@JKnott: I'd expect you'd have trouble finding a computer that could keep up with 100 Gb.  High bandwidth network gear generally uses a lot of custom hardware to handle the processing. PCI Express lanes are the real problem requiring X16, we have found a motherboard/cpu combo that has no problem pushing 100gbps.  SuperMicro X10SRi-F Motherboard with a Intel Xeon E5-1630v3 is capable of doing so.  So don't be afraid to try different things, this is the current configuration for our 100G test nodes.  We currently have Mellanox, Broadcomm, and QLogic NICs in the field.  Though the Mellanox has proven to be the more stable card at the moment (bleeding edge can be interesting at times). @ivor: Current pfSense architecture will be the biggest limitation in achieving such speeds. We have demoed next gen "3.0" which is capable of doing 40Gbps IPsec, so far. We intend to demonstrate 100Gbps IPsec in the following months. Here's the talk on it by our Jim Thompson https://twitter.com/NetgateUSA/status/923994053015982080 Thank you, I'll give that a look.  We are jumping from 10g to 100g and skipping 40g (probably)

Are you certain it's that mouse and not a virtual connection from the virtual console (does that have a DRAC?)

You will get more knowledgeable eyeballs looking at your post if you post your question to the Traffic Shaping forum.

Create your pfSense instance with WAN NIC being bridged to LAN and LAN NIC being internal intnet1. For your Ubuntu client, make his NIC internal intnet1 For your Kali client, make his NIC bridged to your LAN. If you want to play with a DMZ, create another NIC on pfSense, internal intnet2 and another client also on intnet2. Looking at your IP assignments, you can't have your WAN and LAN on the same network which they currently are.  That will never work.  Your WAN is going to be bridged to LAN so he should have an IP address in the same network as your real LAN. Make your life easier and use clearly different subnets, like 192.168.1.0/24 for WAN and 10.0.0.0/24 for LAN. Like this: [image: vbox-pfsense.png] [image: vbox-pfsense.png_thumb]

Yes, PFSense is aware of the issue. Bug #7928

Looks to me like the router is detecting an outage and attempting to restart services to bring it backup.  Since dpinger is showing the latency I wouldn't suspect it to be one of the other services unless you are pegged at 100% utilization on the box (which you aren't).  +1 for piBa's suggestion to check the quality graphs.  I suspect you'll see latency and packet loss in there.  See if they correlate to anything in the traffic graphs.  In certain instances maxing out your upload can cause it as well if the gateway is too busy processing packets to respond to an arp command from the router.  I would suspect the cpu spikes are an effect of the outage and not the cause.  The graphs and logs will point to which is which.

Guys, Please see my post here to disable vlan1.  It is on page#5 https://forum.pfsense.org/index.php?topic=123324.msg763557#msg763557

Intel CPU's don't start self-throttling until 100c and don't shutdown until 110c. I had a GPU that run at 105c-108c while gaming, I played about 6-12 hours of games per day, and I gave that card to my brother after using it for 6 years. There are really only two things you want to keep cool in your computer. Your HDs and your memory. That being said, below 50c is pretty much safe for anything and above 70c typically means something is wrong with the cooling. If you can touch the component without burning yourself, it's fine.

@BlueKobold: the box is providing internet via ipsec from another pfesnse box. And all Internet traffic is going through the other box? And all DHCP and DNS entries must be cached and for caching they must be stored too, perhaps on one end to less RAM available? i used this guide to route internet to our main site, so only ipsec traffic is leaving the firewall that is crashing. https://doc.pfsense.org/index.php/Routing_internet_traffic_through_a_site-to-site_IPsec_tunnel

What part did you try and is not working?  So you did a packet capture on your wan and show the traffic getting there? Love to help you but without more info impossible to even guess where the problem is.

"which turned out to have basic core switch capability" Any switch could be your core to be honest.. It doesn't have to do routing, etc.  It could be a dumb switch.. The nutshell of the access, distribution, core is just a pyramid way of looking at how you fan out your network from the edge to the devices. Such a layout as attached, be it all dumb switches could be seen as top switch as core, middle as distribution and bottom row as access.  With your devices connected to the access layer. It for sure can get way more complicated than that, and normally there is stacks with redundant connections, etc.  If all you have is access switches directly connected to pfsense then pfsense becomes your combo core/distribution layer, etc.  Or you could look at it like you don't have the core or the distribution layer, etc. [image: access-dist-core.png] [image: access-dist-core.png_thumb]

Thank you bartkowski. I will look into these and see how I can accomplish what I need to do.

Thanks. I have tried that to no avail. I'll have to keep looking tomorrow and try to work out what has changed over the weekend.

Thank you for the info, but the problem is the same regardless of the browser used. Mozilla firefox or Internet explorer

@gelcom: Thanks for the reply! I believe it's easy to get SFP specs to match ONT's specs. From an educational point of view how is it possible to configure pfSense to act like this (or any other) ONT? As I mentioned, that ONT is very likely the demarcation point between you and the ISP.  It will have functions such as status monitoring, configuration and more that your ISP expects to be there.  You can't replicate that with pfSense or anything else.  It's part of the ISPs network and you just can't remove it.  Also, in many areas, regulations require a demark point, so you're not allowed to remove it.  In my work, I have set up many customers on fibre.  There was always a piece of equipment, owned by the carrier or ISP that was the demark.  There were even 2, where one carrier was providing service for another.  There might also be VLANs or MPLS involved.  That box is an essential part of your connection.  Don't remove it.

stuff on the same lan doesn't pass your router/firewall …. if you put your nas on a different interface & run a reverse proxy, you could work around your "issue" personally i'd just create a bookmark/favorite .... but thats just me