@terdexx89 said in pfsense : forward all LAN traffic to a proxy:

android phone connected to a proxy and make a vpn connection

Ok I'm a bit confused - are you saying your phone can not connect to this vpn connection unless it bounces off this proxy?

If pfsense can make a vpn connection to where your phone is connecting or any other vpn service on the internet, then you could route all clients behind pfsense through this vpn.. This is just a client vpn connection on pfsense and people do this all the time..

Pfsense does have the ability to use an upstream proxy, but I am not sure if it would then route its vpn connection through this proxy?

https://docs.netgate.com/pfsense/en/latest/config/advanced-misc.html#proxy-support

I take it your goal is to use pfsense to route your device behind pfsense through the vpn connection? Which users do all the time. What I am confused about is the added proxy? My understanding of the upstream proxy feature of pfsense is so pfsense can access updates and packages. I am not clear on if you set this upstream proxy, and then setup a client vpn connection in pfsense if it would make that connection through the proxy.

But once pfsense has this vpn connection, it is quite simple to route devices behind pfsense through this vpn connection.

edit:
If you want your vpn client on pfsense to bounce off a proxy, those settings are in the vpn client setup

https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/configure-client.html#proxy-settings

@zacaustin

I have a Sony Bravia and a sg3100, it’s on my guest vlan
It works perfectly hardwired.. I have a Ubnt nano mounted directly above it which also works fine..

It works on just the out of box dns resolver for me and also by setting it up with next dns google blocking... where it’s pushed dns servers by pfsense and it blocks google services

@beremonavabi

I have never been able to understand the reasons for not supporting DHCPv6 on Android. The reasons I've read could equally apply to SLAAC.

Ok, so the final update, I have everything fixed now (at least till now)☺

So the final trick is to set my switch to tag port 5-8 which connect to my 4 APs

apparently the tp-link APs will receice packages on it's selected wirelss VLAN + anything that's untagged (without vlan header)

after change my switch to tag vlan1 on port 5-8 it ensures all the vlan1 tag won't be removed when outbound the port, which fixes the RA flood issue.

Thanks everyone for the help

yeah you need to create your key ;)

Simple google for bind dynamic dns should get you going.

Have not done it in years... But guess I could fire bind in pfsense and do a walk through... Pretty busy with getting back to work from holiday so not sure be able to get to until later.