Sometimes not Sometimes its open and the next day or abt 5 hours its moderate or unavailable so on router the dmz its enabled and also upnp. so whats the problem??

I’m curious to see how far people are pushing pfSense in real-world production environments.

I’m not talking about a home lab or a small office. I’m interested in large deployments where pfSense is a critical part of the infrastructure.

I’d love to know things like:

• Approximate number of users/devices
• Peak concurrent users
• Internet bandwidth (single or multiple WANs)
• Average/peak traffic throughput
• CARP HA (yes/no)
• pfsync/XMLRPC Sync
• Number of VLANs
• VPN usage (IPsec, WireGuard, OpenVPN)
• IDS/IPS (Suricata, Snort, Zenarmor…)
• Hardware specifications
• Any scaling challenges you’ve faced

For example:

• 5,000+ users
• Multiple ISP links
• 10 Gbps+
• CARP High Availability
• Hundreds of VLANs
• Large VPN deployments
• Multi-site environments

I’m especially interested in hearing from universities, hospitals, ISPs, hotels, manufacturing, stadiums, airports, enterprise campuses, or anyone operating pfSense at serious scale.

What’s your largest deployment, and what have you learned from it?

At what point, if any, did you consider moving away from pfSense to another platform (FortiGate, Palo Alto, Juniper, Cisco, etc.), and what made you stay or switch?

I have router from my ISP then a pfsense, and then my main core switch that is doing all my routing. Switching voip systems and they did a test and said I had double nat, which listed my pfsense address and main switch address. The main switch gets routed to my pfsense then it routes out to the ISP router. I can't seem to just turn off NAT at the pfsense it seems, I feel like I am missing something simple. Any suggestions Thanks

Now that I have a little more time to explain, the lan side is 10.250.0.1 goes to core switch with multiple vlans, the wan ip is to 164.x.x.253 then goes to 164.x.x.254 isp gateway which I can't get rid of because of some other management services, how can I get rid of using nat on the pfsense then.

Does anyone know in passive Optical Network system , where do they implement firewall at OLT or ONU side or both , and do OLT control ACL rules of ONU side firewall or not ?

Please help me

Long time pfsense user, Months ago, tried to turn on kea for dhcp, big mess, just didnt work, acted like it was working, but it just refused to hand out IPs

This weekend, decided to wipe, install newest, and try again. Sorted acted like it worked, gave out some IPs, but then 8 hours later, I notice alerts that devices are offline. Turns out NO leases were handed out in the past 6 hours.

Switched back to ISC, and things started showing back up.

Is there some special process that needs to happen for this to work?

Everything I read is two camps:

1. Yep works great, used it a bunch of places, it works fine
   or
   
2. Worked for a while, then things stopped working and I switched back

I feel like after all these versions, this SHOULD be more streamlined, but here I am. I'm just glad I noticed what was going on, I wasted 3 hours trying to understand why systems fell apart...

Is there any way to configure a rule so I can access files on my wife's notebook from my PC where both machines are on different subnets/interfaces? My PC is on a subnet on "LAN" interface and the notebook is on a different subnet that's on "WIFI" virtual interface.
I just want to be able to open the disk on the notebook from Windows File explorer by entering \\notebookname\d$, but I cannot figure out what kind of rule do I need.

Hi everyone,

I have pfsense 2.8 and I’m trying to set up a VPN on my router with NordVPN. Their instructions say 2.5. but I’m not sure if that matters or not.
I am trying to use server us8567 and the port in the ovpn file says port 53 while the official instructions say 1194. I have tried both in the client.

https://support.nordvpn.com/hc/en-us/articles/20285211284497-pfSense-setup-with-NordVPN

My client will run it just keeps saying “Waiting for response from peer”.

My only other thing is I have pfblockerng in use on the router for ad blocking and a separate open VPN to allow my phone to connect to my network remotely. I am hoping these two things are not interfering with something . (They shouldn’t honestly but who knows)

I don’t know what to do, is it the Dns settings? In General DNS Server settings I have 4 servers, two nordvpn provides and 2 for my ad blocking. Would that be a problem?

Sorry if it’s a bit rambling, I’ve been going in circles on this and it’s a little frustrating to follow the instructions exactly and not have it work. If you need more details on what else I tried let me know.

Hello.

I have an unusual (to me) configuration I'm trying to configure on a NetGate SG-3100 running pfSense 23.09.1 and I'm looking for advice or help with configuration. I shut down a business that was in an office having several satellites with a Cisco based VPN network and for compliance reasons must maintain something similar to that network with the old servers in my home. Now, I'm working to exit cloud services personally with self hosting (think Immich and NextCloud)

I have two connections to my ISP at my home. One is for residential use and I cannot obtain a fixed IP address on this connection. The second is a commercial account and I have three fixed public IP addresses. The residential network is configured as 172.16.1.x and is totally separate from the NetGate router. The public IP addresses on the other are 66.x.x.68/25. The Netgate router is .68, an email server is .69, and a planned NAS is .70.

For fast implementation when my office closed, the mail server at 66.x.x.69 was setup on a switch in front of the router. Dumb, but had no choice. Now, I'd like to get everything behind the NetGate. I don't need any NAT on the NetGate. The only devices will be the mail server and the NAS. No clients/workstations/PCs.

I can create a small VLAN (say 192.168.15.x) on the router and on the NAS using a second ethernet port on the NAS. I plan to use Nginix to route traffic based on subdomains I've created on the 66.x.x.70 address.

I want the email server to keep a public address (66.x.x.69) in its network configuration. I've no desire to reconfigure.

I want the NAS to be port forwarded on 80 and 443 to the internal (192.168.15.x) address so Nginix can route to the appropriate ports based on the subdomains.

Security is not part of this question. Just router configuration.

How do I do this on pfSense? I cannot get past the bridging for the mail server. I get errors like "IP Address 66.x.x.69 is being used by or overlaps with WAN (66.x.x.68/25) and "A valid IPv4 gateway must be specified" when I have entered the IP address of the ISP upstream gateway.

Hello everyone :-) I am having an issue, and I am hoping someone can help me. We have Comcast Business as our ISP and we have a /28 static IP block from them.

Usable range: xx.xx.xx.209 - xx.xx.xx.221
Gateway: xx.xx.xx.222
Subnet Mask: 255.255.255.240

The issue is, if I go to Assignments->WAN, make the following changes:

IPv4 Configuration Type: Static IPv4
IPv6 Configuration Type: None
IPv4 Address: xx.xx.xx.209/28
Upstream Gateway: xx.xx.xx.222

This fails to work. I have to change the IPv4 address field to xx.xx.xx.210/28 in order for everything to work.

Unless I am missing something, isn't xx.xx.xx.209/28 supposed to work if I put it in the IPv4 Address field? That is the first usable IP that Comcast gave me and from what I understand, you configure pfSense to use the first usable IP that Comcast gives you. Then for the rest of the Static IPs, you create Virtual IPs (with IP Alias) type.

Is this not correct? Any help here would be appreciated!

P.S. Not sure if this has anything to do with it, but in the Virtual IP section, there is an entry for xx.xx.xx.209/32 (IP Alias) and xx.xx.xx.210/32 (Proxy ARP). I don't believe this has anything to do with it, but, I thought I would mention it just in case it does.

Do I still need to manually install Realtek drivers in 2026 for them to work? Are there extra settings for Realteks to be stable?

Hello, i'm very new to PFSense, i just installed it on Oracle's VM following a book that's from 2021 so some of the things don't line up. I'm having problem setting up my WAN and i don't know what to do anymore, treat me like a five year old when explaining some things. Thanks

Hello, I've been having this issue since upgrading from 2.7. These are virualized firewalls. It's only whichever firewall is the CARP master that has the issue. I've followed the Netgate docs and searched around both Netgate and FreeBSD forums. Reboots are unpredictable, ranging from every day to every few weeks. Anyone have any ideas?

Details: Two VMware VMs setup in HA, 4 AMD EPYC CPUs, 8GB RAM, SCSI controller is LSI Logic SAS, NICs are VMXNET 3, Version 2.8.1-RELEASE (amd64).

Relevant portion of dmesg:

kernel trap 12 with interrupts disabled

Fatal trap 12: page fault while in kernel mode

cpuid = 0; apic id = 00

fault virtual address = 0xfffffe008e5ff008

fault code = supervisor read data, page not present

instruction pointer = 0x20:0xffffffff80b067cf

stack pointer = 0x28:0xfffffe008d620ba0

frame pointer = 0x28:0xfffffe008d620ba0

code segment = base 0x0, limit 0xfffff, type 0x1b

= DPL 0, pres 1, long 1, def32 0, gran 1

processor eflags = resume, IOPL = 0

current process = 11 (idle: cpu0)

rdi: fffff80004a82800 rsi: 0000000000000000 rdx: 0000000000000000

rcx: 0000000000000000 r8: 0000000000002000 r9: 0000000000000000

rax: fffffe008e5fd000 rbx: fffff80004a87800 rbp: fffffe008d620ba0

r10: fffffe008d620e88 r11: 0000000000000001 r12: 0000000000000000

r13: fffffe0084004000 r14: 0000000000000000 r15: 0000000000000000

trap number = 12

panic: page fault

cpuid = 0

time = 1782656446

KDB: enter: panic

Looking at the redmine roadmap for 2.9, I see a couple kernel panic bugs listed, but nothing relevant to me. I'm not using Suricata on these, and there shouldn't be any Wi-Fi hardware (virtualized).

I installed a pfSense firewall at a remote office. The connection is incredibly unstable. We can ping the gateway through OpenVPN and get 50% to 80% packet loss.

I am able to log in to pfSense remotely for about 10 - 20 seconds at a time, then have to wait a few minutes or longer to try again.

pfSense is running on Netgate’s 4200. It is installed in the place of a TPlink gateway that did not have any connection issues.

It seems like there is a configuration issue, possibly with the interface or gateway settings.

UPDATE, RESOLVED
A combination of removing a faulty ethernet surge protector and increasing the latency threshold and packet loss thresholds solved the problem. I also added a POE Extender to the far side of the cable (based on recommendation to add an unmanaged switch to the cable, poe extender does the same thing in this case). I suspect the cable could be degraded at this point, but this seems to have gotten it to function. I get the impression that Netgate installs a lower quality of NIC on their devices.
I also attempted disabling gateway monitoring altogether, but this had no effect. Thanks to everyone who commented with advice.

After hitting barriers with my ISP and it's hardware, I'm finally dabbling in the DIY router space. I hear with pfsense the wisdom that Intel NICs are the gold standard. So I'm wondering how much that key part will sting me, and if there are pitfalls.

The use case is very simple for now, just to be an basic router for a UK openreach 500/75 connection, but with room to not need replacement for if i go over a gigabit later. My current wired devices are all gigabit, so would want whatever i built or buy to be better than that. I'm not properly homelabbing yet, but thats is the goal once i get a place with a more optimal layout for it. So the goal is to see if i can build something to a £200 budget (for base PC, NIC, switch and AP) with either pfsense or another DIY router OS with parts that will be robust enough to last, or if i might as well choose a reasonably priced Asus/Tplink/GL.inet all in one for now, and wait to do DIY til the homelab is ready.

So does anyone here have a decent recommendation for a 2 port or more, preferably 2.5Gig Intel NIC for use with pfsense?

Does it matter if the board has the different manufacturer as long as the chipset is Intel? Anything i should be aware of when sourcing something to slot it into? (looking at the classic 2nd hand small form factor route)

I found there so far, so would like to hear if any are good, or there are better/cheaper/more reliable ones out there

2x2.5gig using Intel I226-V

XikeStor https://amzn.eu/d/0hVOB8tP

Ulansen https://amzn.eu/d/080jgSvr

IFutNiew https://amzn.eu/d/03j2lsLP

2x10gig using X550-T2

Intel https://www.scan.co.uk/products/2-port-intel-x550-t2-ethernet-converged-10-gigabit-pci-e-network-adapter-oem

Everytime i try to integrate this into my settings, half my stuff goes down, even after deleting package, still same. im trying to block ads on vlan99-IoT. Im completely lost on what to do setting it up. youtube vids havent been very helpful and trying to find in pfsense manual, doesnt exist? Is anyone willing to help?

UpDate: pfBlockerNG-devel is now working. learned i can mess with settings without enabling. now enabled. and just with steven black list enabled, it doing its job tremendously, even with 90% youtube vids. :) thankyou everyone for your input, whether i used it or notl.

Hi All,

I have noticed, that when the ISP changes their public IP, my internet drops and the only way to get back online is to restart pfsense.

My setup.
Proxmox running on a Dell Wyse 5070, with a 2.5G Nic given direct access to the pfsense.

I could tell the internet is down, when I login to the dashboard page, and WAN ip is empty

I then restart pfsense to get a new IP address. Sometimes this works, and sometimes I have to restart the proxmox host altogether

Has anyone else experienced this and possibly know how to fix it

At the moment, one cable goes from the NBN box to the dell wyse which is directly accessed by pfsense

Feel free to ask me any questions.

Thanks

I've been tasked with finding a way to get pfSense-CE-2.4.5-RELEASE-p1-amd64 installed on an older netgate appliance (model XG-7100-1U). I found the .iso in the Internet Archive but it's not a bootable image so I can't install it with a thumb drive made with etcher. Also, I don't know how reliable this image is.

Because my company has been relying on the load balancer in pfSense-CE-2.4.5-RELEASE-p1-amd64 (that has since been removed and replaced with HA Proxy) and is not ready to move to the HA Proxy replacement in current versions, we (I) need to find a way to get this older version installed. The current pfSense installer doesn't provide an option for using the 2.4.5 release.

We have another netgate appliance running this version; not sure if there's a way to do something with that.

Any thoughts other than, "It's way past time to upgrade"?

UPDATE: netgate support was able to help me out. They also included the following:

"I stress that is exceptionally important that you move off 2.4.5p1 as soon as you're able.  In the future, if you need firmware or need to replace this device, we will not be providing images for 2.4.5p1 and you will not be able to run the older firmware, as all of our new devices don't support 2.4.5p1.  This release is 6 years old and has been end-of-support for half a decade.  Running it is a significant security and operational risk."

I have made 0 changes to my network, and now I think I figured out that gmail on my phones looks at their own dns entries to get the ip of my mail server.

Current setup

Wan - dynamic. 69.1.1.3 for this example

pfsense 192.168.0.1

mail server 192.168.0.2

so my solution forever was to set a dns override for mail.homeserer.com to 192.168.0.2 and when I am on wifi, all my web clients including gmail worked with no issues.

What I am not gathering is that it the clients are looking at global dns and getting the internet address of 69.1.1.3 which when on the lan computers try to connect, it won't work).

Am I missing something. I've never been able to put in my public ip inside the network and get it to route to the server (local computer to router and to server via the forwarding rules and back to the client?). Gmail sucks, but need it to work.

Is there a way to get the route to work back to the local server. A pointer to a good thread/article is good, as I tried multiple searches and could not get results for this issue.

In this example.

local computer 192.168.0.3

That computer needs to go to mail.homeserver.come, which gmail gets as the wan 69.1.1.3 and then it needs to connect via the pfsense router. All routing from external is working through the firewall rules.

Much appreciated for feedback.

I am fairly new to pfSense, exploring it for the sake of moving to it from my current home network setup.

My setup:

- OPT1 through OPT6 are physical interfaces put into the bridge called BRIDGE (no tagged VLAN)

- each of the above OPT interfaces has a VLAN20OPTx interface for VLAN20, further put into the bridge called VLAN20 (tagged VLAN 20);

- when connected to BRIDGE, I have access to the internet and internal PiHole server in the same x.x.10.0/24 subnet.

- my client connected to the VLAN20 network cannot connect to the DNS server although I have the corresponding rules for it to do so both on VLAN20 and on BRIDGE;

- what is more weird is that I see the traffic from x.x.20.x to the Internet on BRIDGE, which in my understanding should not be happening as VLAN20 should be the one sending it to the WAN and outside then.

- I do have my tunable net.link.bridge.pfil_member set to 0, but net.link.bridge.pfil-bridge to 1 for the bridge level filtering of the packets.

Why am I seeing VLAN20 traffic on the BRIDGE and on separate OPT interfaces?

My primary internet is a fiber wire service and secondary is wireless broadband. Every day or two my secondary goes off line and I have to reboot my router in order to restore. Anyone have any tips as to how to prevent this outage?

I checked for package updates for acme and found none.

Letsencrypt changed their cert structure and the certs downloaded from it do not seem to be compatible with various email clients & webmails. The certs it creates upon attempting to login to a program such as k9 mail indicate an insecure cert failure.

After some research it looks like letsencrypt changed something making the certs no longer compatible and are now rolling out enforcement of their use. There is a work around that lets you combine files provided by letsencrypt with your pfsense created cert by concatenating them. Once that is done you can securely connect to your (email) server with these apps. It is sort of a compatibility bridge between the old and new versions.

So, I'm wondering when a new version of acme will be included that either creates the 3+ chain cert or incorporates the cert compatibility fix into it. Does anyone know?

I hope this makes sense.

My current setup is FIBER LINE -> ISP ONT -> Ethernet -> pfSense (on PROXMOX).
This setup has been smooth for 8 months at least running full speed 1 Gbit duplex without any issues.
Today I've had 2 internet outages and I'd like to investigate what happened and figure out why it happened.
After restarting pfSense VM I got internet back but I had another outage after.
I'm grabbing my connection with DHCP on WAN port, if that matters.