@Derelict: Where are you testing from? I setup a laptop with a cable straight to the wan port. I'm out for now but, what if I set the ip address to the wan instead of the bridge? do you think this would help. Or it shouldn't be different?

This bug with IGMP Proxy seems to still exist in 2.4.2. I have a different ISP, Movistar Spain, with a different setup (IPTV comes through its own separate VLAN) and I still see the same "The IGMP message was from myself. Ignoring." message and no IGMP is forwarded to the right upstream interface.

"Waiting for your comments." I have a comment - use something that is current and supported..  2.0.1 released end of 2011, shoot its not even the latest version in that line. 2.0.3 was..  The version of freebsd it was on 8.1 was EOL July 31, 2012.. The OLDEST pfsense you could be running is 2.2.6, with even the resemblance somewhat close to being in the area of dragging your feet..

Ashima has the fix.  I tried a bunch of stuff to get this fixed AND NONE OF IT WORKED until I patched the boot loader! https://wiki.freebsd.org/SystemTuning#SYSCTL_TUNING "The kern.ipc.somaxconn sysctl limits the size of the listen queue for accepting new TCP connections. The default value of 128 is typically too low for robust handling of new connections in a heavily loaded web server environment. For such environments, we recommend increasing this value to 1024 or higher. The service daemon may itself limit the listen queue size (e.g. sendmail(8), apache) but will often have a directive in its configuration file to adjust the queue size up. Larger listen queues also do a better job of fending off denial of service attacks." Thank you Ashima!  I gave you a thank you bump too…if that matters, 5 gold stars, best in class, grade A <-- whatever nice things you can think of. This was driving me friggin crazy!!!  :-)

I seem to have found my solution https://doc.pfsense.org/index.php/Unable_to_Access_Some_Websites Step 9 seems to have done the trick: Check Clear invalid DF bits instead of dropping the packets on System > Advanced, Firewall/NAT tab Jason

@motific: Just start with the basic tests - HTTP/500 is an error in the code of the page you're accessing rather than a communication issue. Can you reach the page that generates the http 500 response from a browser? Since there's only 1 machine behind squid right now, what happens if you bypass/disable them (first squidguard, then squid)… does kodi work then? can you use curl to pull down the zip file? can you get to the URL from a browser? Once you have those answers it ill narrow down what you need to look at next and you should be able to follow the path logically to get to the root of the problem. Also, why do you believe you need a DMZ for those devices? I will try this  and  get back to you.

Really the best thing is to set up your hardware like this:- Modem - pfSense - Lan & wireless router Personally, I agree with JKnott - unless you have a very good reason for keeping DHCP/DNS on the Linksys then you'd be better off keeping pfSense visible and reconfiguring the Linksys as a dumb access point.  Giving the Linksys less work to do helps mitigate some of the many security holes present in SoHo routers.  Once set up, you can also pretty much forget about it apart from changing the wifi key every so often.  Since the main interface for what's going on in your network will be pfSense it doesn't make a great deal of sense to separate the responsibilities.

That should be ok. Use "machine.mydomain.com" in your mail client and you'll be fine from the 'inside'. Your domain registrar should also contain "machine.mydomain.com" and point to your WAN IP, where you forward your mail ports to your "machine".

^^^^ That's impossible to answer without knowing the hardware.  I suppose really anemic hardware might have problems.

Oh my Gawd dude…  You stated you were going here I would just go directly to the host/service on the LAN: https://nas1:port. That is not a FQDN so how could you be going to your wan IP…  And you stated your were just directly going to the host.. Yes if your going to your WAN your going to get reflected back in via your proxy or your nat... Dont DO THAT....  Just setup a host override so s1.nas1.domain.net or whatever fqdn you want to hit resturns the correct rfc1918 address.. What are you putting in your browser when your on your PC behind pfsense??  What does it return for an an IP... In your reverse proxy setup your putting in what??  Some other fqdn or hostname - how is pfsense resolve that, some other dns that you have setup??  If pfsense forwards or resolves a FQDN somewhere and it returns rfc1918 then that is a rebind..

How is the OpenVPN server supposed to know which server to send the traffic to?

Post your rules. Be sure it isn't TCP-only. https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

I found my solution, FYI: https://serverfault.com/questions/886071/pfsense-load-balancer-access-virtual-server-from-lan

@Gertjan: something's up with your system. I think you are probably correct. Not sure, but I suspect that an incorrect password wouldn’t result in a terminated connection but rather an error about invalid password and a prompt for another one. I also can’t receive Growl notifications on the same system even though pfSense shows that they are being sent successfully. I’ve installed a public key on the system and we’ll see how that works. So far no problems.

I installed a shellcmd php -r 'require_once("shaper.inc"); require_once("filter.inc"); interface_ppps_configure('opt2');' to fix this issue. Replace opt2 with the optx you are using.

What cron jobs do you have running? (can install cron package to look that up) Seems like one of them is creating a little output that cron wants to mail.. Can you perhaps try running them one by one from a ssh console manually and see if any produce 'output' ?