Good idea, that's very simple. Thanks!

I am pleased to report that I have discovered a solution. Thanks to everybody for eventually pushing me towards a solution! In the end, this issue was caused by a configuration in the physical network that VMware did not like and, in fact, all VMs were suffering from poor network performance. More specifically, the LAN side of the host system was running a teamed connection using 802.3ad protocol. This really served no purpose other than for my own vanity.The solution was simply to take apart this teamed link and run the gigabit ethernet ports individually while disabling all unnecessary adapters and services. I also followed as many recommendations as I could in the following document that my hardware allowed: http://www.vmware.com/pdf/ws7_performance.pdf Again, thanks to everybody that pitched in on this problem and pushed me in the right direction, it is greatly appreciated!

Depends on how your ISP handles that. It probably dynamically assigns the PPPoE address (your WAN address) and routes your static IPs there. So you just need to set them up as Other VIPs and configure your NAT accordingly as desired.

It's a screwy way to block a connection, but that device is without question blocking the connection, it has nothing to do with your firewall. Off-subnet access being rejected is the most likely cause.

@stephenw10: Since that's shown as a linked port forward I assume you have a firewall rule in place. Are you seeing anything in the firewall logs? Steve I don't know since all filter logs change so fast … anyway it was my fault ... had to connect to an external vpn server first then tried to connect via ssh to my host and it worked. Sorry for the trouble. Strangely though I hadn't to do this when using the Zyxel router ... Connecting to my WAN IP address with a PC from the LAN directlly (i.e. not by using an external vpn) results in a connection timeout. Thank you for your support stephenw10 ;)

I assume you also know how you can control a browser from another program/service to fill in forms from another program using a browser like IE, Firefox, and how to get the URL's out of them using COM or API's like FindWindowEx and SendMessage with WM_GetText as well.

@wallabybob: @vitesse: I'll check out logging flow on google (Mule) has popped up as one suggestion. Some posts in http://forum.pfsense.org/index.php/topic,32256.msg238508.html give some more details on netflows, a book reference and some examples of the sort of reports that can be generated by the flow-tools package. Thanks checking them out now and added my two cents as well.  ;)

Ok yeah, after some client disconnects, the process dies, and you can't connect again. I don't know why that's happening. Also, I'm assuming this might be getting fixed, but if DHCP leases for OpenVPN clients don't show up in the management console.

for which type of account? You can always just check the source of the page that adds those accounts and track down the function that adds that type of account.

Ssh into sense. Start pftop (9 I think). press 'R', press 'v'. Press 'f' for filter and then type 'host 192.168.1.10' where the ip is that of your client of interest.

Ah, gotcha. I just found it confusing because most of the time if you hit a top level resource you'll get a 403 forbidden instead of a 404 not-found. Also for some reason that time the Obtaining update status… was saying not found, but it seems to be working again.

It's not OT actually it's perfectly on topic in this thread :-) The nmap package is handy for these kinds of tasks. I had to run a report for someone earlier today and discovered that quirk. For whatever bizarre reason nmap (on two separate pfSense boxes) decided it wanted to source traffic weirdly, even when there was a locally connected interface, so the arp failed to respond as expected. Without passing "-e foo0" it would not get valid results no matter how I tried to scan. I pass it "-e foo0" and bam, perfect.

@marcelloc: Your cron job is scheduled to run every hour at minute 5. If What you need it every five minutes, change first value from 5 to */5 Hi i set it to */5 just i didnt copy the whole line of text :) Zasa :)

This would be easy to accomplish if you had two physical WAN interfaces. Because you are using one NIC and virtual interfaces, either in pfSense or in ESXi, you are asking it to spoof the MAC on an individual packet basis. Neither ESXi or pfSense are able to this it would appear. Steve

i have another crash. this time i was able to save it to notepad. after the crash, the error was gone. [crash report.txt](/public/imported_attachments/1/crash report.txt)

@ajm786: Let me rephrase the first question. Is there a way to enable logging per MAC/IP rather than having logging enabled for an entire interface? What logging do you want? Connection attempts can be logged as an option to a firewall rule. The pfSense logs are "circular" recording only the last "n" bytes of log. You can log flow records or syslog records to external servers if you want to keep a lot of history. pfSense has facilities for packet capture (traffic logging). @ajm786: Is there any reason why pfSense doesn't recognize it by default (or show it in the DHCP leases)? Technically speaking, the DHCP leases page is also supposed to show statically assigned IP addresses, so I'm not sure why it doesn't come up at all. No, the DHCP leases page is for showing DHCP leases. Are you confusing DHCP and ARP, thinking the DHCP leases page should show the ARP table (list of recently used IP address to MAC address mappings)? If you want a system to appear in the DHCP leases page it should have a DHCP lease which means it should request a DHCP lease.