Thanks heper, I did the packet capture, now I'm trying to figure out which options to go to in the system to make the changes.

http://www.ccboot.com/ its a Diskless unit that runs in one server to all other units without using HDD

https://forum.pfsense.org/index.php?topic=124402.msg688335#msg688335

My problem is solved. I retrieved the configuration file config.xml and proceeded to a new installation and then restore the configuration. Thank you so much.

Well this sort of worked. The interface was sitting quite happily at 1500mtu and I tested that I could ping without fragmentation: C:\Users\Administrator>ping -f -l 1472 github.com Pinging github.com [192.30.253.112] with 1472 bytes of data: Reply from 192.30.253.112: bytes=1472 time=86ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=86ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=87ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=87ms TTL=56 Ping statistics for 192.30.253.112:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 86ms, Maximum = 87ms, Average = 86ms Which worked fine. But now this morning, it's back to 1492 and fragmenting again. One thing I did notice when it was working ok was that my WAN interface didn't appear to have an IPv6 address, but now it does. IPv6 was still working without it though.

Everything is working fine  :D I only had a problem on the ubiquiti APs: SLAAC assign duplicated IPs on bridge interfaces inside the AP causing ARP loops. Disabling ipv6 support in the AP solves the issue

Any downside in using such configuration ? If we can use PF sense as a PPPoE server also, then it will help us to avoid another thing (Box) as PPPoE server.

500 Devices and, in particular, 40Mbit/s is just not that much. Probably should be looking at your virtual environment instead of the firewall.

than as stated couple of times already put in a host override for the fqdn you want to use to access your server and point it to the private IP of your server.

I think it's the way it's written, it's misleading to say the least.

See above. (Assumes you have at least a public IP on your LAN. If it's RFC1918 or CGN, tough cookies…)

"Wait five minute or a restart of pfSense may require You can test in any browser. All Done !!" I have over a thousand people connected at the minute. I will reboot at a quieter time and report back.

did some more looking arround. I've implemented the following. https://forum.pfsense.org/index.php/topic,17243.0.html https://forum.pfsense.org/index.php?topic=51786.0 It looks like it will probably resolve the issue.