Hi hsale, Disabling ACPI in BIOS worked for me. Anyhow "Thermal Sensors" monitoring wouldn't work.

@cmb: @firewalluser: Govt's especially the military have far greater resources than most businesses. Which was exactly my point. They also likely wouldn't be so sloppy about it as to get caught repeatedly. You have to be deploying systems over and over again with the same security hole(s) that eventually someone scanning finds and owns. Unless you're a high profile target, no one's going to waste a high value 0 day on you. Every time you use it, it's more likely to be found out. Who needs a 0 day as you rightly point out below, but then do you buy the stories the Govt dont have the money for xyz? @firewalluser: I think that only one device namely a rpi was used to access and configure pfsense on the default lan and all other additional nics to internal machines had to be enabled to the extent I have detailed here https://forum.pfsense.org/index.php?topic=92804.msg517267#msg517267 would suggest reasonable precautions had been taken? I would call that reasonable precautions. That's far better than most people. Still plenty of ways to be compromised. Some incident response definitely would be justified to figure out how that's happening to you. Well if my hd's with packet capture data and others werent being trashed I'd be able to provide something, unfortunately my hd's keep being trashed, making it difficult to provide any such data for analysis. But if you needed a backdoor into a system, hardware is where I'd put it as its virtually impossible to inspect as this vid explains from 2007. https://www.youtube.com/watch?v=VV_v_OEOhH0 Wake on lan has been around years since 1996. http://en.wikipedia.org/wiki/Wake-on-LAN#History So do you (or anyone else*) have any suggestions to overcome the hw issues? Apart from using older hw and perhaps usb nics (although some would suggest not using them) I dont have any other ideas to avoid getting hacked which could prove the hacking methods used especially considering this post of mine from earlier on in the year. https://forum.pfsense.org/index.php?topic=88180.msg486376#msg486376 *Like I said to Kejianshi, the logical thing to do is unplug from the net.

I turned off ipv6 (deselect allow ipv6), and now firewall logging is working fine.  ???

@hal99: I asked in case it had any restriction or the wireless card has something else weird that prevents you from changing the MAC. The only situation where I've ever heard of MAC spoofing being a problem is on a minority of the crap Realtek 8139 100 Mb NICs. Even then it works, but you have to keep the NIC in promiscuous mode all the time for it to function with a MAC other than its own. The NICs we sell, wired or wireless, certainly won't have any such issues. @firewalluser: Without all the data how can you form a judgement? It's really far-fetched to think there are wifi exploits out there so awesome they can own you through the air (a type of vulnerability that's proven very rare to date), but so lame they're foiled by changing your MAC address.

There's a very good chance that drive is dead. You can try a reinstall, but that's about as low level of a failure as you'll see short of the drive not being detected at all. I'd run the HD diag tool from the vendor of the hard drive first, and only reinstall if thorough tests come back clean.

@wifiuk: I'm assuming 2.2.2 fixes these? from that link: "Solution: Update to pfSense 2.2.1" 2.2.1 fixed that one.

If you can see some sort of notice in the logs, perhaps one method would be to use some browser automation like http://www.seleniumhq.org/ to log in and check every few minutes, download the log, parse it and if error message is detected raise an alert via a variety of means beit email, phone or text. https://freeswitch.org/ could help you raise the alerts quite easily and runs on a few OS's. fwiw.

WTH is DNS probe? Did you install some "helpful" plugin? Ping pfSense by IP works? Ping 8.8.8.8 works? Ping www.google.com works? traceroute, nslookup? No info here.

If you never created one, it's not there. If you need to put something there, create the file.

Some thoughts. Anything capable of running software of sorts, beit your computer, firewall, mobile phone, printer, photocopier, TV's, vehicles's etc with the ability to update it with new versions of software has the potential to be hacked. With that in mind, the next question is how easy is it to update? TV's can be updated over the air, some vehicles & phones similarly; now in the case of computer networks, you need to isolate everything otherwise something like stuxnet & other rogue software can be hiding in your network printers or photocopiers or switches. One way is to isolate everything into its own unique sole vlan with firewalls blocking everything thats not permitted. Permission should only be granted when you want to, like for example allowing access to update sources during dates & times of your choosing, none of this allowing anything to touch base unneccesarily like windows desktops phoning home to MS in the US when you log on for example, same for switches. Bear in mind all isp routers and firewalls all have a default allow out to the net rule including pfsense, what an easy way to walk out with your data. Audit all PC's where possible so you know what the contents of your computers hd's are frequently becuase the flaw with AV software is simply this, the AV companies need to find the virus first before they can add it to their signature database of known viruses. In other words your AV software can not protect you unless the AV company has found the virus. For point of reference, AV companies can spot variations of the same virus automatically in most cases which are the updates we receive hourly, daily weekly etc, its the new viruses that can take weeks, months, years to reverse engineer before they consider something a virus or not and thats before we get into polymorphic software. Bear in mind its entirely possible for app stores including MS updates to serve unique files just for you if you want to be really paranoid and how do you know that dll coming down the wire is what it says it is? Bear in mind its also possible to hide software in the less used parts of spin disks which no longer get formatted when reinstalling your windows OS as it does a quick NTFS format which just resets the FAT (disk index) not blank the contents (the chapters of the book). Log all traffic data in and out and have something to analyse the data so it flags up anomalies or unaccountable network traffic. Get to know the data patterns by day, week, month & year much like you would know when your car is not running quite right. In some cases block ssl traffic out of your machine as you dont know what data is being lifted/sent that could incriminate you, even your windows os tracks the files like what you send to the recycle bin and that is part of the forensics built into windows. Be careful of Google, its very machiavellian and will serve you data which can land you in court, be careful of websites you visit as some dont allow you to report questionable data, again setting you up for a fall if the authorities so desire. Work on the basis if you can think it so can they, but they will have beaten you to it in ways to access that data, and remember a request from one country to another is not always immediately illegal except where the conspiracy to commit a crime is punishable like here in the UK, which means every request GCHQ sent abroad to foreign spooks is commiting a crime even though they like to portray they dont break the law, dontcha believe it. They will even employ phishing techniques in major online news media via comments and other websites to find out the information they want to know like how easy it is to evade their detection. ;D FWIW.

Just for reference: you are installing a different server on top of your windows 2012 file server to have external users access those files without AD permissions. Why not just configure the permissions correctly? So true I was thinking it was wierd installing a server on a server. So I just installed lls managment console and ftp service. But now my issue or worry is that if i give a VPN access (192.168.2.2) to communicate to (192.168.3.9) would it be possible for only the VPN to ping 192.168.3.9 and not my other server (192.168.3.8) Thank you

I've added my layer 2 and 3 design as pictures. Indeed this is a hosted setup in a datacenter. All customers make connections over internet to their network (VLAN) Take a look at the pictures. Layer 2 picture is not correct…...eth 2 on A  to eth 3 on B is PFSYNC in PFSENSE setup......forget to correct that. Our problem is that with our GTA firewalls we had no complaining customers, but with the PFSense firewalls customers have 10 times slower browsing the internet or browse their mail is slow even apps in their VLANs are very slow. For now i put back the GTA and evrything is fine again.    

Thanks cmb. Turns out the ISP had an undocumented radio on the network.  I guess I ended the freebie Internet for someone.

@KOM: A Master of Bugger-All? Didn't know that one  ;D Seems you've met some of the victims of the college bubble, with their 'MBA's'. They've paid heavy money to learn basic accounting (basic!), and some ratio formulas to assess a balance sheet (they were screwed as nobody ever told them they were looking at an irrelevant balance sheet…). Yet, I know how much IT-people feel disgusted about us economists. They mix up bankers (not economists, we warn about the messes governments create since about a millenium ago...) with us, they think we are stupid since we 'don't understand the economy'. Yet: IT-people work with 4-10 variables, we with hundreds,  and sometimes even thousands. There's even medical doctors that admit our job is way more difficult than theirs (and theirs is very extremely difficult too). Who cares: in the end hire and fire IT-people, based on efficiency and effectiveness of the the proposals is all that matters  ;D ;D ;D ;D ;D