Squid can be used as a reverse proxy but was not designed for it. you can try: varnish (realy fast but no so easy to configure. balance http) haproxy (recently updated to latest version. balance http and https) pfsenses built in load balancer(easy to configure and balance http and https) Sorry for not answering how reverse squid works, I really prefer one of above options.  :)

They are on the list: http://www.freebsd.org/releases/8.1R/hardware.html#ETHERNET Steve

@wallabybob: @tomdlgns: if i am off site and i am using logmein to connect to my home PC and i am navigating through the webgui on pfsense and it is slow. I'm not clear about the configuration here. You have a pfSense at home and you access your home PC from the internet through pfSense and then from the home PC access the pfSense web GUI? A diagram would probably help. sorry. i configured pfsense on a spare PC at home.  192.168.1.1.  locally, when i was making changes to pfsense (over the weekend when i was at home) i had no problems.  everything was fast and smooth. today i am at work and i wanted to test some settings/play around with it.  i dont have any ports/firewall rules open so what i did was remote connect into my home PC and navigated to 192.168.1.1 as if i were sitting at my desk. i hope that clears it up a bit.  if not, let me know. thanks.

That is FreeBSD's escape-to-debug keystroke (ctrl-alt-esc) I'm not sure if there is a way to disable that keypress. Though it does look like NMI would also go into the debugger, and that can be controlled via system tunables that you can disable under System > Advanced, on the Tunables tab. machdep.panic_on_nmi: 1 machdep.kdb_on_nmi: 1

I'm using pfSense 2.0.1 in a similar setup with public IPs - pfSense also has internet access. Have you set the DNS servers (System->General Setup) properly?

thanks steve  ;)

Since you are met with the pfSense login page you might try using NAT reflection instead of local DNS overide. You have nothing to loose. Also try running a traceroute to your server under various conditions. Speculation: When you run the VPN client it connects to your work VPN server and is handed IP details including gateway and remote DNS servers. That becomes the default route on your laptop. You can still connect to your local subnet since that is in the local routing table. When you then try to access your server (on RED) by URL the remote DNS servers hand back the WAN IP of your pfSense box. Here's the part I don't fully understand, your laptop then tries to access the WAN IP but it somehow already has a route to it via your local LAN. Trying to access the WAN IP fro the LAN side of pfSense brings up the login. NAT reflection should take care of that for you. Why it doesn't get routed out through the VPN I'm not really sure. Perhaps it does and the resulting strange circular route is what is causing the problem. Traceroute should show that. Steve

I would like some more specific information before commenting (or not commenting). @psilikon: Our setup requires us to have 6 Asterisk boxes that we have exposed to the internet in public IP space and simply rely on the SuSE firewall to handle firewalling which works out well. How are these servers exposed to the Internet in public IP space? (e.g. each has its own public IP address, they are all in the same subnet? …) You are proposing to replace the SuSE firewall by pfSense? What else will be governed by the pfSense  box (e.g. internal web server and SMTP accessible from public internet?) What kind of firewalling are you proposing to perform (e.g. keep everything except the SIP traffic? block access between the Asterix servers? ...) @psilikon: I would also like to see if I can have the best of both worlds by also passing the traffic through the pfSense box so I can take advantage of the the huge feature set that is pfSense. What features of pfSense do think you would like to take advantage of and for what purpose? @psilikon: We use multiple carriers for the SIP traffic and I am concerned about how introducing a NAT nightmare. What sort of "NAT nightmare"? I have never met a "NAT nightmare" and am finding it difficult to imagine what that might be like  :) How do the multiple SIP carriers relate to the 6 Asterix servers? (e.g. 1 carrier to each server? all carriers to each server?) @psilikon: Can I use Virtual IP addressing and accomplish what I need? I don't know enough about what you need!

Create a rule on lan with source any, destinaniton any or nod32 update server port 2221

captive portal and it is build in feature

@waiyan.pickme: Is anyone know the 'FreeBSD Radius Server' or 'OpenBSD Radius Server' for use with pfSense … I love to know if that RADIUS server is easy to install and use like pfSense and M0n0wall .... PLEASE .. !! there are two packages available for pfsense: freeradius and freeradius2. You can install them from pfsense Package Manager. These packages are in general not too hard to configure but it depends on what you want to realize. Take a look at this thread: http://forum.pfsense.org/index.php/topic,43675.0.html Try this package and report back what is working and what is NOT working. This will help to develope this package.

Thank you. This helps a great deal. Sincerely, Brendhan

you might try changing the upstream NTP server(s) to one(s) specifically closer to you in the ntp.org pool. They have lists for people all over the world, finding one closer to you may improve its accuracy and ability to stay in sync.

Depends on what you're using. May be critical, may be irrelevant. Read the changes. http://blog.pfsense.org/?p=633

no there are no limits. But if you chose the ICMP monitor type and the servers don't respond to ping, it would show down. That's why I said it depends on the type of monitor you selected when adding servers to the pool. You might also make sure you're on 2.0.1, there were many fixes made to relayd (the Load Balancer daemon we use) after 2.0

no no, you got me wrong(, i admit i explained poorly) If you login with admin account menu should appear, but if you login with myaccount which has admiin rights you should not see the menu.

Thanks for letting me know. I was coming to this conclusion and saw the bug opened to version 2.1 for extracting user information. Keep up the great work!