Thanks for the quick response, Rico! You helped me a lot.

That's normal for Comcast. My ISP does the same to us from time to time.

@Gertjan Great reply it is indeed!

Cool_corona refer to this, https://forum.netgate.com/post/907662 but i don't think it's related to your problem. but you can try that

Yeah the WAN is PPPoE so you don't see the media reported, that's on the parent interface. In Diag > Command Prompt execute ifconfig -vma show us the results. Steve

Since pfsense is a firewall product and not a file server, I don't think you're going to find any kind of solution for this. You really don't want the device that's protecting your internal network(s) to be a file server anyway. If your firewall were to get compromised somehow, your attached storage devices would most likely be targeted as well. How about getting a dedicated NAS box, personal cloud storage device, or network storage adapter? These devices would sit inside your network, protected from outside access, behind the firewall. Do you have a PC on your network that's always on? That could act as a network disk server. https://www.amazon.com/TerraMaster-Transcoding-Personal-Storage-Diskless/dp/B07PWDTBJ6 https://www.amazon.com/KwiltGo-Personal-Cloud-Storage-Device/dp/B07SJHSSMP https://www.amazon.com/Synology-DS120j-DiskStation-Diskless-512MB/dp/B07ZKSLVT5 https://www.amazon.com/Usr-Ushare-Mini-NAS-Adapter/dp/B0050JRXVU/ You could even get one of the less expensive wifi routers that has USB ports on them, set it to serve no network functions, but to instead host your hard drives on the network. https://www.amazon.com/TP-Link-AC1750-Smart-WiFi-Router/dp/B079JD7F7G/ Hope that helps. Jeff

@roadrunner51 Just wanted to thank you for this solution. Fixed my problem.

Please check this https://redmine.pfsense.org/issues/8987

No, aliases do not work in reverse like that. You can use the 'i' icon next to IP addresses in the firewall log to do a reverse look-up. I don't know of any way to do that by default but it would probably intriduce unacceptable delays anyway. Steve

No worries. Better than junking it.

Not directly from us there isn't. If you are forced to do this though a better test would be to install 2.4.5 clean and import the 2.3 config. Steve

Oh, I see. I'm using the wrong branch!

Ok, so LAN is always the 2nd physical interface and pfSense will always use it for the initial web configuration after completing the console config? But I really wanted to make the first 2 physical interfaces WAN1 and WAN2. I guess I got a little OCD in that regard. :) EDIT: I was able to export the config.xml and rearrange the interfaces to the order I wanted. All good now.

@javcasta hi there, did you use the above solution in the end? do you mind sharing please?

It was not possible to change it correctly from gui. I have connected to console using putty change IP of the interface and later created new gateway via gui and assigned it to the network card.

@jimp Tried that also and got 63 for both.

@mrjoli021 said in Suricata blocking Alexa: Could someone explain to me how to match the rule name to what I see in the "Wan Categories? If I look a the alert tab I am getting "ET CINS Active Threat Intelligence Poor Reputation IP group 16" According to the Wan categories I am not seeing anything remotely similar to the rule name. What am I missing? It's not always super easy to make that connection. In this case of this particular rule, it is coming from the ET CINS list of possible bad (or blacklisted) IP addresses. Here is a link to the source of this data: http://www.cinsscore.com/. So on the CATEGORIES tab there is an Emerging Threats rule set with ET CINS and I think there is also one called ET CIARMY or something similar. These are what I would characterize as "dumb" rules. I don't mean dumb as in useless, but rather "dumb" as in it is simply a list of IP addresses, and if the source or destination IP in a packet is in the list you get an alert. One problem with rules of this type is that the owners of IP blocks changes. And that is happening a bit more frequently now since the IPv4 address space has been exhausted, and therefore there is a lot swapping and trading going on for money among owners. So an IP block that might have been used by a spammer last month may, this month, be use by a CDN network that is distributing Amazon Prime, Hulu or Netflix streams. So these lists have to be taken with a grain of salt.