https://doc.pfsense.org/index.php/Installing_FreeBSD_Packages

Update: It appears that the current Netgate image of pfSense, with it's "AWS VPC VPN Wizard", configures the IPSec connections in a way that is no longer compatible with AWS. I guess AWS changed something since this wizard was created. AWS said that both tunnels created by the pfSense wizard should not be active at the same time, and that one should be in standby. I opened a ticket with Netgate support about this on May 4th, and hope to get this resolved before too long.

Status, Monitoring. Use the wrench icon to configure. Status, system logs, click on the funnel icon top right.

Well that is useless switch.. Either get a 2nd dumb switch or get a smart one that support vlans so you can isolate your 2 wan connections and put them on different networks.. Why do you have them connected to a switch anyway.  Can you not just directly connect your isp device to pfsense interface? If possible bridge this isp device so you directly get a public IP on pfsense.  Or use 2 different transit networks.. BTW - work updated to visio 2013, wow the icons are ugly ;) [image: 2wans.png] [image: 2wans.png_thumb]

[image: crystal_ball.jpg] I see something else between pfsense and ISP, what is that? Is it modem?

That's a traditional symlink on FreeBSD systems to the source tree.

Hi wildmanron thanks for your evidence. I hope someone (or maybe developers?) can help us.. Alessandro

Some potential locations might be… /etc/YourScriptsDir/... /usr/local/libexec/YourScriptsDir/... /YourScriptsDir/... Typically it's been my experience that non pfSense files don't seem to be overwritten or removed by updates. Don't use /var/... if nano install or RAM disk is ever enabled.  It will be wiped out.  Potentially even with just a reboot. I'm sure the WAN IP could probably be obtained via a function call somewhere.  But the address stored in /var/db/wan_ip may suffice for your needs. (the file name may be different if not using the default WAN interface name)

@phil.davis: If you are happy editing XML manually and keeping all the start/end tags correct etc., then you can always backup your config keep the original so you can revert back if (when?) you stuff it up edit a copy, find the relevant entries and modify the data or move the entries… as needed restore the edited config let it reboot and test There is no official "pfSense config XML" spec or parser/checker other than what happens at boot. But the format of the XML data hierarchy is pretty obvious, specially if you do a few example changes on the webGUI then backup the config and have a look in it. I did, done it and it worked. Must admit I held my breath, used Ultraedit to export the <staticmap>s that I wanted, then saved it as a new .xml file so I could use the colourization for xml, used find & replace, then inserted the file back into the predefined opt I had already setup. Very pleased with the result. So thanks phil.davis for the confirmation.</staticmap>

EDIT: This is working. Problem was wrongly configured management in switch.

Technically you should allow "ICMP type 3 code 4" (Destination Unreachable, Fragmentation needed but DF bit set) messages in on your WAN to be able to connect to sites that have reduced MTU for whatever reason. However that's not the only solution and for most of the connections the other solutions will solve the issue for you without having to the open holes in your firewall: https://blog.cloudflare.com/path-mtu-discovery-in-practice/

VPN doesn't need a managed switch. You only need a managed switch that supports VLANs if you want to do it all with only one NIC on your router.