Firewall > Virtual IPs You cannot have multiple interfaces on the same subnet.

@bradtn: @guardian: @bradtn: @guardian: Make sure that you don't have Block Private Networks enabled (or a pfBlocker/Suricata/Snort) rule that trips when it sees a 192.168.x.x packet.  I've been trying to get up to speed on setting up pfSense and for now have to run behind a similar NAT… box has been up for about 3 weeks no sweat, so unless the modem is going down, you should be fine. Where Do I find said settings? Look under    Interfaces / WAN or    Interfaces / LAN - at the bottom under Reserved Networks (If you are using the new 2.3.1 or 2.3.2 interface) are you using any of  these: pfBlocker/Suricata/Snort?  If so, then you need to check the rules/blocklists - Firewall log should give you a hint if you are seeing stuff blocked. Its a fresh install so I do not believe so? If I recall correctly they are CHECKED BY DEFAULT

That's it exactly.  

If you can ping the pfSense LAN interface (or bring up the pfSense gui when connecting to the LAN interface address) from the OpenVPN client then your tunnel is probably up and correctly configured. If you cannot connect to other devices on the pfSense LAN, that is almost always the local firewall on the TARGET host preventing access from foreign subnets.

When bridging is necessary, it generally works fine. If you have to ask "should I use a switch or a bridge" the best answer is pretty much always a switch. You really don't want layer 2 traffic between the two switches going through a bridge.

@heper: csrf error does not occur on interfaces. So if you assign an interface to your vpn, then it all works indeed. And IPSec will do it too: once sites are connected through IPSec tunnel, this is as simple as defining FW rules  8)

I also agree, but some packages, like HA Proxy, might exist so pfSense can function as a proxy OR a firewall. Not necessarily a proxy AND a firewall. That is just an example. HA proxy generally runs fine on the firewall though it could certainly be argued it is not the best place for it. Just because the packages exist doesn't mean they can all be run at the same time on the same node without issues.

What version did you upgrade from? You can generally run into trouble if you use something like AD and google as "Primary" and "Secondary" DNS servers (there really is no such thing as it is completely up to the client which DNS server is used first. Some query them all simultaneously and take the first answer, some query one, time out, then try the next, etc.) All of the DNS servers used in a particular context should return the same answers to every query from the same source. Your AD will have AD information, google will not. Problems such as these are best investigated using DNS tools such as dig/drill. Without seeing the actual queries and answers it's tough to tell what you were seeing. I can't see deselecting All interfaces to listen on having any effect. The forarder was either listening on the interface in question or it wasn't. All binds to all.

The crap software in most consumer grade routers makes them good as an access point, but not a lot more.  The C9 should be pretty decent - a lot better than the WRT54GL (running dd-wrt) that I'm using-but even that works… good enough to stream a bit of Youtube or browse.

ok  I try it ， thank u。  ;D

you can create a limiter on lan https://doc.pfsense.org/index.php/Limiters check dynamic queue creation

Thank you, I added that now. Where would you place the script to load it propery? In here? /usr/local/etc/rc.d/

That's basically idle. Any loss is likely attributable to a problem on your Internet connection. The processes you see coming and going are from updaterrd's stats gathering.

There was a problem earlier, fixed this morning.

@Harvy66: I hate SMS based 2FA. It requires wireless connectivity and SMS has been shown to be easy to snoop on for people in the know. The US National Institute of Standards and Technology (NIST) has released the latest draft version of the Digital Authentication Guideline that contains language hinting at a future ban on SMS-based Two-Factor Authentication (2FA): http://news.softpedia.com/news/nist-prepares-to-ban-sms-based-two-factor-authentication-506617.shtml