thanks. how can i restrict access from one VLAN to the other, I need it such that clients connected to the guest vlan cannot even ping the corporate network

+1 for this being a feature in the GUI for selecting SSH and WebUI Ciphers and SSL/TLS versions. Did you end up requesting it in the bounty section couillard45682? If so, perhaps post the link in this thread so everyone can find it and give it a bump.

thanks for answering. esxi firewall off i use 1 vswitch in which i connect only 2 active phisicaly adaptors mgmt network connects directly to pfsense (172.20.10.1) vm's netwrok goes to a phisical switch (which connects to pfsense in anotehr port / different netwrok) ping form vmkernel to pfsense mgmt does'n work. will try to change something and update.

I know this post is old but did you find a fix for this? I am having the same issue now, when I run my pc just on the modem its all good but  when I hook up PF I get low speeds and packet loss.

Network Diagram attached. First line is IP second is GW, all is on /24 mask. Im trying to ping client pc1 and 2 from my laptop. at the moment, i can ping from both laptop and host pc, the pfsense vm, nothing further. I can also ping the laptop and the internet from the client pcs the router 192.168.0.1 has static routes set up to pfsense router, 192.168.0.2. When the wifi link between host pc and isp router is replaced for a cable, I can ping the client pcs from the laptop. when its on wifi, i cannot. Firewall settings on the isp router are turned off firewall settings on the PFsense is set to allow all on all interfaces [image: network.jpg] [image: network.jpg_thumb]

https://forum.pfsense.org/index.php?topic=109827.0

Squid is running but not enabled in the configuration. Do you suspect that causing the issue? I've stopped the service for now to test. -S

Thanks. Deployment went down without a glitch!

Provide more information. Hardware? Pfsense/ ISP modem configuration? I have 300/300 PPPoE over Ethernet working with near full speed including traffic limiters and shaping.

@Kahomono: I do need to be able to power these devices off and on.  When my devices power on, they default to 2015-01-01 00:00:00.  They are not synching successfully off the firewall.  I suspect the time adjustment they would need is too great so it's refusing to make it. Any way I can (A) confirm my suspicion and (B) make it happen anyway? Override of large time offsets has to be done on the client and cannot be done on the server. How this is done varies greatly by client. If you provide information on the client, someone here might have experience a similar device and be able to provide you with some guidance.

@divsys: I'm not a Minecraft/gamer aficianado by any means, but I would have thought you could simply provide a FQDN (eg. "thisisthegame.here.now") that would reference through DNS setup on pfSense to get you across the VLANS. So far, it seems to be working just fine with the bridge.  Typing FQDN for children on handheld devices might be a bit much for them.  Android complicates it more with their default hostnames that (sarcasm) seem to be deliberately constructed to test the buffer size limits of any DNS server. (I can control the DNS hostnames for the devices that "live" there, but not for the ones that are only guests.) I think (hope) they are moving away from the minecraft phase anyway, so once that's gone, I can drop the bridge. Another thought is to just write a quick daemon that listens for broadcasts on whatsoever port minecraft is using and retransmits the broadcasts on another interface.  (I'd have to do packet captures to figure out exactly what is being broadcast.)  A sort of broadcast forwarder.  (Actually, something like that might already exist… hmm..)  I'll freely admit that something like that would be COMPLETELY unsuitable for use on a larger LAN, but it might be a good learning experience for me even if it turns into a disaster.

Admin vs root was my issue.  Thanks to everyone who helped out.

you can sniff (packet capture, diag menu) on either wan interface or your interface your traffic enters pfsense for the IP of this pop3 server and port.  Prob need to update from the default limit of 100 packets and let it run for a while.  Then download that capture into your fav analyzer say wireshark and take a look see what is going on.

What radius server, the pfsense package or standalone.. I thought mac auth was not available til version 3.. Does it work in the current pfsense package which is only 2.2.9, how are you setting up the unifi controller to use radius if not on wpa enterprise? Oh your letting your switch set the vlan?  What is the point of that since your wifi traffic would not be tagged?  I don't see how your setup is of any use.. So user A gets on and is in vlan 100, how does user 2 get vlan 200 ??  If the switch is changing the vlan of the port? How do you then talk to the AP since the managment interface does not allow tagging and if you port on your switch changes its vlan based upon user mac.. I am confused.. Here is normal setup with unifi you can have untagged ssid, you can have ssid with a vlan tag or you can have radius determine the tag of the client on a ssid.  So you could run multiple users on same ssid with digger tagged vlans.  But the management interface of the AP does not do tagging and has to be on the native untagged vlan.  So I am confused how changing the vlan on the port connected to the AP from the switch allows for multiple tagged traffic? If you set unifi controller to wpa psk for a ssid you can not point it to a radius server even..  You can assign a vlan, when you go to enterprise then you can add radius server ip and port and then select to have radius control the vlan assignment of this connected user. I just confused how your getting mac based auth with unifi and wpa psk since you can not point to the radius.  If your letting the switch do it??  Your saying your switch can tagg traffic on the port based upon the mac??  That would be useful as well for my iot stuff..  What is the exact switch?  I have a cisco sg300 I will have to dig deeper into such a setting, I did not think that was even an option. [image: ssidvlans.jpg_thumb] [image: ssidvlans.jpg] [image: unifiradius.jpg] [image: unifiradius.jpg_thumb]

after reducing the squid memory to 10GB … no more swap memory usage .... Thanks you guys .....