAN. You might need firewall rules to allow the traffic in. Though I don't see any required on my test box here to allow the PPPoE traffic you will need them on the PPPoE server interface to allow traffic inside the connections. Steve

Alright. We can do this :) On for example Forefront TMG you would have created a rule saying that anything going to external is allowed and drop the rest. PFSense however doesn't have an external object so instead we will need two rules per network instead instead First we need a Block rule that stops the unwanted traffic. Second we need an allow any rule that allows anything we haven't already blocked. In your case you need a block rule as rule nr2 on LAN: Source Any Destination 192.0.0.129/25 You will need a Block rule on OPT1 to (before the allow any-any rule) Source Any Destination 192.0.0.1/25

Okay I ran out of ideas so I grabbed a backup of the config file from before I installed HAProxy and ACME and restored it. Access is again granted to port 443. I will have to assume it was HAProxy but I only had set it up for port 80 and it was working. I was starting to work on 443 but everything for those backends and frontend was disabled. Also I completely disabled HAProxy and no difference. Oh well. I will just start again with ACME and HAProxy and see what happens

Can you add some network addresses and ranges to your diagram? For example - 192.168.0.1/24 or something similar? Jeff

Hi @PiBa After a good night sleep, and some coffee, I discovered a domain override for https://www.yourdomain.tld/ in my DNS resolver. False alarm. Thank you for your time.

@KOM In accordance to Aristotle - the first sign of real knowledge is ability to explain shortly the matter and teaching this matter. I wish you big money in your free time ... The information that I've got from @stephenw10 - all that I've been asking. For now all is working.

@Ozzmosis said in pfSense Crash: can not find the problem. Cut the problem in pieces. Like : remove the VM from the equitation.

@skullnobrains said in apply changes with pfSsh: how can i apply my changes without relying on rc.reload_all ? By "reading", rc.reload_all, see what it does, under what conditions, and do it yourself what rc.reload_all does. There is no documentation that states what a file or functions does.

ok thanks, now it is clear...

Just remove the spaces, so: !(wan|lan) Or (opt1|opt2) if those are the interfaces you want to see hits on. Steve

If you do not have a policy against it, then how do you think its ok to block him or throttle it? Step 1.. Create you use policy!

I haven't tried across subnets yet, I'll have a look at that next time it dies. Thanks again for everyones help so far.

@superweasel said in [SOLVED] What would trigger this info popup?: Thought I might have been hacked. Me too

@JKnott I left memtest running a few days after I moved pfSense to APU, it found no problems (and didn't lock up). The old board had ECC RAM, too, and there were no errors logged in IPMI.

Setting it via ifconfig ix3 wol (FreeBSD) would only matter if pfSense was putting the device to sleep or a low-power state, which isn't going to happen. If the device is powered off, that's entirely between the BIOS and the NIC, nothing to do with the OS.

having a prod and a test/dev FW can be good.

@pr3dict Thanks to meckhert on the unifi forum I've now managed to solve my hdhr problem by installing socat on a raspberry-pi that I already had on my private LAN. On the raspberry-pi I created and enabled a simple systemd service for socat so that it auto starts using the command meckhert listed. 192.168.100.17 is the IP of my hdhr on my IoT network. socathdhr.service: [Unit] Description=socat hdhr After=network.target [Service] Type=simple User=root ExecStart= /usr/bin/socat -d -d -v udp4-recvfrom:65001,broadcast,fork udp4-sendto:192.168.100.17:65001 Restart=on-failure RestartSec=10 [Install] WantedBy=multi-user.target I hope this helps.

@EricHamby said in Pre install Question: @akuma1x You take one of the lan ports, share the connection so it send the signal to the switch. I still don't know what that means - share the connection. In my attached example picture, this pfsense box only has 2 ports - WAN and LAN. You would plug the WAN port into an available port on your modem, and the LAN port goes to your switch.They are 2 separate ports, going to 2 separate devices. Jeff [image: 1555349802491-sg-2220.png]