Netgate SG-1000 microFirewall

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - mikeisfly

Pages: [1] 2 3 4 5 ... 30
General Questions / Re: VLAN basic
« on: April 19, 2017, 06:12:57 am »
That was my point,  saying you probably shouldn't do it. Plus it looks like this person is learning, so why not start off with a good foundation before they start dealing with native vlan mismatches. I've also seen in previous versions of pfsense the captive portal doesn't play well with tagged and untagged traffic on the same interface. Not sure if this is still the case today.

General Questions / Re: Setup Test PFSense
« on: April 17, 2017, 10:22:00 am »
Why not just make your LAN a different network then the WAN (You have to do that or else your router won't route)? setup all your static IPs, DHCP settings, Port Forwards, ......
You will need to put PfSense in the DMZ of the DD-WRT and setup PfSense to allow private IPs on the WAN interface and you would be good to go. Don't really see a need to change the IPs to match DD-WRT unless you just want consistency for failover.

General Questions / Re: Can I communicate two PC on differents subnets
« on: April 17, 2017, 10:16:38 am »
You have to create a static route on each router, or you will have to setup a dynamic routing protocol like rip for each router to discover the routes across the whole network. Take a look at YouTube I'm sure there are plenty of videos of people explaining how routing protocols work. RIP would probably be the easiest to use for your needs. You will need to download a package from to get RIP functionality.

General Questions / Re: VLAN basic
« on: April 17, 2017, 10:12:57 am »
It depends if you switch is stripping off the vlan tag then this will not work. Why not just get a smart switch? You can get some really good used gear on ebay depending on your requirements and budget. Probably not a good idea to put both tagged and untagged traffic on the same interface for security purposes.

General Questions / Re: ISP locked router and preventing double NAT
« on: April 16, 2017, 10:30:55 pm »
No need to port forward all ports, just have the ISP assign your PfSense box a statically assigned IP address. Then put that IP address in their router's DMZ. That should forward all unsolicited traffic to your PfSense box.

I should mention that if I choose any combination of WAN connections regardless if the speeds are similar or not and the scaling is additive (As long as I stay below the max speed of my nodes). Far better than the days of having to add the slower speed connections in multiples of the larger.

2.4 Development Snapshots / Gateway Groups Loadbalancing performance
« on: March 01, 2017, 07:55:58 pm »
Please see Image below:

I was testing the load balancing capabilities of PfSense by connecting 8 WAN connections to my firewall. I have to say that I'm very impressed by how well it scales. Here are the speeds of each modem individually:

     Download   Upload   Ping(ms)
WAN1   180.27   24.24   10   
WAN2   141.45   22.68   10   
WAN3   180.52   24.12   10   
WAN4   240.17   12.17   10   
WAN5   179.89   24.23   10   
WAN6   180.28   24.21   10   
WAN7   180.36   24.04     10   
WAN8   240.19   12.19   10   

Total       1523.13      167.88

I got 61.34% of the download speed and 87.15% of the upload. I know what your thinking 61% that's not that good. Well I'm on a gigabit network so my theoretical max is 1 Gaps. I believe I would have gotten closer to the max but I was maxing out the fiber optic nodes that these coaxial cable modems were connected to. I'm also hitting the max upload performance of the nodes as well. Just wanted to say good job keep up the good work!

Test info:

Computer running the test was a Dell OptiPlex i5 (980 I think) 4 GB ram running Server 2012 (Chrome Browser) using the built in gigabit nic.

PfSense is running on a i5 OptiPlex 980 as well 4Gbps of ram. The built-in nic is connected to a brocade FastIron 648P POE which is the LAN port running 17 VLANs

The WAN is connected to one port of a  dual gigabit port Intel NIC. A cisco C3550-I5Q3L2-M switch is what I'm using as a WAN Aggregator. The WAN port on PfSense is running 9 VLANs. The modems are spread across two nodes which have no real world users.

PfSense version:

2.4.0-BETA (amd64)
built on Tue Feb 28 13:16:27 CST 2017
FreeBSD 11.0-RELEASE-p8


Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz
Current: 3100 MHz, Max: 3101 MHz
4 CPUs: 1 package(s) x 4 core(s)

I would have created a LAGG Group but PfSense doesn't allow a VLAN on a LAGG port to be assigned to a WAN interface. If anyone would like for to test anything let me know and I will try to get you the info asap.

Although I am a employee of a very large ISP, I do not speak for them or endorse PfSense on their behalf. I have been a user of PfSense almost from the beginning and thought that I would share this very cool information with everyone. I personally have loved the project from almost the beginning and have personally recommended it!

Thanks, thought I looked through the list. Guess not carefully enough.

Is this going to be posted for Ondemand? Looked in the archive and it is not there. Thanks.

Routing and Multi WAN / Re: 2 lan routing issue
« on: May 08, 2016, 06:06:20 am »
congrats, keep us updated.

Routing and Multi WAN / Re: 2 lan routing issue
« on: May 05, 2016, 09:01:07 pm »
You said you vpn info is empty but is it disabled? I believe my problem at one time was that it was enabled even though I believe I felt like I removed all info. This is a really interesting problem. Like you have said before this should be a fairly straightforward setup. If you look at the arp table on your clients, do the entries for match the actual mac address of your firewall's interface?

Routing and Multi WAN / Re: 2 lan routing issue
« on: May 05, 2016, 07:55:27 pm »
Everything looks good to me. I know that your router is but I'm seeing a ip in your arp table as well, do you know what that device is? So from what I can tell you can ping from interface to anything on your network, but from any device on your network you can not ping the network. In your arp table I see all your devices on the devices. What type of clients are you working with? If you are using windows what does the output of the ipconfig command what does it look like? Maybe your DHCP configuration is not configured correctly and the their gateway is assigned incorrectly. Your gateway should be Do you have anything like OpenVPN setup or IPsec tunnels configured? If so those routes may take preference may be preferred over the directly connected network. It is not clear to me the routing preference of PfSense. You would naturally think that directly connected networks would be preferred but I can remember having IPsec tunnels enabled by accident and even the tunnel was not up it was the preferred route which was causing me issues.

Routing and Multi WAN / Re: 2 lan routing issue
« on: May 05, 2016, 03:52:35 pm »
Typically I have seen dsl modems at like nat routers giving out private IP addresses. If you have the same network on two different interfaces then that would cause your issue. Simply changing the network to should fix the issue. Don't forget to adjust dhcp. Currently I don't think pfsense will warn you if you have overlapping IP ranges across interfaces but I could be wrong.

Routing and Multi WAN / Re: 2 lan routing issue
« on: May 04, 2016, 06:59:12 pm »
What is the IP on your wan interface? Is it a private IP? Does it overlap your LAN IP? Why is your firewall's IP in the middle of your IP range?

Routing and Multi WAN / Re: Moving VLANs from pfSense to L3 Switch
« on: May 04, 2016, 03:37:28 pm »
Another easy way to do it is to use a dynamic routing protocol between your pfsense box and your l3 switch. RIP should do the trick just download routed package and advertise all routes you want discovered. You will have to look up instructions on your dell switch I'm not fimilar with it.

Pages: [1] 2 3 4 5 ... 30