Bridging OPT1 with WAN was what I did and its, by far, one of the simplest configurations.  Be aware that this will make it impossible to configure CARP fail over.

Alternatively you could use Proxy Arp, which would require some minor configuration of your DMZ machines.  This (I think) will also break CARP fail over, and frankly, I can't think of any good reason to use this solution verus bridging the two interfaces.

Finally, you could alias a bunch of IP addresses to WAN and use 1:1 NAT.  This is the most intrusive solution in terms of configuring your DMZ machines, but it means you can use CARP failover without drama and would allow you to obscure the actual IP addresses of your DMZ machines.

@manfred.herrmann:

I would like to use pfSense in XEN virtual machine.
On XEN there is a 5.3 based Kernel-Patch available.

Please point me to a starting point for bsd newies :-)

Is there a chance to use 5.3 with pfsense/freeSBIE ?

Nope.  Not at this time.  Atleast not without you spending 40+ hours to backport everything.

@luvrig:

I get this error about 50% of the reboots and it hangs the system.

Looks like FreeBSD doesn't like your storage device for some reason.

ok, i have a removeable media and live-cd pfsense 0.94.4 detects it.
I choose option 98 to change the location of config.xml.  Then I did a restore on the webgui.
The firewall box reboots, but it doesn't seem to pick up the config.xml.
Went to shell, the cf mount was empty.
What gives?

Due to some problems with another one of my systems, I wiped my m0n0wall drive, and now that a new version of pfsense has been released, I'll try it and see if it works this time.

Geee, thanks Scott.
That will definately save me a lot of time while upgrading my boxes ;).
Cheers

Ok cool I understand. :)

ok sorry

| If | Proto | Ext. port range | NAT IP | Int. port range | Description |
| WAN | TCP | 3389 (MS RDP) | server

(ext.: any) | 3389 (MS RDP) | Remote Desktop |
| WAN | TCP | 80 (HTTP) | server

(ext.: any) | 80 (HTTP) | Webserver |
| WAN | TCP | 21 (FTP) | server

(ext.: any) | 21 (FTP) | FTP Server |
| WAN | TCP | 4662 | server

(ext.: any) | 4662 | Emule TCP |
| WAN | UDP | 4672 | server

(ext.: any) | 4672 | Emule UDP |
| WAN | TCP | 6881 - 6889 | server

(ext.: any) | 6881 - 6889 | Torrent |
| WAN | TCP | 3000 | pfSense | 3000 | ntop |
| WAN | TCP | 443 (HTTPS) | pfSense | 443 (HTTPS) | pfsense WebGUI |
| WAN | TCP | 22 (SSH) | pfSense | 22 (SSH) | pfsense SSH |

@mpapec:

@sullrich:

@speedylix:

@sullrich:

Say what?  This is a shell script.  Are you sure there is a "continue" directive?

Of course there is, works in sh as well as in bash ;)

BTW, is it possible to make custom LiveCD (with ones own config.xml) - this way you don't even need removable media support so less devices needed in a box?

Use a USB Keychain drive.  A menu will come up to transfer config.xml if it is MS Dos formatted.

btw, I can provide patch for /scripts/pfi if you're willing to apply it.

It would be really nice to use floppy for config.xml as I have them few lying around begging to be useful. ;)

The continue patch?  It's already commited.

I haven't noticed any problems with .92 either, but I upgraded, so if it was installer issues, I wouldn't have seen it. And I'm using the harddrive version.  I have noticed a little better performace too.  Previous to the .92 upgrade I was noticing a lot of states as well, but once I had done the update, the performance increased again.  ;D

@Braindead_One:

I Already have a switch, but it is in different room. There is only room for 1 Cable to the closet, so i'd have to buy a second switch just to split the 1 Cable into 2. And that would really be a waste of money ;)

I never asked nor demanded anyone to implement anyting! I Just asked whether it is possible to start the Webinterface when there is ony 1 nic and, after the "no" by cmb i asked why….

I think it's an unnecessary limitation that the Webinterface only works if 2 nics are Present.

You can't be a firewall without two interfaces (whether they're logical or physical).  I'm aware that the PPPOE interface is a logical NIC - however we don't treat it as another NIC, it doesn't exist until the connection is up.  So you need either two physical NICs or 1 NIC with multiple VLANs (which are exposed in the webGUI).  I don't see the requirements for two NICs ever changing, however some day we might expose the PPPOE logical NIC as another NIC in the webGUI which will allow what you want.  There are some rather nasty underlying problems with how NICs are setup that need to be addressed first.

–Bill