I have a pfsense box set up. What happens is I set a rule so I can't hit the admin interface 192.168.3.1 from the box. With the rule enabled--- www.l.google.com ping statistics ---2 packets transmitted, 2 received, 0% packet loss, time 5080msrtt min/avg/max/mdev = 37.684/37.776/37.869/0.215 msroot@bad-apple:/etc#Rule disabled --- www.l.google.com ping statistics ---2 packets transmitted, 2 received, 0% packet loss, time 1001msrtt min/avg/max/mdev = 42.064/44.104/46.144/2.040 msdisallow Rule that causes it. ID  Proto   Source  Port    Destination     Port    Gateway     Queue   Schedule    Description             *   APPLESERVER net     *   192.168.3.1     *           *        none     I don't want the server to be able to hit admin interface, but would like to hit internet for configuration of the machine. Has anybody had this problem before? I have below this disallow rule an allow all from APPLESERVER NET to * because if I set destination to WAN net dns dies.Well what happens is with the rule enabled I ping and it shows up about every 5-10 seconds for a line to appear in ssh. Without the rule it runs like a normal machine, very fast-like. This issue doesn't either of my LANS and they have the same respective dns servers and block [pfsense]admin. [one lAN is admin lan so no block rule on that] I run everything on LAN2 and plug in manually to LAN1 for administration. Update - added /tmp/debug.config#System aliasesloopback = { lo0 }WAN = { re0 }ADMIN = { re1 }LAN = { re2 }APPLESERVER = { re3 }#SSH Lockout Tabletable <sshlockout> persisttable <webConfiguratorlockout> persist#Snort tablestable <snort2c>table <virusprot># User Aliases table <EasyRuleBlockHostsWAN> {   10.35.0.1/32 } EasyRuleBlockHostsWAN = <EasyRuleBlockHostsWAN># GatewaysGWOPT1GW =  route-to ( re2 192.168.1.1 ) GWWAN =  route-to ( re0 wan ip ) set loginterface re1set optimization normalset limit states 23000set limit src-nodes 23000set skip on pfsync0scrub in on $WAN all    fragment reassemblescrub in on $ADMIN all    fragment reassemblescrub in on $LAN all    fragment reassemblescrub in on $APPLESERVER all    fragment reassembleno nat proto carpno rdr proto carpnat-anchor natearly/*nat-anchor natrules/*# Outbound NAT rules# Subnets to NAT tonatsubnets    = { 192.168.1.0/24 192.168.2.0/24 192.168.3.0/24 127.0.0.0/8  }nat on $WAN  from $tonatsubnets port 500 to any port 500 -> 24.220.153.106/32 port 500  nat on $WAN  from $tonatsubnets to any -> 24.220.153.106/32 port 1024:65535  # Load balancing anchorrdr-anchor relayd/*# TFTP proxyrdr-anchor tftp-proxy/*rdr pass on re2 proto udp from any to any port tftp -> 127.0.0.1 port 6969table <negate_networks> { 24.220.152.0/23 192.168.1.0/24 192.168.2.0/24 192.168.3.0/24 }# NAT Inbound Redirectsrdr on re0 proto { tcp udp } from any to any port 21 -> 192.168.2.3rdr on re0 proto { tcp udp } from any to any port 5000:5050 -> 192.168.2.3rdr on re0 proto { tcp udp } from any to any port 80 -> 192.168.3.2rdr on re0 proto { tcp udp } from any to any port 443 -> 192.168.3.2# UPnPd rdr anchorrdr-anchor miniupnpdanchor relayd/*#---------------------------------------------------------------------------# default deny rules#---------------------------------------------------------------------------block in log all label Default deny ruleblock out log all label Default deny rule# We use the mighty pf, we cannot be fooled.block quick proto { tcp, udp } from any port = 0 to anyblock quick proto { tcp, udp } from any to any port = 0# Block all IPv6block in quick inet6 allblock out quick inet6 all# Snort packageblock quick from <snort2c> to any label Block snort2c hostsblock quick from any to <snort2c> label Block snort2c hosts# SSH lockoutblock in log quick proto tcp from <sshlockout> to any port 22 label sshlockout# webConfigurator lockoutblock in log quick proto tcp from <webConfiguratorlockout> to any port 443 label webConfiguratorlockoutblock in quick from <virusprot> to any label virusprot overload tabletable <bogons> persist file /etc/bogons# block bogon networks# http://www.cymru.com/Documents/bogon-bn-nonagg.txtblock in log quick on $WAN from <bogons> to any label block bogon networks from WANantispoof for re0# block anything from private networks on interfaces with the option setantispoof for $WANblock in log quick on $WAN from 10.0.0.0/8 to any label block private networks from wan block 10/8block in log quick on $WAN from 127.0.0.0/8 to any label block private networks from wan block 127/8block in log quick on $WAN from 172.16.0.0/12 to any label block private networks from wan block 172.16/12block in log quick on $WAN from 192.168.0.0/16 to any label block private networks from wan block 192.168/16# allow our DHCP client out to the WANpass in on $WAN proto udp from any port = 67 to any port = 68 label allow dhcp client out WANpass out on $WAN proto udp from any port = 68 to any port = 67 label allow dhcp client out WAN# Not installing DHCP server firewall rules for WAN which is configured for DHCP.antispoof for re1# allow access to DHCP server on ADMINpass in quick on $ADMIN proto udp from any port = 68 to 255.255.255.255 port = 67 label allow access to DHCP serverpass in quick on $ADMIN proto udp from any port = 68 to 192.168.1.1 port = 67 label allow access to DHCP serverpass out quick on $ADMIN proto udp from 192.168.1.1 port = 67 to any port = 68 label allow access to DHCP serverantispoof for re2# allow access to DHCP server on LANpass in quick on $LAN proto udp from any port = 68 to 255.255.255.255 port = 67 label allow access to DHCP serverpass in quick on $LAN proto udp from any port = 68 to 192.168.2.1 port = 67 label allow access to DHCP serverpass out quick on $LAN proto udp from 192.168.2.1 port = 67 to any port = 68 label allow access to DHCP serverantispoof for re3# allow access to DHCP server on APPLESERVERpass in quick on $APPLESERVER proto udp from any port = 68 to 255.255.255.255 port = 67 label allow access to DHCP serverpass in quick on $APPLESERVER proto udp from any port = 68 to 192.168.3.1 port = 67 label allow access to DHCP serverpass out quick on $APPLESERVER proto udp from 192.168.3.1 port = 67 to any port = 68 label allow access to DHCP server# loopbackpass in on $loopback all label pass loopbackpass out on $loopback all label pass loopback# let out anything from the firewall host itself and decrypted IPsec trafficpass out all keep state allow-opts label let out anything from firewall host itselfpass out route-to ( re0 wan ip ) from 24.220.153.106 to !24.220.152.0/23 keep state allow-opts label let out anything from firewall host itself# make sure the user cannot lock himself out of the webConfigurator or SSHpass in quick on re1 proto tcp from any to (re1) port { 80 443  22 } keep state label anti-lockout rule# User-defined rules followanchor userrules/*block  in  quick  on $WAN reply-to ( re0 wan ip )  from   $EasyRuleBlockHostsWAN to any  label USER_RULE: Easy Rule: Blocked from Firewall Log Viewpass   in  quick  on $WAN reply-to ( re0 wan ip )  proto { tcp udp }  from any to   192.168.2.3 port 21   label USER_RULE: NAT pass   in  quick  on $WAN reply-to ( re0 wan ip )  proto { tcp udp }  from any to   192.168.2.3 port 4999 >< 5051   label USER_RULE: NAT pass   in  quick  on $WAN reply-to ( re0 wan ip )  proto { tcp udp }  from any to   192.168.3.2 port 80   label USER_RULE: NAT Rule for web 80pass   in  quick  on $WAN reply-to ( re0 wan ip )  proto { tcp udp }  from any to   192.168.3.2 port 443   label USER_RULE: NAT ssl web block  in  quick  on $WAN reply-to ( re0 wan ip )  from any to any  label USER_RULEblock  in  quick  on $ADMIN  from any to any  label USER_RULEblock  in  quick  on $LAN  from any to   192.168.2.1  label USER_RULEblock  in  quick  on $LAN  from any to   192.168.1.1  label USER_RULEblock  in  quick  on $LAN  from any to   192.168.3.1  label USER_RULEpass  in  quick  on $LAN  from 192.168.2.1/24 to any keep state  label USER_RULE: Default allow OPT1 to any rulepass  in  quick  on $LAN  proto tcp  from any to 192.168.3.1/24 port 22  flags S/SA keep state  label USER_RULEpass  in  quick  on $LAN  proto tcp  from any to 192.168.3.1/24 port 80  flags S/SA keep state  label USER_RULEpass  in  quick  on $LAN  proto tcp  from any to 192.168.3.1/24 port 81  flags S/SA keep state  label USER_RULEpass  in  quick  on $LAN  proto { tcp udp }  from any to   192.168.3.2 port 10000  keep state  label USER_RULEpass  in  quick  on $LAN  proto tcp  from 192.168.2.1/24 to 192.168.3.1/24 port 443  flags S/SA keep state  label USER_RULEblock  in  quick  on $LAN  from any to any  label USER_RULEblock  in  quick  on $APPLESERVER  from any to 192.168.2.1  label USER_RULEblock  in  quick  on $APPLESERVER  proto { tcp udp }  from any to   192.168.3.1 port 80   label USER_RULEblock  in  quick  on $APPLESERVER  proto { tcp udp }  from any to   192.168.3.1 port 443   label USER_RULEblock  in  quick  on $APPLESERVER  proto { tcp udp }  from any to   192.168.3.1 port 22   label USER_RULEblock  in  quick  on $APPLESERVER  from any to 192.168.1.0/24  label USER_RULEpass  in  quick  on $APPLESERVER  from 192.168.3.1/24 to any keep state  label USER_RULE# VPN Rulesanchor tftp-proxy/*I've updated it with the debug.config file. So my workaround for the fix was to only block 22,80,443 from the 192.168.3.0/24 subnet [appleserver subnet]. This fixed my speed issue, but I'm not sure if this is a great way for a correct fix. Perhaps it could be a dns issue, but then entering in a wan ip on a remote machine takes about the same[long] amount of time with all block rule enabled as domain name route. 
pfsense long ping to google
linux;networking;freebsd;firewall