I use VLANs to segregate my WiFi traffic and VPN; I have a VLAN for my private WiFi, a VLAN for my guest WiFi, a VLAN for my VPN, and my wired LAN is untagged. All of it plugs into a cheapo unmanaged D-Link gigabit switch, which passes it just fine. All of this goes out over my LAN port (assigned as such). The APs are VLAN-aware (and tag and filter the appropriate packets) and of course pfSense is VLAN-aware on the other end. Sure I might be able to do some magic configuration on one of my wired ethernet systems to be able to touch VLAN-tagged traffic, but given that there are only ethernet ports in the office and bedrooms, if a bad actor has access to my wired LAN, I have bigger problems than them picking up stuff off the VLANs. In the meantime, any communication between those three segments (Guest WiFi, Private WiFi, LAN) is at the pleasure of my firewall rules -- which is to say guest WiFi can't see while the others are, by and large, unfettered (though there are some restrictions on VPN).

Yeah what confused me the most is that router->internet was testing at 750mbps+ with speedtest-cli, and desktop to router (through the same switch I'm normally connected through) was testing at 400+mbps (when downloading a dummy 1GB zip file I put in the web dir on the router... and it probably could have ramped up faster if it hadn't yanked the entire file in ~20 seconds). That's what got me looking at the router configuration itself, because obviously the router->internet connection was fine, and the PC->router connection was fine -- so it had to be something on the router itself that was bottlenecking things.

From your other thread I'm going to assume this was because you have not enabled SSH...

it's probably active or a static lease, check and eventualy remove the static lease under "DHCP Static Mappings for this Interface" (Services -> DHCP server)

Thanks. I get it now. Don't specify the static ip on the pc. Set it to use DHCP and then in pfsense, make it a static ip on the DHCP leases page. Works great! Thank you.

@johnpoz i think this is the best way.. tq sir

@Manguu said in pfSense + Catalyst 3750G: Now I need to figure out how to NAT on pfSense all my vlans behind the 3750G If your using auto outbound nat, it will auto do it for you once you create the gateway and the routes to the downstream router (your 3750).. All you will have to do is make sure the rules on your transit interface (the interface that gets to the 3750) allows the downstream networks in its rules.

You can see the mbuf usage on the dashboard in the sys info widget or from the command line: [2.5.0-DEVELOPMENT][root@apu.stevew.lan]/root: netstat -m 4983/1092/6075 mbufs in use (current/cache/total) 4501/565/5066/1000000 mbuf clusters in use (current/cache/total/max) 4501/559 mbuf+clusters out of packet secondary zone in use (current/cache) 0/6/6/524288 4k (page size) jumbo clusters in use (current/cache/total/max) 0/0/0/524288 9k jumbo clusters in use (current/cache/total/max) 0/0/0/20840 16k jumbo clusters in use (current/cache/total/max) 10247K/1427K/11674K bytes allocated to network (current/cache/total) 0/0/0 requests for mbufs denied (mbufs/clusters/mbuf+clusters) 0/0/0 requests for mbufs delayed (mbufs/clusters/mbuf+clusters) 0/0/0 requests for jumbo clusters delayed (4k/9k/16k) 0/0/0 requests for jumbo clusters denied (4k/9k/16k) 0 sendfile syscalls 0 sendfile syscalls completed without I/O request 0 requests for I/O initiated by sendfile 0 pages read by sendfile as part of a request 0 pages were valid at time of a sendfile request 0 pages were valid and substituted to bogus page 0 pages were requested for read ahead by applications 0 pages were read ahead by sendfile 0 times sendfile encountered an already busy page 0 requests for sfbufs denied 0 requests for sfbufs delayed You can also check the mbuf usage history in Status > Monitoring. Steve

https://redmine.pfsense.org/issues/8987 https://redmine.pfsense.org/issues/9677

Why would you not just use the fqdn for your time machine? What needs to talk to the sonos devices - just put them on the same L2.

@xenicle said in Can't access machine connected on my isp router from pfsense LAN: from it I can ping the WAN network IP 192.168.1.1 Do you mean the LAN IP there? Because then you said the WAN subnet is 192.168.2.0/24. I would not expect a client in the WAN subnet to be able to ping a client in the LAN subnet unless you have added firewall rules to allow it and a static route to the WAN side client. Without that it will just send traffic to it's gateway rather than via pfSense. Steve

Confirmed. https://redmine.pfsense.org/issues/9807

Yeah, you might consider using gateway groups there instead so that if you do get a failure clients using that gateway failover to another one. Steve

@stephenw10 Gmail limit is something around 500 emails a day. I was using single email accounts for all my sites. Service Watchdog was also monitoring dpinger for sites having multiple WAN. Due to heavy rains WAN connections were quite unstable. So it generated lot of mails. Anyway the real issue is neither Service Watchdog nor FreeRadius, the problem seems to be created by squid (as pointed by @stephenw10 in previous thread) . I am using transparent https filtering. Read about it https://forum.netgate.com/topic/112247/squid-use-all-memory-ram/43 https://forum.netgate.com/topic/136907/problem-with-squid-https-ssl-interception-consuming-all-memory/8 When I manually restart squid it stablises. As a workround, I am planing to use php script provided by @remzej , till something better comes up. Regards, Ashima

A lot of ISPs do that. Usually the modem locks to one MAC address and resetting it will allow a new MAC to be used. Some ISPs log that upstream though and you have to call and get it reset. Check the dhcp and system logs when that is happening. Something will be logged there. Steve

Erm no, that won't do a time limit. That's just time based rules. You need to use Captive Portal and radius accounting to achieve this sort of setup. Steve

10$ dif for 200 vs gig - yeah that is a no brainer.. What I would go for gig as well at that sort of price point and difference.. What I really want is the up.. But if I went gig from my 500/50 it only goes to 1000/100 - and its like 20+ more a month.. And I really can not justify the download side.. I have no real use for it, and the up is only for my friends and family to share my plex.. And 50 is handling the current load without any issues. But if I could get 1000/1000 I would jump on it for sure if only 20 more, for 10 = no brianer.. So if your going to do gig/gig - 1100 prob bit under powered.. 3100 would be what you would want. Just ordered 4th 3100 for work ;) pretty happy.. Just wish they would let me use them for some other devices with more umph... Its been a slow process.. But out of the blue my team lead said today - hey order another one of those firewalls ;)

Can you test in a 2.5 snapshot? Or against a more recent FreeBSD directly? Steve