New install observations

rcfa

I'm just finished installing pfSense on an Atom 330 box (Zotac IONITX-L-E, 4GB RAM, dual ethernet PCI NIC, broadcom/apple mini PCIe WiFi card).

Here are a few observations:

a) the WiFi card doesn't seem to be recognized, even though it's a pretty much industry standard chip set (Broadcom 4321 801.11 a/b/g/n)

b) any significant changes in IPSec setup require a reboot to work. While the tunnel will come up after changes, no traffic will flow until the system is rebooted

c) there's no way to destroy and properly repartition a disk once a GEOM mirror was attempted. The disk has to be physically removed from the system, and repartitioned in an MBR scheme etc. before it can be properly reused in pfSense. There should be a destroy GEOM option in the installer menues.

d) only two packages show up as being available in System:Package Manager. (Varnish and IP-Blocklist) Can an amd64 installation not install the packages that show up in the i386 setup? I did a test install before on a 32-bit CPU and obviously with an i386 architecture installer DVD, and I had dozens of packages listed available for installation.

e) OS upgrades are funky: the dates of the build and the date of the update shown are not in sync. So you can install the latest update, and the system will still show an update is available, which is the same you just installed, because the system will report the build-time as the current version, while the update server reports a date/version based on when that build was packaged and put up on the server, and these two are obviously never the same, and therefore even the most current update will result in the system thinking it's out of date

f) there seems to be an incompatibility between ZyWALL units and pfSense: the exactly the same tunnel will not come up ever if the mode is changed from aggressive to main on both sides. Switching back to aggressive, and things work fine, switching again to main mode and connectivity ends. Even with aggressive mode and a working tunnel, there are tons of messages like these to be found in the VPN/IPsec log:

racoon: ERROR: notification INITIAL-CONTACT received in aggressive exchange.
racoon: ERROR: exchange Identity Protection not allowed in any applicable rmconf.

g) even though traffic flows from the LAN interface out the IPSec (which serves as the default route for the LAN interface), I can't get traffic to flow from the DMZ interface, which should be NATed out the WAN. Still investigating that one (could be an oversight on my side). To clarify my setup: I have a public class-C address block (my LAN) that I need to route to the public internet, but my ISP doesn't offer that service. So I have a colocation service with an IPSec VPN box, which acts as the gateway for my class-C net. So all my traffic is tunneled there, and so my LAN is using the colocation service as the routing gateway. I however also have a separate guest WiFi network, which can go directly to the internet using NAT and my ISP as gateway. No need for all that traffic to be tunneled, since it won't have public IP addresses anyway. Eventually, for performance reasons, there's some traffic out of the LAN that I want to NAT and send through the ISP rather than tunnel, with some policy routes, but that's down the road….

h) it would be way cool if OpenCL could be used as crypto accelerator... I got that ION chip doing next to nothing in that machine, and it's likely more powerful than the main CPU. OpenCL would have the advantage of being portable and GPU agnostic.

i) it would be nice if there were an option to have man pages installed. While I'm familiar with the basics of UNIX/BSD there are always system specific differences, i.e. Linux, FreeBSD, Mac OS X, etc. are all slightly different, so when doing anything at the shell level it would be nice to have man pages available to look up/confirm semantics.

j) I'd love to have a manual for the system, but the pfSense manual is written for 1.x, which is quite a bit different from 2.x, and 1.x lacks several must-have features, which is why I'm trying to use 2.0 beta as it is. Is there a beta version of the pfSense book for 2.x?

k) once a virtual interface, like e.g. an IPSec tunnel, is defined, it should show up everywhere where there are NICs defined. Routing should be more explicit, i.e. I should be able to specifically say if the WAN or the VPN is used as the the default route to the rest of the net for any other net (LAN, DMZ, etc.)
In my case both the WAN and the IPSec VPN offer a route to the public internet, but that's not obvious in the GUI.
There should only be a collection of (virtual) NICs, and then the routes between them should have to be explicitly defined. Right now the routes are implied in some non-intuitive way by the way the IPSec VPN is set up, because the VPN isn't a choice in the list of interfaces when setting up Gateways, nor can default gateways be defined on a per-interface basis. i.e. I want the WAN gateway to be the default gateway for the DMZ and the VPN virtual interface, but I want the VPN to be the default gateway for the LAN.
The whole thing should work more like a patch-bay and cables than like some table based system in which not all elements are treated equally. In other words, just because the IPSec VPN requires the WAN to be established shouldn't mean that as far as the LAN and DMZ are concerned, it shouldn't be seen as an equivalent to the WAN when it comes to routing options.

l) once an interface is (accidentally) MAC address spoofed, clearing the field and saving/applying the new settings does not restore the original MAC address, instead the spoofed address remains in effect. So unless you happen to know the NIC's real MAC address and you enter it manually, you can't get back to it (at least not through the GUI or without removing and re-adding the interface or similar drastic steps). When the spoof field is cleared, the NIC should revert to its hardware MAC address and give up on any previously set addresses.

m) it seems impossible to have NAT apply only to specific FW rules. e.g. I want most of my LAN originated traffic to have no NAT and go out over the VPN tunnel, but web browsing (destination port 80) I'd like to use NAT and go out through the WAN gateway. So while FW rules can specify an alternate gateway, NAT can't be enabled on a per-rule base. Again, I'm a noob, and maybe I'm looking in the wrong place.

n) In VPN:IPSec the Pre-Shared Keys tab terminates in a non-existing page

o) Without starting yet another vi vs. whatever-editor war, I hate vi, and I'm very prone to screw things up using it. While installing the "emacs-OS" may be a bit overkill, something like nano would be nice if it were part of the standard distribution...

Hope this makes sense ;)

New install observations

uname -a

dmesg