@Tai:
Im not sure what disabling NAT Reflection really entails if it is a horrible security risk or just makes port forwarding/nat more work. ??
Cheers
It's not a security risk, it just puts more load on the pfSense box. The domain name you use to access your virtual sites internally looks up to a public IP. Thus the request goes out to the pfSense box. Enabling NAT reflection allows the pfSense box to redirect the request back into the internal network to the correct host.
If you had split DNS when inside your network the domain name would look up to the internal IP of the server. This would avoid the unnecessary loop to the pfSense box as the request would go directly to the server. When outside your network the domain name would look up to your public IP.
There are ways to do such configs not from the pfsense gui!
Search google if you want to do such a config but it just provides basic security and not a real protection.
Go to the console or ssh in (if you have ssh enabled at system>advanced) In the menu you'll find an item "pftop" that will do exactly what you are looking for. Press "h" for advanced options while running pftop.
Try setting your harddisk in PIO4 mode if you still recive this message check your RAM.
There might be an edge case where might need to change the allocated memory to kernel vs. user base. What version of pfSense is this?
You only have to follow this simple guide: Rules are applied on incoming traffic only so if you want to do outbound balancing to multiple WANs the traffic is coming in on the LAN and leaving on the WANs/OPTs. Your rules have to go to the LAN tab therefor. And also have a look at the tutorials and docs. They should get you started quickly.
Great to hear that. Good progress has been made on the traffic shaper. Now can we put together a bounty to extend captve port to be multi-wan and multiple interface?
I'd go with rsync over SSH. Rsync will allow you to keep the webserver updated with changes on the fileserver and as you should be using SSH to admin it anyway you're not opening up any new holes.
Doesn't matter if it's in the GUI for me, personally. If the support was there, I was just going to modify /etc/inc/interfaces.inc to add the lines. No big deal.
