I am assuming you have (or will have) some way of determining from the client MAC address which DHCP clients in Norway should go through Amsterdam.

I am assuming (since I won't have access to my own pfSense boxes until next week so I can't currently check) that the recently introduced DHCP Pools feature will allow clients to be assigned different gateways based on their MAC addresses and this could be used in the Norway DHCP server to direct clients to the appropriate gateway. See the Sticky note in the "2.1 Snapshot" forum for more information about DHCP server pools. This will only work on all clients if the gateway is on the same subnet as the client. If that is not the case, then I think you can add firewall rules so traffic from a particular client get redirected to a gateway out a particular interface. This feature will be easier to manage if the client IP addresses fit neatly into a subnet (e.g. a /27 subnet of the LAN subnet).

I suspect you won't, in the long term, want clients' DHCP server to be at a remote site. (You probably won't want DHCP to be dependent on a WAN link.)

The external modem is also easier to swap. They don't actually require a lightning strike to get fried, so I prefer to always keep a spare modem on the shelf.

I can even explain a "dumb user" how to swap modems if the internet failed after "something started to smell funny".

I would use virtual interfaces and let hyper-v handle VLAN. Just assign once VLAN to a different virtual switch and put an interface in there for pfsense.
I would imagine you could do it the way you are describing, but I just don't know.

What version is that on?

The CPU being taken by "system" implies that it's being used by pf for packet processing or similar, or in some cases, the GUI.

If this is on 2.0.2, move to 2.0.3 and it should be better: http://forum.pfsense.org/index.php/topic,58203.0.html

Glad I could help.

you are now using your wireless AP as a switch instead of a router. That puts everybody one the 192.168.1.0/24 subnet and gets rid of the 192.168.0.0/24 subnet.

Thank you very much.

R

If you don't create a management vlan on pfsense then you won't be able to access/route-to the devices on the m. vlan without creating a vlan adapter on the source device found on the regular lan. Though this isn't really an issue with a small number of devices.

As I recently found out, L3 switches will not route onto the m.vlan so all management devices need to be on the m.vlan.

Also, careful with esxi and vsphere. My grand master plan with management, iscsi multipath & data vlans meant a reset to defaults and reconfiguration from scratch! (So you might want to do this over a weekend)

Thanks jimp!

I was hoping for some technical details. But a no is better than nothing :)
Im not using polling, tried it and the GUI and became completely unresponsive on ALIX hardware.
How about traffic shaping? Does kern.hz has an impact on the, say, "precision" of the traffic shaper?
Is powersavings the only reason you default to 100Hz on embedded systems?

Solved - I think!!

It appears that the problem has been solved - although I will wait a few days before final confirmation.

The solution - if it was the cause - was for the ISP in Australia to put a check mark (i.e. enable) in the "force MTU" option in the exchange.

I have no idea how / why this would cause the strange problem - but so far it appears to have fixed it.

I will mark the thread "Solved" once I have verified over a few days.

search the forum. This has been discussed trillions of times

see: http://forum.pfsense.org/index.php?action=search2;params=YWR2YW5jZWR8J3wwfCJ8YnJkfCd8M3wifHNob3dfY29tcGxldGV8J3x8InxzdWJqZWN0X29ubHl8J3x8Inxzb3J0fCd8cmVsZXZhbmNlfCJ8c29ydF9kaXJ8J3xkZXNjfCJ8c2VhcmNofCd8ZmFjZWJvb2s=

Hmm, I don't know why that isn't working. I use an almost identical setup at home and it works no problem. Did you change the protocol to 'any'?

How do you have external access setup to the CCTV system?
You would normally use port-forwarding on one WAN to do it. In that situation The URL on which external clients connect to the CCTV box will only ever point to one WAN. It should not make any difference to external clients even if you can't use policy based routing.

And the reason you're using 20.0.0.* is…..?

Steve

thanks for this valuable info.

by installing from pfsense web interface, zabbix_agend restarts automatically after reboot.

You should be okay with the 2.1 beta, but it is a beta, so keep that in mind.

I chose the 2.0.3 update to minimize any risk I may be inflicting on my network.  However, there are people using 2.1 in production with excellent results.  I am too risk averse and stayed conservative with the 2.0.3 release.

Thanks so much!

Unselecting any interface under "Services –-> NTP" solved the Unreach/Pending issue and my clients are able to sync with the pfSense NTP Server.

you are going to have to supply a lot more info. (logs / hardware info / …)

@dhatz:

The Open ERP server may eventually have to be carefully public facing if I need to review data from home once the business is running, but I might be able to do this with VPN.

Always go the VPN route.

So far I am able to access the internet from LAN, and Wifi. I can print to all of my printers from LAN, but not wifi yet. I've been hitting my head against the wall with the captive portal setup, but I haven't spent much time trying to get it to work yet.

For your Wifi needs, use an external Wireless Access Point that will allow you to setup two WLANs / SSIDs (one for your own use and the second one for customers/CP) and pass them two separate VLANs. Unless you're doing this for educational reasons, you might consider avoiding the setup of a CP, and just change the password on the customers' WLAN once every few weeks.

I will go the VPN route, thanks for confirming that's the best way.

The Wireless access point is http://www.versatek.com/products-and-solutions/wireless/indoor-access-points/vx-ap400pro-high-power-400mw-wireless-ap.html
So I guess I should source a cheap managed switch from Ebay and figure out how to use it after all. Major problem is that finding a reasonably priced wall wart for that access point is proving to be a challenge, and POE injectors I can't seem to find anything but very expensive ones that say they are fully 802.3af compliant. All the cheap ones I can find don't seem to list their specifications. And of course my POE switch isn't managed, so I don't think I can run multiple vlans through that for the access point.

I'm almost hell bent on using the captive portal to limit bandwidth usage, terms of service agreement, hard time limit, device logging, and so on so they would have to reconnect, etc. just to help prevent abuse and help limit my liability if someone managed to do something nasty over my network. It will also be instructional for me, in case further business ventures require that knowledge such as a net-caffe or something like that.
Sorry I'm all on about "cheap" but right now my financial situation calls for that, because business funding is not available at the moment.
(Edit: I probably should have checked Versatek's site before saying that about the POE injectors. They have one that will work for my needs at a very reasonable price)

On WAN alone is adequate, we enable MSS clamping to prevent TCP from being bigger than that.

I've been noticing the same issues, due to the unconstrained growth of the tcpdump process.    I'm running the Feb 4th snapshot, so I do have the -S flag.

I filed a bug report: https://redmine.pfsense.org/issues/2819