That makes sense…didn’t think of that.  Thank you! ETA:  That was the issue...the 4 port NIC now occupies igb0 through igb3 and the onboards start with igb4.  Thanks again!

Hi kshays, If you had no 3rd NIC on your pfsense you would tag all VLAN's on the LAN NIC and on the switch uplink port (trunk). You would then untag/tag ports on your switch as per requirements. In your example you would: Switch Port 1 - Tag VLAN1 & 3 (as it's carrying both Secure WiFi and Guest VLAN traffic to the ASUS RT) Switch Port 2 & 3 - Untag VLAN1 I hope this makes sense. SJT.

Well am glad u were able to resolve this with easily replaceable NICs and not some embedded soldered on NICs.  There are some system/advance/network parameters that users can turn off to deal with problematic NICs to try things out as alternative.

???? What do you mean pfSense server?  PfSense is a firewall/router, that can also do things like DHCP and DNS servers.  If you have multiple sites connecting to it, what will you use as a firewall on those sites?

@dotdash Thanks for the info. I have search only last night and after a long many hours found my potential solution. I will have to test today. I will also be searching the virtualization forum also for alternatives.

Unlikely it's related to a software reboot. It'll probably come back if/when your phone starts charging again or so.

Yeah this seems to be related to https://redmine.pfsense.org/issues/8360 With that !/

So you have computer on pfsense wan, and you want to get to stuff behind pfsense NAT to lan.. Then you would have to port forward..  If you do not want to port forward, and use pfsense as a downstream router/firewall without nat.. Then unless you do host routing on devices on what becomes a transit network your going to have a bad time with asymmetrical routing. To use pfsense as a downstream firewall/router or just router and not nat then pfsense needs to be connected to the upstream router via a transit network that no hosts are on so that you remove asymmetrical routing.. If you want to do what your doing with pfsense NATing between wan and its lan which is what it does out of the box.. .Then you would setup port forward for what ports you want to hit on 192.168.2.2, and haave your 192.168.1.2 computer hit pfsense wan IP at 192.168.1.100:port to get get forwarded to 192.168.2.2 [image: transitnetwork.png] [image: transitnetwork.png_thumb]

https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

"but I have never encountered a situation where two IPs from the same subnet can ping one way but not the other." You sure its pinging the correct thing.. Could be wrong mac.. And sure have seen this quite often with firewalls on hosts.  Or in a bridge if your filtering on members of the bridge it could be allowed in one direction or not the other.. etc. etc.. There are many reasons why this could happen.  If you were on a actual L2 first thing to do is validate your devices are arping the correct mac, etc.

While I am not an expert on the whole boot process of pfsense.. From a general point of view… The configuration of pfsense is stored in XML... So on boot I would assume pfsense makes sure that "all" settings that are in the config XML are placed into the appropriate files.

What kind of content?  I use Plex for the 5000+ movies I have and it can live behind a dynamic IP and no need for a VPN tunnel from any location.  Plus Plex is available as a native app on every media platform.  Smart TV's Netgear Router now has Plex Media Server Built in., Iphone, Android, Mac, PC etc… FYI Plex Server and client are completely free!!!!!! Install Plex Server at home and then use the Plex client anywhere (No VPN Required) and access your content!

Thanks I'll give that a try.

That is not what you stated ;)  I was making a funny about it… You really need to look into how shaping works and limiting though... TCP does this on its own.. My guess would be this user is doing p2p and has hundreds of sessions running if he is eating up all the bandwidth. The best solution to such users is just block what they are doing or just limit them down to shit..

Figure out why the state is being closed. An established TCP state will not expire for 24 hours of ZERO traffic using the default firewall settings. If the state is no longer there it is because either side has closed it. More info here: https://doc.pfsense.org/index.php/Why_do_my_logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection