Use PfBlockerNG to blackhole the DNS for sites do is protocol agnostic.  You just need to find the right block list to feed it.

Do not use visudo. Use the GUI, System > sudo

Can someone help me ? Regards, Dimostin

Oh you are the first one ever to ask this question … NOT. Seriously, that's a question that comes up quite regular, so go and search for it.

Thanks for the confirmation Steve!

Thanks for your response. I had removed Squid, Squidguard and PF BlockerNG, trying to get back to a generic configuration without any major packages installed but couldn't get the Apple TV to work.  I reinstalled Squid thinking I could get back to where it worked but it wouldn't work. I have since removed Squid and power cycled the Apple TV and now it works on my pfSense with no major packages installed.  If you google the issue, everyone says you need a VPN for it to work but I didn't want to do that.

Not opposed to using pfSense and just having Cisco basically act as a switch, but if possible I'd like to utilize it as a router since I bought it and also use the content filtering. Extra layer with the redundant firewalls and filtering.

oh yes , i got it many thanks

@chrispeden: I am not exactly sure how though. I don't understand.  2.3.5 is available for download. 1. Save current config. 2. Download and re-install 2.3.5 from scratch. 3. Restore config, this will also re-install all packages.

I realize this is total necro, but this post shows up on the first page of DuckDuckGo results. I was getting Ds and mostly Fs on DSL Reports bandwidth test. In 2.4.2, setting CODELQ without bandwidth was not permitted by the interface. Setting bandwidth to a number higher than my ISP advertised rate resulted in no change in bufferbloat. Setting bandwidth to my ISP's advertised rate resulted in all As. What I found interesting is that even though I can get ~10% higher than advertised actual speed, setting bandwidth to even 50 kbps higher than advertised resulted in increased bufferbloat.

Found the way. in radcheck table: Auth-Type = googleauth in radreply table: MOTP-Init-Secret = (Secret code) MOTP-PIN = (PIN Code) MOTP-Offset = 0 Thanks!

As far as I remember, the speedtest's results are the peak results, not an average  :) But you're probably right… The VM could be taking overhead, but I was very surprised that it was taking over two times the peak of the speed test!  :P

For anyone looking for similar assistance. I found this article to be extremely helpful. https://www.highlnk.com/2014/06/configuring-vlans-on-pfsense/

@KOM: I don't see a reason to leave them out of Squid Squid will sometimes interfere with some downloads, like Windows Update or antivirus updates.  Until I updated to latest squid a couple of weeks ago, Kaspersky updates would always fail unless I exempted the client form the proxy. That it is. For some updates and for other reason i have to exempt some users from the proxy. And with that configuration i don't know how i can get their logs.

Raspberry PI can run as a Syslog Server. So very little costs  ;D