pfSense has alternatives?!
Sometimes I find a great idea, put it in writing, then realize that it isn't working. pfsense was one of those moments. To be fair to the project, I am still using pfsense in many places, and am perfectly pleased with it as a part of most solutions. But my corporate firewall had some issues that were causing me sleepless nights.
The first problem was with our Voip provider. The firewall configuration to work with our sip trunks took several hours to find the solution, which required the firewall to be more open than I would like. Fortunately, the instructions I found solved the problem, and we were online. Then weeks later, and for reasons I don't care to review right now, I ran into my second problem. It appears that if you use PPTP connections to remote locations, you can not turn on the PPTP server on the firewall. The reasons are just as complicated as the reasons behind the VoIp issue, but this time there was no solutions, and I was left with grumbling users on both side of the great wall.
The problems, as it turns out, were both caused by the same issue. pfsense uses a product named packet filter for its firewall. packet filter as I understand has a good history in security, but it's connection tracking systems lack support for at least a few of the protocols that I use on a regular basis.
After a bit of research, I learned that pfsense's parent project, m0n0wall, used a different firewall - ipfilter. On a whim, I switched out the memory card and replaced the main firewall with m0n0wall. The install process was basically the same process I learned from pfsense. The interface, though lacking some of the features and extensibility of pfsense, was so similar that I was reconfigured in minutes. Two notable differences: the VoIp worked out of the box, and PPTP was now available from both sides. I was now able to host a server, and dial into remote networks. PfSense has failover options that I would have liked to explore some day, but right now PPTP was a make it or break it option. Both projects are great assets to the open source community, but at least for now, m0n0wall has taken over my main router.