I think I tracked it down. The SRV query appears to belong to the repository agent (pfSense-repoc). It's trying to find the closest or most available update mirror. I ran the following: pkg -d update The results showed pfSense stuck in a loop checking for system updates. Netgate's repository servers (pfsense-plus-pkg01 and pkg00) were actively rejecting your firewall's built-in client certificate at the application layer, throwing an HTTP 400 Bad Request. Because of this failure, the pkg tool mistakenly attempted to resume partial downloads using bad byte ranges, causing it to endlessly cycle between mirrors and throw erratic errors. Additionally, this update routine caused the firewall to query netgate.com as a relative name, resulting in the netgate.com.foo.org that I saw in the BIND logs. I resolved this as follows: rm -rf /var/db/pkg/repos/* Wipe out the corrupted metadata cache and clear the broken partial download states that were driving the infinite loop. pfSense-upgrade -cc Clean the internal upgrade utility cache. This forced the firewall to dump the stale SSL session tokens and request a fresh mutual TLS (mTLS) authentication challenge from Netgate's registration backend. -- Best regards

@gamehoundsdev NVM im a idiot, I forgot to disable a 443 mapping on nat ..

@jgq85 I think that will work but it's always best to have Windows do your DNS and DHCP if your clients are using AD. Just use pfSense as a routing firewall and VPN remote site. Are you looking to move the existing building DC somewhere else? Otherwise I don't know why you wouldn't just connect the new building to the old one and the clients use the same old DC they always did with the least amount of disruption.

Hi, No need to go to http//whatever.on.the.internet.tld Like Mercedes knows all about Mercedes cars, Netgate/pfSense knows all about pfSense : https://docs.netgate.com/pfsense/en/latest/nat/port-forward-troubleshooting.html I would open my tool box, that is : clicking on " Diagnostics > Packet Capture" and set up for a capture on port 1194 and UDP (?) and start it. Then, try to connect using your remote App. Stop the capture. Look at the result : something came actually into on your WAN (?) NIC on this 1194 port ? If not : the problem is up stream : traffic didn't make it to pfSense. Read the entire check list on the trouble shooting page : execute every step, and if you do not understand : ask. "before using Pfsense I open NAT-DMZ on the router from WAN to local IP. " pfSEnse is not any different from any other router on planet Earth. You have to create a NAT rule, using incoming port, outgoing (destination) port, a 'LAN' (DMZ) IP address and that's it. But if 1) applies, and nothing comes in ... well yeah .... 1 explains 2. "I have a program that does not work in the domain environmen" : I don't understand. That's a typical user that describes an error. Your are the network admin ? Start detailing what actually happens. We, from here, know nothing about your network / needs / setup. Give details and we figure it out.

Yeah you should be able to use either HAProxy or reverse Squid to redirect requests based on the host headers to different internal servers. Or different ports on the same server. https://docs.netgate.com/pfsense/en/latest/packages/haproxy-package.html https://youtu.be/FJSHMyrd29E Steve

@jmurr Посмотрите тут Обратите внимание на раздел Extended Query Возможно , это то что Вам нужно https://docs.netgate.com/pfsense/en/latest/usermanager/ldap-troubleshooting.html

The benefit is that you don't need to use port forwarding at all and you only need to have one port open. You can have HAproxy listen on the WAN on port 443 and send requests to the appropriate backend server based on the requested URL. You don't have to remember what port the services are running on externally just the FQDN. It isn't necessarily any more secure though. You only have one firewall rule on WAN so you can't apply different rules to each service at the firewall level. Connection limiting, traffic shaping etc. You still can have HAprxy listen on different ports though if you found you needed that. Steve