So we got everything working fine. When we use vpn we can connect to our server on opt1 and everything.

But now we want to get external access to our server using the opt1 interface.

But when we forward the port it doesn't work.

we want to forward a port to our server that is n opt1 interface.

example: external ip:poort x ->to our server that is connected to the opt1 interface

Veeam 9.5
vmtools installed
Not sure if quiescence was enabled, I've already scrapped that pfsense instance and deployed a new one, had to reconfigure everything from scratch

I don;t think it was a write issue, I had 30 days worth of backups and every single one of them had the same issue. I restored alreayd a few other pfsense firewalls and none had this issue restoring from Veeam.

Bear in mind this was one of the first pfsense devices I deployed like 4+ years ago so it could be that some update screwed it up.

I tried file level restore but I could not get the appliance working, as it was a urgent matter we just ended up reconfiguring it from scratch

You probably want to ask godaddy what they require for nsupdate on whatever service you have with them, then make the acme package do that.

https://github.com/gozoinks/unifi-pfsense.git

Yes, this is probably some setting on your TP-Link device breaking stuff. If you switch to using it purely as a wireless access point it will probably all start working again.
https://doc.pfsense.org/index.php/Use_an_existing_wireless_router_with_pfSense

But what happens when you ping one of the failing sites? Does it resolve to an IP? Does it try to connect and fail?

Steve

I don't know.  Are you getting errors or are you just curious about this specific directive?

@MPPurcell:

…it seems like you are implying that on a cheaper consumer router, the ports might actually be just switches…

Exactly that. Most SOHO style devices have a 5 port switch IC on board. Even if you kill the firmware so it's not running an OS at all it will still be a switch.

Many of them have some VLAN capability which allows some configuration of the ports separately but that is usually hidden from the user. You can often get additional functionality with alternative firmwares such as OpenWRT.
https://openwrt.org/docs/guide-user/network/vlan/switch

Steve

Thanks, maybe next time I'll try for an easier and less amusing alternative!

I was looking for the GUI built-in editor, I figured there must be something.  Like anything new there are too many choices and roads to go down, and for a Newbie at anything, even the most obvious things seem to be hidden.

Thanks to all of you for your help!

Michael

Got it!!!

Thanks for all the help and patience.

Got it and thanks for your reply.  :)

I have a 4 lan interface box very similar to this one:
https://www.amazon.com/Qotom-Q190G4-S01-celeron-Pfsense-firewall-router/dp/B01AAKGH88/ref=sr_1_5?ie=UTF8&qid=1525656793&sr=8-5&keywords=pfsense+network+box&dpID=51RsQ8C3R5L&preST=SY300_QL70&dpSrc=srch
I bought it just before pfSense announce the requirement for Hardware Encryption (AES-NI) in later releases :( … we'll see how long I can run with this one.
Thank you for the additional info and documentation! Helps a lot!!

I was thinking maybe there was some online service which transparently PAT'ed traffic or something

I have multiwan (load balancing) and when I create a rule for this site to use 1 gateway the problem solved

Thanks Alot  8)

This is not a pfSense problem. Check your local network.

What i do first is to review and check all connection cable from Switch HUb device and review one by one  unplugged and plugged it. then finally found the problem :)

so the problem is from the LAN1 LAN2 and LAN3 connected to same Switch HUB1,2 and 3 device so i removed LAN1 and connect to HUB1 Only and LAN2 to HUB2 Only same to LAN3 to HUB3

so HUB1, HUB2 and HUB3 are not connected to each other anymore then i tried LAN2 to access the shared folder from PC50 were the subnet is from LAN1 which is 192.168.1.10 whoaalllaaaa i get access denied

Thank you soooo much for giving me a time to understand and i learned so much guys

@MR-NT:

Dear Sir if you please can clarify this point

Ok :
@johnpoz=topic=123266.msg794665#msg794665:

Or they are doing dpi and notice that your ssl traffic is not typical ssl, but openvpn - that would be very rare, but can work around that with a stunnel and then openvpn inside the stunnel.

I was referring to setting a GATEWAY on the DNS SERVER configured in SYSTEM > GENERAL exactly as I stated.

This has nothing to do with the default gateway the firewall might have for general routing. In fact, it overrides this for THAT DNS SERVER ADDRESS.