The latest 1.3b12 and 1.3b13-pre releases of M0n0wall contain changes to bring in full (?) IPv6 support.

Is it worth looking to see if these changes can be ported into pfSense ?

I ran into exactly this problem too. My connections were all physically stable, and established connections (downloads, VoIP calls, etc) were reliable. But new connections were intermittently flaky, and packet loss was appearing while pinging the router's internal addresses.

A quick look at the RRD graphs showed that I was hovering around the 10k default state limit. So I doubled the state table size (in System / Advanced).

Thanks for the thread. Love those graphs.

First off, get off the release candidate onto the final release.

Secondly, there are a few ways of solving the problem.  Probably the simplest is to block any outbound traffic on 80 and 443 (yes, there are other ports, but if you're not blocking by default it's a good start) and allow traffic to the proxy.  Then simply tell people that they have to use the proxy.  You could also install Squid in transparent mode and configure MLabs as your upstream proxy (and you'd still have to block 443).

How about:

wget --output-document=traffic.png --no-check-certificate --user=admin --password=yourpassword "https://10.10.1.1:2001/status_rrd_graph_img.php?interval=4h&database=lan-traffic.rrd&style=inverse"

in a cron job on your web server?

I suppose there is cause for a little concern having plaintext usernames and passwords on the web server, but…

Take a look at Traffic Shaping (there's even a forum for it).

Another-

Lan net - Lan net

why are those needed?

I think the answer to your problem is in your system logs.

But we need more…

What interface do the various names equal?

rl0?   rl2?   What are they?   If I had to guess Id say you had a loop connection someplace.

Can you draw a picture of your network?

http://www.gliffy.com/ is a good resource for this...

The same mac address is showing up on both rl0 and rl2 but expected on rl1.

I'm not sure if it's even linked in the docs.
I only know about this because cmb posted it here:
http://forum.pfsense.org/index.php/topic,6784.0.html

I'm not sure if in 1.3 the gui solution will just be an implementation of the described procedure in the pdf.
But dont worry about breaking someting when you update to 1.3
1.3 is still more than a year (or even more) away :)

Check out the load balancing/failover function.

if you run tor as a server it can be hard on pfsense you will want to raise your state table and also set pfsense as "aggressive". I run a tor relay in the lab with 10mb up / down set for it, pfsense has been dealing with it great. but I'm not hosting it on the pfsense box.

Tor is one of the best tools for testing hardware and or mucking with least cost routing…cant do that part with pfsense....but upsteam i have some devices doing it. Tor allows you to bring and turn around as much traffic as your willing to give it.

You can install whatever you want…. unsupported.
--> You are on your own.

But for gods sake dont do it.

A firewall is a security critical system on which you just DONT install unneccessary software.

or
sockstat -4 | grep lighttpd

hi

i did change my isp really and back to the previous one  :D still one more problem bugging me here, it is squid upstream proxy not working with pfsense, and most of the isp here wants us to use it when connection becomes bad, well one day might work

thanks

You missunderstand what the gateway means.

It means if traffic on this interface comes in and matches the rule it will be send to the gateway.
If you set * (default) it will be processes by the routingtable of pfSense.
Right now you force the traffic somewhere.
But inbound on the interface itself that doesnt make any sense.

As a rule of thumb you can say: never edit the gateway unless you REALLY know that you want to force traffic this way.
It's usually better to add static routes to the routing table and let the gateway on *.

I think if you issued that statement before, then it would make more sense as to why it is never conveyed.  Now that you said that - it makes complete sense and understandable.  I would agree - staying ahead of the competitors.

@cmb:

I don't think I've ever heard of a CF writer that won't work. I've used no name generic ones and various name brands. I mostly use Sandisk 8 in 1 (older model) or 12 in 1 writers, might also be a newer one from Sandisk by now.

I really like my Sandisk writers, and they don't cost much more than anything else. That's what I would recommend.

Thanks cmb

Yeah, i've tried that, but as soon as the lease time goes out, i loose the connection.

thank you

I have tried changing "Firewall Optimization Options" under Advanced to "Conservative" but this has had no effect.  This idle connection dropping just started happening after upgrading to 1.2-RELEASE.  Before the upgrade we never had any issues with idle connections and we feel that enabling ssh keep alives in the client is more of a "hack".  Also, some SFTP clients some of our employees are using do not support keep alive.  This was working previously and I'm more interested in learning how to get it back to allowing idle connections how it used to be.