@johnpoz said in Having trouble understanding the best way to connect pfSense to my environment:

are you not knowing how to create a lagg interface? But your switching environment needs to support the ability to do that.. Creating a lagg over non stacked switches can be problematic at best, etc.

I have Dell N2024 switches that are stacked. are you proposing to create LAG interface of type LACP and connect one port to switch 1 and the the other to switch 2? and do it from both master and backup?

@johnpoz said in Having trouble understanding the best way to connect pfSense to my environment:

They RDP over the public internet? - Again Ouch!

each company has fiber connection to the internet and vpn ipsec to the cloud.

@JKnott
It seems to be reporting status correctly. And I do only let it run for a minute or two before I plug it back in (afraid to let the pfSense appliance turn off without being shut down).

@bmeeks Checked that reddit post and everything looks to be as it should IPv4 is my default gateway and the address is correct. No LAN gateway configured.

Where exactly did you take those captures?

Found this thread and it seems to be a same issue, in thats its the same ISP

https://forum.netgate.com/topic/137434/pfsense-wan-keeps-disconnecting-out-every-10-mins/6

@ivor

I believe it's human being problem, which can happen with best of us, even with you, at some point. And I believe it's Great idea to add to the Great Product such as pfSense.

https://www.silabs.com/products/development-tools/software/usb-to-uart-bridge-vcp-drivers

find another machine

https://docs.netgate.com/pfsense/en/latest/solutions/sg-3100/

How about you read the original post again and this time understand it
I have pfsense up a running and it running just fine
I provided the hardware that I have it running on , I stated clearly that I have set up a VLAN on the pfsense box which has a wireless access point connected to which is working fine connected to a cisco sg350 managed switch

I simply stated that I plan to connect a PBX to the switch for a VOIP system that feeds back through the pfsense box to the internet

hi RHLinux

cpu is just around 20-30% usage, state is normal. no traffic shaping is being but a manual limiter has been set to each rule. already tested directly from each isp router and no problem found either.

This is absolutely ridiculous!

It's October 2019 and still happening to me right now!

Un friggen believable.

@MaxBishop
What you need to do first, before becoming too concerned, is to look in the Suricata alerts and see what internal machine or machines are initiating that traffic. If your firewall is configured as it should be, then nothing can just "come in" from the WAN unless an internal host opened the initial connection. That's how stateful inspection firewalls operate.

If you have Suricata on the WAN and are using NAT, then finding the internal host is going to be hard. That's why, when using NAT, you should instead run Suricata on the LAN. That way internal hosts will show in alerts with their actual IP address instead of being "NAT'd" to the WAN IP.

Odds are you are correct and these are simply Windows clients downloading security updates. That particular set of Emerging Threats rules is not really to useful on most networks because the rules will false positive frequently. They really are more appropriate in an enterprise network when you run an internal update server such as someting like Microsoft's WSUS. In that case, if you ever had clients downloading an EXE or DLL file from the Internet, it could be potentially bad (but even then, not always bad).

Capture.PNG
I already deleted the rule on WAN. I'm looking at the link you posted and this is my firewall log.

After rebooting it works now. So, if anyone has this problem rebooting might help. Thank you guys.

Here, on twitter, Reddit, etc. I'm sure. I've passed along the info internally, so hopefully we can head off some of the impending tsunami.

Anything in your System log?

General pfSense Questions.

thank you

@kiokoman said in How Can I Mount a Drive when Booting from the Install USB:

mount -u / # re-mount root as read/write
If it's a ZFS system you may need to run zfs mount -a

Does the file system of the install disk permit this?

@johnpoz Thank you sir!