"By not mixing T and U traffic on one IF it is likely more overseeable, don't you think?" To be honest I don't see it as an issue, while I completely agree with KISS and why over complicate things.  Not having any settings on a interface tends to confuse new users..  So if they can think of that as network ABC, and then adding vlans on top of that its pretty simple. But you have a talking point sure.  But then your doing it opposite to the end machines - you don't tag the port that end device is connected too.  if you do then you have to set the end device to understand the tag..  So no matter how you look at it your going to be running tagged and untagged when you start to vlan.  So how is it any different for your router vs your workstation.  Just in the router you need to tagg the traffic for the other vlan lans its routing, etc..

@roy2019: My switch just normal unmanaged Gigabit switches Then you need to replace it with a proper one.

Oh right, I forgot you have to authorize apps to access your Google stuff.  Thanks for the reminder.

Before we had a proper pkg building system someone must have hand configured the options for the version it pulled, I didn't see anywhere we set them. I pushed a change to fix the options up so it'll come through with the next update. pkg is smart enough to pick up that the options changed and it needs a nudge on the client side.

995kb/s is roughly 10GiB/day. If you want to limit bandwidth, then just use limiters to set to this. If you want to manage volume, then you're talking about data caps, not bandwidth.

Roger that.

It's a mystery. Packet capture I guess. If the SYN is going out with no SYN/ACK in return something upstream is blocking.

The error suggests that a process was unexpectedly killed. Were there no other errors nearby in the logs? The main system log perhaps? Given the choice, I would always pick HAProxy over relayd for any task that HAProxy can handle. The relayd balancer is OK for small/simple things but it's hard to beat the flexibility and reliability of HAProxy.

Thanks, I couldn't fine it.  The frequency of the beeps is somewhat dim for my hearing.  So I changed it to: beep -p 2860 20         sleep 0.1         beep -p 3050 20         sleep 0.1         beep -p 2860 20         sleep 0.1         beep -p 3050 20         sleep 1         beep -p 2860 20         sleep 0.1         beep -p 3050 20         sleep 0.1         beep -p 2860 20         sleep 0.1         beep -p 3050 20         sleep 1         beep -p 2860 20         sleep 0.1         beep -p 3050 20         sleep 0.1         beep -p 2860 20         sleep 0.1         beep -p 3050 20

A firewall is not a DDoS mitigation device. Some cases can be helped by a firewall, but as has been mentioned, it's a problem best solved upstream or with specialized hardware that is dedicated only to DDoS mitigation.

That's right. I have the luck that my server is in my network next to my pfSense router. That's why I can do it the easy way. My ISP - as many others others - simply block all outgoing connections to 'port 25' (smtp) except their own mail server. Before a couple of months my ISP was also blocking port 25. My solution was to call them and to ask if they would unblock the port and they did.  ;D cheers Kalle

is this possible or am I talking broken biscuits? For my domain users I push out a certificate from the Sonicwall to all domain computers via GPO so I can utilize DPI-SSL. Could I use this certificate on Pfsense Captive Portal so BYOD users have to accept it when they are presented with the CP? This way I could then capture SSL traffic

Many thanks! I found some good videos on youtube. I probably should look more often there. :) https://www.youtube.com/watch?v=xpXhudbsrr8 is a 3h introduction by a Microsoft guy into networking. There also is a (right now) 7-part introduction to pfSense, that is also quite good, though it is a little more of a reference video, going through all web-ui options one by one.

So you have pfsense running on this 2k16 box.  So pfsense wan is the interface that is exposed to the internet right? The setup openvpn on pfsense, vpn in and then you would have access to anything behind pfsense

Excellent. Thank you.

Nov 29 21:31:21 dpinger WAN_DHCP 99.233.16.1: Alarm latency 19857us stddev 24963us loss 22% Dunno, but 20+% packet loss is considered a down connection with dpinger default settings. You are having real issues with your ISP, it's not something that pfSense would be inventing. So yeah, disabling GW monitoring won't help obviously, the packets will still get lost and things won't work.