Bridge is functionally equivalent to a switch but of course when you have a filtering bridge there's also the possibility to filter the traffic. The hosts that are on the same side of the bridge can talk to each other without going trough the bridge. However, all broadcast traffic still traverses the bridge regardless, for example ARP naturally must be able to do this to reach any host on the same "logical" network segment.

This topic should contain the solution for any configuration restores which left 'ghost' packages: https://forum.pfsense.org/index.php?topic=112151.0

Gateway logs, lots of WAN_DHCP, WAN_DHCPv6, Sendto error: 55/65s [image: gatewaylog.JPG] [image: gatewaylog.JPG_thumb]

The AP's are not set for multiple SSID, so the employees would connect via one set of AP's and the guests via another. Ah, ok that was not really clear to me in the opening post from you. Then the Ports need not to be "tagged" with one SSID only. Also the pfsense handles the DHCP for both subnets Yes.

The graphs looks nice… I wonder if you'll have a way to specify the "First Day Of The Month" for calculations to begin?  That would be a VERY important feature for people who needs to monitor their monthly caps. And backup/restore of the data.

Excellent, thank you!  :)

Well you are not alone!  I have the same ECS kbn-I 2100 motherboard and (2x4GB ram) and a dual port intel 1Gb NIC.  This setup is NOT stable to say the least.  The post above states that this motherboard/chipset is not supported though the post below made me purchase it in the first place: https://forum.pfsense.org/index.php?topic=69969.0 In any case my WAN seems to go down randomly and is plagued with kernel panics and reboots.  The poster mentions disabling ACPI (but really doesn't say where) since this can be done in pfsense and in the MB BIOS.  Disabling ACPI in the bios does nothing, however disabling ACPI in pfsense causes system NOT to boot.  Since this motherboard was only like 20 bucks I really don't care but now looking to see about a different MB since it appears this one is not it.  If anyone has any info please update with your experience. Thanks

@slu: Can someone explain me why my Out is the double of the In traffic? Because twice the number of bits are egressing than are ingressing on the interface.

I also just tried: System: Advanced: Firewall and NAT, called Static route filtering – Bypass firewall rules for traffic on the same interface. Still no go

that doesn't seem to matter … its a appears to be a general issue: https://forum.pfsense.org/index.php?topic=111108.msg626013#msg626013

And my problem remains the same!

I've also heard of people on other systems using scripts that ping a target and when the ping goes high, it starts to clamp down on the traffic shaper. Because traffic shaping is almost only useful if you're the slowest link. If your ISP is not giving you enough bandwidth, then that is no longer true.

I can't think of why this happened but I reformatted the disk and reinstalled pfsense. Worked like a charm!

Packet capture at the client to see where the web traffic is actually going. I suspect that only some of the traffic is going through the tunnel, such as maybe DNS and that is the WAN traffic being seen.  But the web traffic is using the local internet connection instead of the tunnel.

Attached is another screenshot of the log. Could there be anything other than the firewall that could be causing the problems I'm running into? [image: log3.png] [image: log3.png_thumb]

No, not possible with just standard NAT. The reason is that PF has no means to inspect the payloads of the data packets that are flowing trough the packet filter, to do redirections based on the destination hostname part of the HTTP headers you'd have to know what's inside those payloads.