Queries getting ignored on pfsense configured as a proxy - network cards?

[p0ddie]

Hi there,

I have set up pfsense with squid as a caching proxy for two separate networks. The problem is that many queries from the network are ignored/stuck, meaning: I enter a website in a browser, eventually the query times out. I need to hit enter on my address bar multiple times before I can get a connection.

It happens with all the computers behind the proxy.

I suspect there is some network fubar going on outside of pfsense on the virtualization/host OS layer that causes this.

We have (currently the only stuff this school can afford) the following setup:

• Pentium 4 Windows 2003 Server with VMWare Workstation 7

• 1GB of RAM allocated to the VM (only VM running currently)

• pfsense 2.0.3 32bit with squid 2.7 package, 2 network interfaces configured for 2 different subnets

• The host has two Realtek NICs

• VMware is set up to bridge one NIC to vmnet0 and the other NIC to vmnet1

• the NICs in pfsense are emulated as Intel (em0/em1/em2)

• the proxy connects to a gateway with content filter (Lancom router with their content filter package)

I am guessing the problem evolves around some Windows ethernet driver issues… could I be right?

Solutions that come to mind are:

• put an Intel NIC into the host
• upgrade Vmware
• ditch Windows 2003 for e.g. Ubuntu as host
• do a bare metal install
• tweak some network settings in Vmware or Windows
• tweak the network settings in pfsense

I hope to have given all relevant information.

Do you guys have an idea of what is going on and how to solve this? Thanks!

[craigduff]

Why don't you chuck on VMware esxi free onto the box as a hypervisor and p2v server 2003 and virtualise pfsense. Should work much better.

[p0ddie]

while that is a good idea and the plan for the school is to eventually virtualize everything with ESXi, I'm more interested to solve the issue with the resources at hand - school's on a tight budget and can't afford IT guys to spend half a day to set up ESXi after virtualizing their stuff…

I guess I'll try with an Intel NIC first, see if it works.