@derelict I had lost webui access entirely... so I didn't have the opportunity to see the capture process still running. I had forgotten about it. Likely because the file being removed is still open by the capture process. Is there a command to see what files have open file descriptors?

Yup, that^. You just need to change the pfSense LAN subnet to something other than what the ISP router is using. The default 192.168.1.1/24 for LAN will work if it's not already in use somewhere on your network. But I suggest you don't use that, especially for a VPN server, because it can easily conflict with remote VPN clients. Use something obscure instead like, for example, 10.100.10.1/24. Steve

@jknott it looks like - thank you.

I have CAT5e jacks throughout the house and get gig speeds on every device. Possibilities I can see... misbehaving NIC on the endpoint, damaged cabling, bent pins (or corrosion) on the jack, bad termination on the jack (or patch panel), misbehaving switchport, misconfigured NIC, could also be running CAT5 instead of CAT5e, amongst other things. You can actually get up to 5 Gbit over CAT5e using mGig ports, so there shouldn't be any issues getting 1 Gbit speeds under normal circumstances. If you're not getting 1 Gbit over CAT5e, then there's an issue with something... somewhere... however subtle it may be. I feel like the CAT6 cable may be masking the underlying issue... but glad it's working.

Mmm, odd. I know of nothing that would do that without a deliberate config to make it do it. Like using Squid with ClamAV perhaps. But the 2GB RAM in the 3100 would restrict that. Steve

Mmm, the name itself should not be an issue but, yeah, I would definitely re-install.

It wasn't that it's unstable in 2.6 it's that the drivers stopped building in our build infrastructure for some reason and the errors were preventing snapshots being built. Since the only thing we've ever sold that has Realtek NICs (apu1) runs just fine with the default driver the easiest thing was to remove it at that point. I can ask about adding it back. Steve

@indiegamesfan said in Can't reach access point on other interface/subnet to configure it.: and block the web interface on the guest network I doubt that would be possible with most AP devices, but probably the best chance is to use an outbound NAT rule as mentioned and on the AP allow access only from that IP (the IP of that NAT rule).

Yeah, the chances of a NIC failing so that it's not seen on the PCI bus is extremely low. It's far more likely to fail on the other side. If hardware failures like that are a concern you should be using an HA pair. Steve

@johnpoz Thanks, yeah I was aware I can see it real time, I was looking for logging. Firewall rules with logging enabled works too but IMO the service itself should do it.

ok so i solved the problem... idk why I didn't do this earlier but I checked the arp table of the computers that were not working and the mac didn't match my router. turns out that my brother's switch killed itself and decided to give itself statically the same IP as the router, arp poisoning the network so the computers could only access devices in the same subnet. idk why this affected only Windows devices

@bob-dig Found it and it expired 120 days ago. I have renewed and it will expire on Dec 3, 2027. tnx

@stephenw10 Thank you, I will check the snmp protocol ;)

More information needed. This fails after the install? Can we see a screenshot? Which pfSense version? Which ESXi version? How is the VM configured Steve

@dimskraft where are you creating this file - I use public key to auth to my pfsense, I only have that enabled, you can not ssh with password. You put the Authorized SSH Keys for a user, in the user manager.. [image: 1654958761603-key.jpg]

Ah, that sounds like it's missing some lines and the linksys can detect that and fall back to 100M, which only needs two pairs. If that is the case then setting 100M fixed at both em0 and the Cisco switch should also link. If that does work then you are losing some connections somewhere. If not the cable then it could be in the port perhaps? Steve

I have a new, clean install of 2.6.0 CE that is doing the same thing as the OP described. I'm running this box in a VMWare environment. Initial install went normal, with no issues. The issue started when I went into System->Advanced and tried to tell the webConfigurator to use HTTPS. I'm using the default self-signed certificate. The WebGUI redirect box is unchecked (default) and the Anti-lockout is enabled (default). As soon as I click the Save button it breaks the webConfigurator. Every browser gives the message "This browser must support cookies". I have also tried multiple browsers from multiple machines with different OS's. The only way to regain access is to use the console and re-enter the LAN static IP. During that process it asks if the webConfigurator should be reset, choose Y and it resets back to HTTP access only and access is regained. Has anyone found why this is happening?

@johnpoz said in Allow access without NAT IP?: @lewis just create an alias and put in the fqdn.. Then use that alias as your source. I just noticed I do have an FQDN alias, for the voip provider. That's great, that will work. Thanks so much. I just love pfsense. I recommend it to anyone I come across that talks about needing a firewall. It's amazing.

The swap slice is also used for crash reports, but that would be a lot of crash reports! It show like that if the RAM has ever been exhausted. Check the monitoring graphs for hiostorical RAM usage. Steve

@bearhntr said in pfSense with CloudFlare (and WireGuard - soon) - setup AD DS: @bmeeks I think I may have it all working. pfSense has the DOMAIN overrides in place for the ipv4 and v6 addresses. There are no DNS severs in pfSense GENERAL setup area. There are no FORWARDERS in AD DNS. All root hints (v4 and v6) are populated and resolve. Some of my devices are picking up IPv6 addresses on reboot. Still not getting things added to DNS for DHCP reservations...but I am gonna watch it and see how it goes as they start expiring. NSLookup is now showing IPv6 address for DNS/DC - but not the IPv4 (on the AD DS server). [image: 1654797340555-e1fa74f3-1c6b-40c7-a5e0-1b265833a2aa-image.png] AGAIN - Much appreciate for the help. I will update as I learn more. Glad it is working better. Windows prefers IPv6 when available, so no surprise about how the IP addresses are showing up. As for DNS registration of local hosts, that is highly dependent on the dhcp client app on the local host. Things like Windows and most Linux desktops will either by default supply a desired hostname when requesting a DHCP address, or they can be configured to do so. Some Linux operating systems don't do that by default, but can easily be configured to supply a desired hostname with the DHCP request. IoT devices are a toss up, though. Some may, but I suspect most won't, supply a desired hostname when requesting an address via DHCP. For those devices, you either need to do static IP assignments via MAC reservations in DHCP and manually provide static DNS names, or just forgo that feature for some devices. IPv6 can also be a hinderance here because devices can and will have multiple IPv6 addresses by default (privacy extensions, for example). All of those may not get DNS registration. That's one of my beefs with IPv6 -- it seems referring to devices by a hostname was not fully thought through when it comes to all the multiple IPv6 addresses a client might have.