@ermal: You can do a port forward too. could you please tell me how? THANK YOU! massi

I've used m0n0wall on alix and soekris boards, and pfsense on soekris. I prefer the soekris hardware, but both are nice and compact, low power. If you get tired of asterisk you can install the freeswitch package on pfsense, like I did. The freeswitch package is well-supported and maturing rapidly. (The freeswitch software itself appears to be rock-solid. When I say the package is maturing rapidly, I'm referring to the GUI, which is heroicly maintained by mcrane.) db

It might be worth trying a more up-to-date build which is based on FreeBSD 7.2. See http://snapshots.pfsense.org/FreeBSD_RELENG_7_2/pfSense_RELENG_1_2/updates/

Thank you!

Just placing here the solution for this problem after so many months. Basically it was an MTU issue, even though im using a PPPoE to PPPoA bridge one would assume I would need to set the mtu to 1492. But that would not help, I had to set the MTU down to 1454 so that everything finally worked normally on my linux machines. Oddly the windows machines were never affected no matter what value was set.

wow…. just installed it on an x500 with the lcdd script and it looks very good. now for some testing over the next couple of weeks. but it looks impressive to say the least and is more in line with what i'm familiar with.

Rather than do all that, which would require you to roll a new version of pfSense and make a bunch of unsupported custom changes, a simpler solution exists.  In the webGUI, navigate to System -> Advanced and check the box which says "Password protect the console menu".  Reboot the firewall and you're good to go.

@tracer: Sorry don't use aliases, use Virtual IPs I meant. And don't bind more than one subnet to a physical network. Excellent advice. I have now managed to use AON to redirect outgoing traffic from my second subnet to go out from the gateway ip of my second subnet. I'm half way there. Next thing is to get the outgoing traffic to appear from the corresponding ip of the second subnet. The problem is that in the rules of the AON i can only choose the network range to apply the rule to and not the specific ip. eg. the rule lets me specify that traffic originating from the 200.300.400.x subnet goes out from whtever ip alias i choose from that subnet. there is no option in the rule wizard to specify a specific ip instead of a subnet.

Yes, OpenVPN is fully a part of the pfSense webGUI configurator.

Clog was broken in that build, and some before it. Try moving up to pfSense-Full-Update-1.2.3-20090608-0559.tgz or newer.

Still it hanged here –--> ls `ls' at 0 [Logging in…] …

Not wishing to sound too condescending, but if you're responsible for firewalling 20 servers at 5Mb/s, you'd be wise to invest a bit more time in future in realistic load testing. A single "inactive" lappy hardly mimics the deployment environment.

With a standard pfSense you won't be able to do it. If both websites are on the same physical server, running under the control of a single web server (eg. Apache), then virtual host configuration will be able to handle it. If you have physically different servers (eg. 192.168.1.2 and 192.168.1.3), then you will have to set up some kind of proxying facility. You can use a third box (ugh), or install something like ffproxy, varnish, or mod_proxy on Apache on one of the servers. If you go for the second option (recommended) then you'll forward all incoming HTTP requests to this box and the proxy will have to analyse the "Host" header on the incoming HTTP requests and route it to the relevant web server.

and root instead of admin

Could it be a problem with the MTU? Maybe try reducing the MTU on the client interface on pfSense. Something just a little lower like 1492.

@chpalmer: Go to "System- Advanced- down to Network Address Translation - Uncheck "Disable NAT Reflection".   Id reboot the box to make sure it takes but you may not need to… My box is still set to port 80. I see my webserver fine by looking at my domain name... awesome.  just had the same problem and this fixed it immediately…and a reboot wasn't necessary.  thanks!