Darn it I found the problem! I had entered a VIP on the interface with a netmask of /24! Doh! I've removed that and am now somewhere nearer getting it all working. Thanks for the help. Bails

Somebody know how fix this error?

So does the router have to be on its own port or will it work off my current switch?

@johnpoz: "VLANs are not for isolation or security" "just use the firewall rules to block attempts to communicate within the network" Huh??  Vlans are very much so for isolation and security ;)  When your route the vlans through a firewall like pfsense, or via a L3 switch with ACL's applied.. How exactly is the firewall (pfsense) going to stop devices in the same network/vlan from talking amongst themselves? Hah :) Wow, that'll learn me for drive-by commenting. No idea what I was thinking in regards to those two statements! Disregard..! But the inability to scale well for this scenario still applies.

In my example, I was pulling the cable from WAN2 port which is not the default gateway. When this occurs, I can't log into the GUI so I am actually establishing a new connection to the GUI. My WAN2 connection is a satellite link which has high latency to very high latency. I have attempted to change the monitoring settings to compensate. Nevertheless, the alternate WAN2 gateway can get marked down multiple times a day and sometimes multiple times an hour. But again, this is not the default gateway. Perhaps I should attempt to adjust it more. Currently have WAN2 removed and just running a day or so without it in the mix and see what happens. Thanks for the information, this certainly gives me something else to check. At the end of the day I hope to have the DSL on WAN1 and the Satellite link on WAN2. The only time WAN2 gets used would be if WAN2 goes down. I know it's not ideal setup but we are out in the middle of nowhere and that is all we have for Internet. No Cable anywhere in the area. Mark

https://doc.pfsense.org/index.php/OpenVPN_Remote_Access_Server Or are you talking about connecting pfsense as a client to some VPN service you have purchased or run somewhere else?

@Chrismallia: Throw out the router and buy a dedicated AP In larger professional environments I would agree but in any application where budget is a concern, routers often offer better bang for the buck. In SOHO applications, where budgets are often very tight, the additional switch ports are also often useful additions. It's very simple: If the router have an AP mode (as the router in this thread have with original firmware) - use that and connect to any port. If the router doesn't have an AP mode - don't connect anything to the WAN port and disable the DHCP server (if another DHCP server is already present in the network).

Nothing definite unfortunately. Typically you would see a watchdog timeout error from one of the msk NICs on the console. You might try leaving a serial console connected to see it anything is shown. Did you see this without the modified drivers? I've no idea what those were compiled against or what changes went into them. I didn't compile those 10.X modules. Steve

"class c ip adress dmz" Is that public or rfc1918? Do devices behind pfsense (that I take it you are calling ps box) access stuff in the dmz? But yes normally how you access something like a AP from remote would be with a vpn.  Do your AP have gateways set pointing to pfsense?

https://forum.pfsense.org/index.php?topic=113842.msg632969#msg632969

Ive also come across this, but I still have internet on all the pc's [image: PFSense.png] [image: PFSense.png_thumb]

@xlameee: I already checked the vpn settings they are OK Well you say that, but it isn't working and you haven't posted your VPN configuration or really any details at all so I'm doubting that you have it all set up properly. Also, you named your interface VPN_LAN, do you have a normal LAN? Are you using a VPN server or client? What are your firewall rules? What are your NAT rules? Is there any useful output in your logs? You said it was working for 8 months, what changed? Did it just stop working one day? If so there is probably something useful in your logs. We need details if you want help. A list of your interfaces and saying you can't ping stuff doesn't mean anything.