There are not currently any plans to take on mirrors from third parties.

Hello Steve The Pfsense does not have DHCP server There are many PC navigate on the same subnet. All with static IP (10.1.1.x) So, I have one PC to be LTSP server inside the same subnet. The dnsmasq do it a DHCP server for LTSP clients. In this way that I have no ability to fix the communication through Ltsp server/client/PFsense to out internet or have ping answer. Thank you Douglas @stephenw10 said in LTSP - Pfsense - (clients LTSP UP but not connect Internet): You should be able to ping 8.8.8.8 without DNS. Check the routing table on the client run netstat -rn. The only other explanation is that the rules you have in pfSense are somehow passing only traffic from the server and not the clients. But the default allow rules on LAN would apply to all traffic from that subnet. Steve

Thanks for the insight Steve, this information you provided me saved me lots of time. Appreciate it, the previous guy had put a SYSlog server into place, but the license had expired so I lost out on that end as well lol. Still no word from the data center. Chris

This is a 2 year old thread, with no details when first asked. I would suggest you start your own thread with details of "exactly" what your doing... Large number of certs means what 10, 100, 20,000? For example of a bad way to ask a question.

https://www.netgate.com/products/tnsr/

@stephenw10 Good to know! That has already been taken care of in this instance by accident, but it's good to know for the future! Much appreciated :)

@jknott The PFsense kernel is compiled with option "device ENC", so you can see this interface even if you don't use IPSEC. In this case, it is in the state "down".

Is the ERL also routing and NAT'ing? If the AT&T routing has a 192.168.2.X sibnet on it's LAN then it is not in bridge/modem mode. The subnet between the AT&T LAN and the ERL WAN and everything on it, including pfSense, will be 192.168.2.X. So probably you need to set the bridge interface to the .2.X subnet. Then you will be able to add the AT&T router as a gateway. A diagram might help a lot here. Steve

@coreybrett said in TINC: Unfortunately I can't find any documentation for the package. I've played with it a bit, but haven't had much luck. Yes, THAT is the "problem" and there are a few "quirks" that is not "true" to the way tinc actually operates, like the forcing of an address in the host configuration, even though it's a host that is not going to be connected to and would be a dynamic IP host.

Okay... Corrected itself. (smacks forehead...)

Because netgate/pfsense no longer provide unsupported version for download for security reasons https://forum.netgate.com/post/788629 There would be zero reasons to run those OLD unsupported versions that do not have current security issues corrected, etc.

Thanks for the help, Steve. I can't get this working properly. Tried with this NAT rule: [image: 1550324444955-capture-resized.png] The secondary gateway (IP 10.10.10.1) doesn't seem to be able to communicate through the GIF tunnel. Also tried with the option discussed above (with patches), no more luck. No byte is going through the tunnel. [image: 1550324579186-capture2.png] Any idea of what's going on ?

If you want to use Netflows to view that then you need a netflow collector to export the data to. If you only need an instantaneous reading you could use something like wireshark that can graph traffic from a packet capture. https://docs.netgate.com/pfsense/en/latest/monitoring/monitoring-bandwidth-usage.html Steve

You don't need proxy+nat if your using host override. You don't need any nat reflection!

Yes, it was added in the change set referenced there.

@stephenw10 Now i get it. I just enabled ipv6 in networking and logging in firewall settings and created rules to block ipv6 totally without any logging. Now logs look much better. Those logs are great learning tool. Thank you kindly ALL for clarification.

Are you tracerouting from Windows (ICMP) or Linux/FreeBSD/OSX (udp by default)? If you traceroute to something through the VPN that's not the firewall does that succeed? Steve