@netboy Never mind.... This worked. Removed CNAME x.mydomain.com Configured Dynamic DNS in google domain for x.mydomain.com Used pfsense SERVICES -> DYNAMIC DNS and selected "google domains" and entered username and password and voila x.mydomain.com works and points to my server Sorry for the confusing post.

After some discussion with their support they disabled CGNAT for me. :-) -Rico

@gertjan said in How to detect P2P traffic and block it using pfSense: I still doubt that a app on some pc somewhere on some LAN will 'cooperate' by having it's activity detect by some upstream device running snort and the OpenAppID detector. I should really try it out, as I have, in theory, a device (4100 MAX) that would be able to do so. It is a cat and mouse game between the p2p software developers and the IDS/IPS Layer 7 detection software developers. The goal of p2p is to "elude" detection, and the goal of stuff like OpenAppID is to "detect" p2p. Currently there are some things that do still happen in the clear during initial session setup, and that allows detection. Of course tomorrow some p2p variant will make a change to foil that detection, and then the OpenAppID folks will respond. So, back and forth the game continues.

@johnpoz No it's not that not sure how that got there.

@vpittman One other thing is with a VLAN, you could give VoIP priority over other traffic. However, that's not much of an issue these days, with Gb switches.

Problem resolved : https://redmine.pfsense.org/issues/12834 You can install the System Patches package and then apply this patch directly from the built-in Recommended Patches list. The patch is available in the System Patches package version 2.0_4 or later, no need to create a manual entry.

@stephenw10 appreciate you Stephen. Thanks for all the support !

You can't NAT on an IPSec tunnel like that. If you need to NATyou have to use the BI-NAT field in the Phase 2 setup. https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/phase-2-nat.html Assuming this is a policy based tunnel (not VTI). Steve

@stephenw10 Thanks a lot Steve!!!!

Nice work! It's probably because of the latency difference. With local transfers the latency is so low you can see the full bandwidth with a single TCP connection. SMB is notoriously latency sensitive. It looks like multichannel works around that to some extent. Steve

ive personally have issues with bandwidthd not reporting data on top talkers. https://forum.netgate.com/topic/177849/bandwidthd-not-capturing-any-toptalkers ntopng always works but its hard on the ssd with lots of flows happening.

@qcezwadxs said in 10 Mbps DL (from 980 Mbps) after upgrade to Netgate 6100: @plawlor What is the make/model of the SPF+ 10G RJ45 modules? Please and Thank You. 10Gtek ASF-10G-T

Forwarded it from where to where? If you're testing from a VM behind pfSense and that VM is using pfSense for DNS then adding host override there will work.

@bmeeks Thank you very much for your help, you mentioned the points I needed to hear. I will investigate and work on the matter. Regards.

It uses the SSH key. See: https://forum.netgate.com/topic/150789/update-ssh-public-key

You can open a Correction in pfSense Docs in the redmine. Or open something marked as new content. Steve

Depending on how the remote router is configured you might be able to use the hostname to access the 1100 OpenVPN interface. it would need to be setup to resolve OpenVPN clients. You can always setup multiple port forwards with different incoming ports if you need to access several hosts behind the 1100. Steve

@cool_corona Try installing the bandwidthd package. "BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each IP address's utilization can be logged out in CDF format, or to a backend database server. HTTP, TCP, UDP, ICMP, VPN, and P2P traffic are color coded."

@artooro It seems that you are correct...learned something new today...thank you for sharing. "Yes, a domain can have multiple A records. This is known as "round-robin DNS" and it allows multiple IP addresses to be associated with a single domain name. When a client requests the IP address for the domain name, the DNS server will rotate through the list of IP addresses in the A records and return a different IP address each time. This can be used to distribute traffic across multiple servers or to provide failover in the event that one server becomes unavailable."