Well I'm not sure why you have the outbound NAT rule on OPT. That shouldn't be required, everything there is routed.

But that test is not something I've done with PIMD. I have done it with IGMPProxy and it did work last time I tried it.

It sounds like the /30 CGN subnet is used for transport only and it not routed (or NAT'd) by the ISP.

In which case you would need to source traffic from the firewall itself from the public VIP.

To do that you need an outbound NAT rule that matches it.

An alternative here might be to set the public IP as the primary WAN address wit the CGN address (100.64.136.210) as the VIP.

To add the gateway to the WAN you would need to set the advanced gateway option: Use non-local gateway

This is a very unusual config!

You should see it reported on the dashboard after rebooting.

It requires a SWAP partition to copy the crash report onto though. Does your system have SWAP?

How often does it crash? Can you log the console output, assuming it has a serial console?

@SteveITS

Cheers for the link, still confused but will give it a go and see where I get to!

Based on my own experience, Wake-on-LAN can be a great thing when it works, but there will always be a situation where this thing won't work under any circumstances, even with the manufacturer's assurances that it should. In my case, it ended with assembling and connecting a PiKVM to the power button, and as a result, I also got a full KVM over IP setup.

If you have multiple downstream subnets on the LAN you will need to add static routes to the mik2 switch and firewall rules on LAN to pass that.

The default firewall rules only pass traffic from clients in the LAN subnet directly.

Also make sure you don't have a conflict between WAN and LAN. Make sure pfSense itself can connect out from Diag > Ping.

Yes you'll still need to configure VLANs 5 and 6 since they're passed tagged to something external. But WAN, LAN and OPT can just be assigned to NICs directly in the other device.

@stephenw10

Yep, did that and all is working now.

Appreciate you help!

Bill

It certainly could be a BIOS setting.

But try running: sysctl kern.smp

@allkemyst said in Can't connect to 9443 port on a host in the same subnet:

Subnet: 20.0.0.1/24 | DHCP4 on

while technically that can work, its a horrible idea to use public IP space internally. Not not just 10.0.1/24 as your lan2 network?

I try to test the port on PfSense, i can reach the port 22, but can't reach the other ports, including 9443.

that screams firewall on that box or your vm host..

To validate this to yourself sniff on your lan 2 interface while you send a test to these ports.. Do you see the traffic leave pfsense, but not get an answer.. But you can ping and ssh works - that screams host firewall to me.

edit: or the config of whatever service this is set to listen on IP 192.168.1.x (whatever your old network was) and not 20.0.0.x

Unless the traffic is routed over pfsense, pfsense has nothing to do with the traffic - if it is routed, maybe your doing a policy route and this is sending traffic out your wan gateway. Without seeing the rules we really have no idea, maybe you set the rule to allow tcp, but this is udp?

@stephenw10 I tried it, works!
Thanks a lot

@JeGr said in Under attack, anything I should do?:

I don' even know how that got so famous in the first place!

I guess grc.com, Gibson and affiliates.
I remember vaguely some talk shows ...

Ok. thank you that was super helpful

There is, unfortunately, no fine grained control for notifications. Yet. If you have a notification type configured you will get alerts.

Well the first thing is to confirm it really is pflow by disabling it making sure it doesn't happen.

What VPN type? How are you routing it? Can you change VPN address?

@pp-ng said in WAN repeatedly going down every few days again:

@stephenw10 Also - to get my WAN back to 'online' I went into Interfaces > WAN and just clicked Save and then Activate. I know it runs several scripts or whatever in the background, so not sure which one got me back online, but that did it.

Sounds to me more like a configuration problem on your WAN or your ISP/upstream provider. That somehow smells like you have DHCP on WAN and your box looses its connection because the DHCP address expired or your provider doesn't "know" it anymore. Or you get a quasi static IP from your ISP and configured it as static IP but your ISP needs to hand it out via DHCP.

We had some of that use cases in support here and most of them had that exact problem. Saving WAN config brought them online and after a few hours or days the connection dropped 'cause packages wouldn't go out/in anymore. Switching the WAN e.g. from static to DHCP or configuring it the way your ISP needs/wants it could solve that. Or check the ISP modem or %device% depending on your internet. That a manual "save & apply" from WAN brings you back seems to indicate that a manual performed DHCP restart seems to work, so I'd have a look at the way you get your IP from your ISP.

Cheers :)

@Gblenn said in Googling blocked domains let them through:

@iSagen So fortnite.com and www.fortnite.com are "different" in this regard. You need to add all variants in order to completely block a site...

Try adding www.fortnite.com and it should block also when searching...

That did the trick, thank you :)

@bozo-bogd
if you have found a solution, plz post it here ;)