What pfSense version is it running?

You can always reset the config (or just the password) from the serial console.

Steve

Edit: Just checked and the reset button should work in 2.3.5. I tested that myself at the time.

That's just one slice. The actual installation files are on a separate partition on the memstick that can't be read by windows.

Using top to see io activity, both 2.4.3_1 and 2.4.4_1 are about the same. So my hunch was wrong that more disk writes are occurring.

I still can't explain the behavior I've described but at least I'm not seeing more disk writes.

Thank you. I still don't understand where 172.x.x.x (private IP) is coming from? as it was set to default, why default is not picking up WAN IP?

I've left Gateway as dynamic (it still displays 172.x.x.x address), but I've added Monitor IP 8.8.8.8 (Google DNS).
I'm not sure if this is correct, but I can see now correct status in Status>Gateways

Probably some power saving feature that SD doesn't do.

@jimp I upgraded from 2.4.3_1 -> 2.4.4_1 and this time I had no issues.

Thanks for the support and great product!

Thanks

Hi,

Nuke the raid stuff - visit BIOS if needed.
Btw : nuking means re reinstalling ... take config backups

In the end nothing helped but reinstalling. I was naturally afraid of doing so but it turned out: It was fast (with the exception of getting the image in the first place) and worked beautifully. So thanks for the assistance!

@ronpfs said in Restore config doesn't change Syslog Log file size on disk:

But do I have to visit all tabs and sub tabs to figure out what I need to pay attention to when restoring to a new installation?

Keep a good documentation of the changes you made. And yes, verifying your setup after a config restore is important and pretty much a standard procedure.

Thanks for all the help. Since client is a 24/7 operation I'm going to suggest they replace this old unit with an SG-3300. Then we'll try the reinstall on the old unit and save it as a backup.

Thanks for the reply. Mainly to separate the traffic on the first pfSense. That one currently runs at about 35% to 55% cpu. Eventually that server will be upgraded. The thought is the 2nd pfSense at that location will be used exclusively for the VPN access. If the VPN access begins to affect the traffic through the main pfSense server, I'll just cut the site2site access out of the picture. I have limited bandwidth available (400/25) so the site2site is a nice to have to eliminate running to the building when something goes bonkers there. I may try enabling the site2site on the 1st server and see what happens. Is it possible to run site2site and road-warrior on the same pFsense server. Needless to say, because I had been relying on RDS for the past few years, I'm a noob on the VPN side of things.

It doesn't matter how many you have, one should be set to default. Either directly or by using a gateway group as the default. There is an open bug report about a gateway group as default not working for everyone, though, perhaps your setup is one of the affected ones.

As long as you have a default route showing under Diagnostics > Routes you should be fine.

The advice you were given was pragmatic and meant to get you back up & running quickly, which is usually desirable when your net access is downor your config seems irreparably broken..

If you're really that upset then simply ask for a refund and move on, but I've worked with other firewalls in the past and I've had upgrade problems with ALL of them at one time or another. At least pfSense isn't a black box and you can poke around and make changes that might fix whatever issue you have. Try doing that on most other firewall appliances. I upgraded a Mikrotik 6 months ago and it blew away ALL of my configuration, including a complex QoS config. That's not to say that the 2.4.4 upgrade could have gone a little smoother, but that nothing is perfect.

If you have a problem that can be reproduced then log it to redmine and they will fix it.

New location/client, I'm gathering information and assessing here.
I'm sorry you are being a jerk here about this.
You really are haha.
I'm expressing my opinion on the interface saying all is fine and up to date.
If it were under my management it wouldn't be this long before it was checked into.
Again thanks for leading me to the information I needed.

Ah, looks like this was discussed a few months back:
https://forum.netgate.com/topic/135395/where-to-download-old-versions/7

Intentionally removed because they are insecure, and we should maintain downloaded copies if we want them.

Check this :
What ? Google doesn't accept MITM anymore ?