I have a number of physical networks and VLANs all working happily with vswitches in pfSense running inside ESXi.

Maybe it would help us to help you if you told us the IPs for each of the networks.  I'm having trouble understanding why you have physical port + VLAN for the same networks eg LAN & Wifi.  Your most recent description of what you want to achieve is different to your original post.  The more detail you give us, the easier it will be for us to understand what you are trying to do and then help you.

Why don't you put your ISP's DNS servers into the DHCP server settings?  Then all of the clients would use those DNS servers.

And if you're not running internal DNS, why does it really matter which DNS servers you're using?

Did you Google solutions?

https://serverfault.com/questions/318563/how-to-push-my-own-dns-server-to-openvpn

It's better to use a monitoring agent tailored for monitoring. Whether that is the built-in SNMP daemon, the NET-SNMP package, Zabbix Agent, or NRPE is up to whatever you use as a monitoring/alerting system.

Thanks for the fast analysis!
We'll run a memtest on the machine and look into replacing the box with modern hardware in the foreseeable future.

@vronp:

@Derelict:

I had to replace the realtek daughtercard in my old jetway because of the same sort of thing. It would seemingly go deaf and would manifest itself as failed DHCP renewals from the cable modem.

Same router, same slot, but an intel daughtercard and I never saw it again.

One of those anecdotal stories about realtek.

(I did packet capture prior to swapping it out and the modem/isp were doing everything they should be doing.)

Ugh….  Since your post I've done a lot more research and now see that Realtek NICs are a major issue.  Unfortunately, I've got a small single-board computer with NICs on the board.....

Just to cap off this thread…..I've found some mention of a v1.93 driver that may have improved things....

What you describe isn't a "true transparent bridge" but a "half bridge".

And currently pfSense cannot act in that role.

What's coming in on WAN cannot come in on LAN as well. It has to leave the unit, doesn't it?
If traffic enters on both interfaces then you have a NAS.

@Spectrum48k:

I suppose it's future proof - my ISP here in the UK keeps doubling my speed at no extra cost. Its going up 50Mbps to 100Mbps soon, so I'm guessing in a year or two an i3 might be ideal, although they do a J1900 Celeron too? Might check out the TDP figures and see what's the best fit.

Tried looking for just a motherboard with dual intel LAN which ARE about, ie the H270N and H270M from Asrock and Gigabyte, but then you need to find a low TDP processor and looking through the latest Skylake and Kaby Lake, they all seem to start at 35W. Why did Intel abandon the Atom? I wonder how long til we see an ARM based board with dual LAN, pushing 100Mbps?

In 10 years it'll still be overkill.  The specs in my sig were running 2 x 1Gb LAN links, and 2 x 100Mb WAN links.  A persistent SSL site-to-site VPN tunnel, VPN connections, several web servers, and dozens of users behind it.  Several pfSense packages and some creative policies/routing too.  The CPU never went above 15% at any time.  And it was a dual-core CPU.

If you use pfsense as your internet router and not only some captive portal setup - then yes it would need to be on to access the internet ;)  But why would you want to turn it off every day?  Unless you have it on some way over powered machine it would use very min power.  Something like the sg-1000 could be used for a small office and its power draw is

Power Consumption 2.5W (idle)

Its bigger brother the sg-2220
Power Consumption 6W (idle)

Even bigger brother the sg-2440
Power Consumption 7W (idle)

There should be little reason to not leave any of these on over night..  Your talking less, like half that of the power draw of LED bulb…  At the 7W mark, and high cost of 0.12 cents per Kwh your talking like 7 dollars a year to run...

If the cost was 10 times that it wouldn't be worth the effort of turning it off and on every night ;)

@Cyberben:

I can use my browser to get to the machine through WAN/dhcp.

When you setup a router / firewall device, you hook yourself up for initial setup using a local serial port (could be a serial over USB), or a dedicated NIC, or, by default, the future LAN NIC.
Never ever the future WAN port.
That goes for pfSense and any other device on this planet.

Knowing this, you will find this :
@Cyberben:

I simply tell the machine there is a LAN NIC I loose connectivity to WebGUI.

… normal.

"ftp server is IBM mainframe and that's location is in our main office. "

Then why would you be natting inside your own company?  So you running what OS z/OS?  sftp (ssh) is available on pretty much every OS on the planet..

"those force us to use cmd ftp to get some files"

Not really no..  there are many ftp clients you could run on windows that allow for scripting that support way more features than the built in cmd.. If your using active then install ftp active package for pfsense for your clients behind pfsense..

https://forum.pfsense.org/index.php?topic=89841.0

ftpclientproxy.png
ftpclientproxy.png_thumb

Did you solve this? just got the tg-789 (fttn) trying to bridge it.

UPDATE
By using IPv4 Configuration Type DHCP it now connects however the gateway shows offline

WAN_PPPOE IPADDRESS 0.0ms 0.0ms 100% Offline

@xenu:

I have a UPS connected to my NAS box, and it runs nut.
I have pfsense UPS configuration set to : "Remote NUT server".

The problem is if I have a quick blip where the power goes out for a few seconds and returns, the pfsense box shuts itself down.

The shutdown timing is controlled by the NUT master server. Some UPSs have an issue where they send a low battery notification almost immediately after going on battery which will trigger slaves to shutdown. To change this, you need to set ignorelb on the master server.

See 'ignorelb' in the ups.conf man page.