It works installing 2.3.3 AMD64. no errors thanks

@jimp: No, because that only applies to pass rules, which already only log the first entry. That sets a state/rate limit for connections passed by a rule. After that limit they are blocked (and logged…) Subtle, but I see the point (I think). Making rules more complicated to limit logging is probably not advised, anyway. The task of limiting/filtering could equally well be done by the viewers. If the Log widget or Status/SystemLogs had a way to collapse adjacent similar entries in the listings that would be sufficient.

I think I may have fixed this. Hope this helps someone else: My setup is pfSense as DHCP server, and a WDS server acting as the deployment server but with WDSLinux also in play - http://www.syslinux.org/wiki/index.php?title=WDSLINUX Disable TFTP proxy Configure pfSense DHCP server for network boot on the client side interface, with next server IP address as the WDS server and for bootfile, for WDSLinux, "boot\x64\pxelinux.com" Allow UDP 69 on client side pfSense firewall rules through to the server. Allow UDP >1024 on server side pfSense firewall rules through to the client. The last comment due to seeing blocked traffic on ports 2070-2079 on one attempt and 49152 on a second. I looked up the ports but the associated services didn't seem relevant so I guess it must be picking a random higher port. I hope to clean this rule down but this is what it took to get it to work.

Thanks heper, I did the packet capture, now I'm trying to figure out which options to go to in the system to make the changes.

http://www.ccboot.com/ its a Diskless unit that runs in one server to all other units without using HDD

https://forum.pfsense.org/index.php?topic=124402.msg688335#msg688335

My problem is solved. I retrieved the configuration file config.xml and proceeded to a new installation and then restore the configuration. Thank you so much.

Well this sort of worked. The interface was sitting quite happily at 1500mtu and I tested that I could ping without fragmentation: C:\Users\Administrator>ping -f -l 1472 github.com Pinging github.com [192.30.253.112] with 1472 bytes of data: Reply from 192.30.253.112: bytes=1472 time=86ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=86ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=87ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=87ms TTL=56 Ping statistics for 192.30.253.112:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 86ms, Maximum = 87ms, Average = 86ms Which worked fine. But now this morning, it's back to 1492 and fragmenting again. One thing I did notice when it was working ok was that my WAN interface didn't appear to have an IPv6 address, but now it does. IPv6 was still working without it though.

Everything is working fine  :D I only had a problem on the ubiquiti APs: SLAAC assign duplicated IPs on bridge interfaces inside the AP causing ARP loops. Disabling ipv6 support in the AP solves the issue

Any downside in using such configuration ? If we can use PF sense as a PPPoE server also, then it will help us to avoid another thing (Box) as PPPoE server.

500 Devices and, in particular, 40Mbit/s is just not that much. Probably should be looking at your virtual environment instead of the firewall.