Okay. Thanks for the explanation.

@jimp Very confusing but ok, thx ! Case to have real syslog server

There is no way to exclude the hostname, it does this to ensure the filenames are unique between firewalls, so if you connect to multiple firewalls, the filenames are not the same. I'm not sure it makes much difference for the hostname in that context, whether or not you want it to show "pfsense" there or another hostname is up to you.

The most common time I see this is when my cable connection renews DHCP and switches to a different subnet. Some states are still pointing at the old gateway which is no longer valid, thus the error. I suspect a similar issue happened there, probably as @heper said, it came from the cable modem. Lots of cable modems will hand you a private address if you lose upstream sync.

Do your sniff, diag packet capture on your lan interface... Do you see the syn to your ftp server private IP... If you do not see an answer its not pfsense that is your problem. Here I just setup a port forward for ftp (21) and can you see me shows closed.. [image: 1548858567386-ftprst-resized.png] See how my client on 192.168.2.11 sent a RST... Basically he said to F off ;)

In what way does the the WAN 'go down'? What do you see logged? Are you running 2.4.4p2? There were some default gateway issues in 2.4.4. Steve

Im am using only Cisco 3750 switches in the network. It was 100% opperator error.

LOL Read the book! Thanks Sir

Hmm, so the command remained the same? Just the interfaces in lagg0 that changed? Steve

Does it do the same on different switch ports? It could be a bad port. It's not any sort of limitation in pfSense. All Gigabit NICs should link at 1Gbps regardless of whether or not the hardware can make full use of that. Steve

Hmm, that's... unhelpful! Well you can at least update to 2.3.5p2 (or 2.3.6 if you go to the last dev snaphot). If there is some bug you're hitting it may have been corrected. I'm not aware of that specifically though. Steve

Just as an update to this. I span up a new VM with a fresh install of pfSense. Copied most of the settings across so it was ready to 'drop in'. I visited the site two weeks ago, shut down the broken pfSense, and booted the new one. Power cycled the cable modem and immediately everything worked. Two weeks in and the cable modem is still recognised and working correctly. So I assume the problem was caused by some sort of corruption in the config file.

I think it has something to do with the LCDPROc Packages. Will testing this now

L3, ie layer 3... Vs L2 - layer 2... That seems to be only a layer 2 switch, so no routing..

I've reset the SG. Connection kills are gone. No longer nginx reports in system log. Is there another log that might help dig deeper? because just that error in system log didn't helped identifying the problem.

@mitch_sullo Sounds correct :-)

@mattlach I think you are misunderstanding my setup I am not using pfsense as an Access Point. I have eero behind my LAN port for that. AirVPN is my VPN provider. The reason for two LANs is one subnet routes directly to ISP and other subnet through VPN for privacy. Example my Xbox and XB6 STBs will go through ISP via LAN and my wifi traffic , Torrents etc will go through VPN for privacy. My switch is located behind the pfsense firewall

It began to work now.

@mattlach I've seen a lot of people talk about Nas but I have no idea what it is or how it works or how to set it up. But I see it all the time in the Plex forums. Would you mind explaining it beyond "network attached storage" I mean I guess that's what I'm trying to do is setup media storage servers and network them. Btw it transcodes because there's no direct connection to the Plex server. If I could get a direct connection I could use h256 and I'm running tomato over the Netgear because ddwrt doesn't support open VPN for this model of router but tomato does. Which finally got tomato and ddwrt somewhat recently many years after I bought the stupid thing.