Thanks for the hint. I don't think that after what I figured out today, Apple Home will be "my thing". Of course I could setup "something" in IoT VLAN which connects to Home and I can connect from iPhone in another VLAN, but if I didnt do it wrong, it always uses the internet to execute commands, means: Iphone Home App --> Internet --> control server --> back home --> iPad --> IoT devices I can clearly see a delay from pushing the button in Home App and when I sniff on the interfaces I can see outoing and incoming connections. What I'm curious about, except some avahi/mdns/zeroconf stuff there is nothing I could do to keep it local when iPhone is on user WLAN/VLAN while hue bridge is still in IoT VLAN ? Thats where my network skills leave me alone. You might also check FHEM if you didnt already.

You have to define groups and then use group ACLs. Create a group that can access any site and then simply don't apply those blocks target categories to it. https://www.netgate.com/docs/pfsense/book/packages/a-brief-introduction-to-web-proxying-and-reporting-squid-squidguard-and-lightsquid.html?#access-lists-acls Steve

Indeed I have something very similar to that but I cannot use that as a source address. Obviously, it's link-local. I would not expect the OP to be using that as source for a pkg update though. Steve

@rgc No I am Not running pfBlockerNG-devel, but I still can save output to .php file from diagnostic Crash reporter. I was told to post it here 1st. I guess to vet and prevent unnecessary or redudnat reporting from being posted to bug portal. Should I post the the bug report.php now? to th bug reporting portal?

What logs are you seeing without Snort and bandwidthd filling it? I exepct to see more nginx errors in there. Steve

@johnpoz said in Using PFSense as a router between two ESXI hosts - VLANS, routing help: So I ran a USG p3 for a short time while I transitioned between pfsense on my OLD esxi box, it could not handle my then new 500/50 internet.. While the USG handled it without issue as long as didn't turn on IPS which disables the hardware offload. As soon as the sg4860 I wanted back in stock and got it, the USG went on my self.. While I love the price point and that it can handle the 500/50 without much issue... It is no where close to the maturity and ease of use of pfsense.. If you have more interfaces then you for sure could do more with the networking on your esxi than that basic setup I posted. Maybe something like the sg3100 (pair) of them would be something you could do if you really want HA.. Or the 5100s that are now shipping. I think that is a bit over the top for home setup myself. But since you have 2 esxi hosts and plenty of nics in them - you could for sure do it with the hardware you already have. Or if money not a problem - get yourself a couple of the new XG-7100-1U for your CARP setup ;) Have Fun!! I predict your ER is not long for this world once you start playing with the power of pfsense ;) Yea, I think my edgerouter days will be coming to a end in the very near future. For now, maybe get a sg3100 with plans to do HA in the future (although reading on CARP, that sounds fun....not sure I could convince the wife on the xg-7100-1U :) ). I forgot to mention, at some point i am going to be adding a storage piece for backups, nfs mounts for my ESXi. THinking that will add 2-4 more NIC's to my setup. SG3100 still be ok for that? I didnt realze that the SG3100 had 5 NIC's outside the WAN interface. I have the SG3100 (one for now) in my cart...ready to buy (just making sure right one for now and future stuff (storage)...ready to purchase!!!

Thanks everyone! Now, a bit wiser, I know how to proceed.

Good to hear you found the problem.

It may not output in ascii. Does it appear to be incrementing at 1s intervals? I'm seeing some references to it being at 50bps so you might try that. You could probably cat the device to a file to examine the actual data but it probably won't tell us much anyway. There is a utility to check the output but I don't think it's compiled by default: https://github.com/pfsense/FreeBSD-src/tree/devel/contrib/ntp/parseutil I suspect you may need to compile either that or ntpd with the rawdcf option enabled in FreeBSD 11.2 and copy it across. Or at least test it there first. Steve

I agree, it's not obvious. You can see what the pfSense package is configuring in /usr/local/etc/nut/upsmon.conf Anything else is using the compiled in defaults. Steve

@bbennett That's a poor way to test throughput. Use iperf on each side of your WAN. Testing a 10G connection over the Internet is crazy.

I've been using in parallel this https://github.com/KoenZomers/pfSenseBackup : runs from a Windows PC every day.

hi kapara could you be more specific for your statement : If you want to take it to the next level you can installpfsense directly on the host machine.... Do you mean instaling pfsense directly on a physical machine ? Is this feasable when using OVH vrack ? thanks Stephane

I don't use pf-sense beyond what the dafault settings are and when setting up the firewall threw the inital configuration wizard the only thing I changed was the DNS as I selected to use my own. I dont have to much knowledge in particular about pf-sense and everytime I have made changes you can guarantee I have borked my set-up . When I installed it, I was curious about the home lab aspects of it and it works don't get me wrong and I use it daily when I'm using my systems as my servers up most of the time.

What version of pfSense are you running? If you are not running the latest 2.4.4 version, you can't upgrade/install the latest packages due to a PHP 7.2 dependency. If you are not already running pfSense 2.4.4, remove all packages, upgrade to 2.4.4, and then reinstall your packages.

It seems somehow the shellcmd was in the config.xml twice in different places. Removed them both and just left the crontab entry so it starts up a minute after booting. Not ideal, but it may be the only way as it seems there is a conflict with pfSense executing the shellcmd too early before everything else has finished starting up. I'm guessing one option may be to have the shellcmd script look for the booted file to appear, like pfBlockerNG does, before actually starting the script. Its all very odd as it was working perfectly months ago, I can only assume either pfSense made some tweak in when the shellcmd is executed causing it to hang like this due to starting too early, or I was using some alternative way of starting the script on boot (I lost that old config so not sure). Its baffling as surely shellcmd should be the vast last thing to execute once everything else has finished, not half-way through the boot process. Seems a very questionable choice if your startup script can hang the boot process. They certainly don't seem to document all changes, possibly because some things are happening upstream in FreeBSD itself. I noticed after the upgrade to 2.4.4 I'm using a lot more RAM, I think its related to zfs as before it was detecting I had less than 4GB RAM so disabling some functionality, perhaps now its ignoring the RAM allocated to the integrated graphics so acting like I have 4GB RAM (which I do minus iGPU). But I digress.