Why can you not just LDAP to auth to your AD?

It's strictly for a lab environment , on an inside segment. Bingo

@stephenw10 yes it helped thanks for tip. I started learning now about traffic shaping to see if i can do more to improve performance and just to learn about it for fun :)

@stephenw10 is spot on. On the LOG MGMT tab are settings for controlling the size of each active log and for retention of rotated logs. There is also a setting for controlling the maximum allowed size of the entire /var/log/suricata tree. Be sure to allow for some overrun when setting the size limit, though. This is because the log managment feature is handled by a cron task that runs periodically to check on and clean up logs. On a busy network, there can be a lot of log growth that happens in between the 5-minute checks the cron task performs. Unless you have a quite large hard disk (say at least 30 GB or more), then enabling packet logging can be dicey on a busy network. You will need to limit the log size and particularly the retention (the number of old, rotated logs/files kept on disk).

Mmm, already watching.

Yes you can do that. pfSense can run the OpenVPN client and route all traffic through it. But there are two issues that make it at least inconvenient to do this with pfSense. There's no good way to search for and connect to a wifi network from the pfSense GUI. You would need to 'discover' the wifi network on something else and then manually configure pfSense to connect to it. Or use some other device to connect to the wifi network. As you said pfSense will just try to connect to that network to bring up the VPN. You would need to have at least once device that is not routed over the VPN or maybe a particular site you can access by IP that is not routed in order to be redirected to the captive portal login. Steve

@stephenw10 said in System Log: Mmm, I can't answer that without more research but it logs like that on every firewall I see. So whilst it may be a bit ugly it's nothing to worry about. Steve Thank you - Nolli

@kiokoman thank you so much for this tutorial. I will try this setup. Once again, thank you so much I really appreciate your help. :)

If you WAN bandwidths are that different the first thing you should do is weight the gateways in the load-balance group so you get 5:1 connections using the ISP B gateway. Then a great way to set equal bandwidth per user is to use dynamic limiters based on a /32 mask. Unfortunately the screenshots have been lost from here: https://forum.netgate.com/topic/57476/per-ip-traffic-shaping-share-bandwith-evenly-between-ip-addresses The description is still good though. Steve

The VPC subnet is assigned in AWS. All interfaces are DHCP and receive their settings from AWS. This does make things a little odd for some things. So LAN will receive a gateway and be treated as a WAN by pfSense. You probably want to set outbound NAT to manual or hybrid and prevent it NATing out of LAN. Steve

@jpod2019 said in Can you run DHCP, DNS and NTP on different VIPs?: (I’m assuming everything will be done through the LAN interface and VIPs) I'm assuming you mean WAN there. You can have a single interface and it will be WAN and that's fine. The anti-lockout rule will be applied there instead of LAN in that case. If you add a VIP on the WAN all services will listen on it by default so you can add VIPs for NTP and DNS and it will work. DHCP will only run on the interface address though. By default DHCP wil hand out it's own IP for NTP and DNS so you would need to make sure you set those values in the DHCP setup. Though it would still work fine for anything using DHCP since those services would also be listening on the interface IP. Steve

sshguard also protects access to the GUI, not just SSH.

@JKnott ok

Working Thank you soo much.

@Rico said in How can I make a data usage graph?: https://www.netgate.com/resources/videos/bandwidth-monitoring-on-pfsense.html Traffic Totals package:- [image: 1562330012656-screenshot-2019-07-05-at-13.28.00.png]

Ok guys thanks for no replies anyway got this sorted. I still have no idea what was the problem. I must have tried 20 different configuration options with rules and all. In the end, I have it all working with just ONE rule that I'm 99% sure I tried before.... go figure... sigh After I got things working I started disabling the others one by one to see which would impact. Anyway, here's the rule that has it working now: Firewall > Rules > LAN Immediately below the Anti-Lockout Rule, add a new rule: Action: Pass Interface: LAN Address Family: IPv4 Protocol: Any Source: AppleTV's alias Destination: any Advanced options: Gateway - WAN_DHCP In the meanwhile I had an IPv6 block below but it wasn't creating states so I disabled it, and still all is working. So I'll just keep an eye on it and lyk tomorrow.

Hmm, I've never tried that. I would backup the config re-install, remove the swap during the install. You should edit the fstab to set it to mount root noatime though if it's not already. Steve

Thank you all. I appreciate your comments on DNS Resolver and everything got sorted. Super!

@sheen73 said in WAN Disconnects Multiple Times During Use: Hintron E31N2V1 Hmm, well it's not on the list specifically and 30s of Googling shows positive reviews so maybe not that. https://badmodems.com/Forum/app.php/badmodems https://www.dslreports.com/forum/r32152762- Steve

@mcury thanks let me try