As mentioned above, from the WAN side it will be pretty safe out of the box. My first step even before I connect it to a WAN or LAN would be to change the default password though.

https://doc.pfsense.org/index.php/Firewall_Rule_Basics

1 more thing, this is from the cable modem log: Mon Feb 06 14:59:54 2017 Critical (3) Received Response to Broadcast Maintenance Request, But no Unicast Maintenance opportunities received - T4 time out So the cable modem had a hiccup with the comcast signal, and when the gateway (wan) handled the change, one interface (lan) was able to cope with it, but one (opt1) was not.  I fear I'm out of my league here as they're setup the same.

@webtyro: Bad pun I know. I have one lan called "home" and another called "untrusted". I know you can guess where the visiting Microsoft units are put. Hard to trust them. I run all Debian for my own use. Microsoft had a good run but I feel they have gone rogue. Post update if it shows again. Hope not though. I've seen a quality drop from nearly every big tech company there is.

Perhaps try FreeRADIUS.

Here's my network details if it helps: Network Diagram: http://prntscr.com/e58gvo Switch network config: http://prntscr.com/e58cfj Switch VLAN settings: http://prntscr.com/e58cs4 Firewall LAN interface: http://prntscr.com/e58d8y Firewall VLAN3 interface: http://prntscr.com/e58dpp LAN DHCP settings: http://prntscr.com/e58e2b VLAN3 DHCP settings: http://prntscr.com/e58eau Relevant LAN rules: http://prntscr.com/e58eth VLAN3 rules: http://prntscr.com/e58f2p

Lan Gateway: ?? LAN Gateway should be none for pfSense.  Your settings are correct.  What is the problem you are having?

What does Windows get when you bypass pfSense?

I forgot to add the even better way.  I just added it to the previous post. Using AP with vlan support and proper placed for best cover (you may need more than 1) and smart switch gives you the most flexibility in your network.

Actually there is no problem with updates when you change repo back to pfSense after installing desired packages ;) Also there is no problem to use forum search and find out how to do it on your own risk.

I upgraded to 2.3.3 with the new traffic graphs but the problem seem to remain. All Hope is gone now.

Realizing that I had a much more managable set of domains to enter into the default gui I decided to try these domains out one by one.  I was able to input all but the 2 at the top with the wildcard and the Google nameservers went unblocked.  The ones with the asterix gave this error: The following input errors were detected: A valid domain must be specified. Now maybe the issue with this new paired down list was the asterix, and it wasn't just Google's name servers that were being blocked but maybe EVERYTHING?  However, looking at my old 180 domain long list, there are no entries that begin with a wild card, but a few that end it one.  However, Testing this pared down version without asterixes still blocks google's name servers. Finally, I also tested with the redirect to 127.0.0.1 with the same results as 0.0.0.0 So I'm still curious why using the domains in a text file like you suggested @johnpoz is blocking Google nameservers (and possibly everything?) and also curious if I can use a wildcard symbol for domains in the default UI to accomplish "*.licenses.example.com"?

i actually stopped using freenas and moved to Ubuntu server (headless) and find Plex works a lot better on it and other features are supported

well I wasn't sure in which category to post. anyway, that's clear now. appreciate any help on the questions too! thanks.

Excellent idea. Thanks for all the advice!!  8)