If packet souce ip address , destination ip address , service ports, application id matches against the policy framed in firewall and further check for route entry . if its matches with firewall configuration packet is allowed by firewall toward outside to inside network and inside to outside networks .
If above parameters are not matching then firewall ...
Generally, source NAT (SNAT, NAPT) and destination NAT (DNAT, reverse NAT, port forwarding) are each stateful. That means that if you permit packets in one direction, packets belonging to the same session in the reverse direction are also permitted automatically.
A response to an inbound DNAT session is not subject to source NAT rules even though the packet ...
pfSense is a open-source software firewall, so the most obvious answer for how they do it is "take a look at the source code". Programming techniques are off-topic here anyway.
Being a software firewall, pfSense doesn't require special hardware like ASICs or TCAM. It can use offloading functions provided by the NIC but that's about it. So it's all ...
As it is and with the very scarce information you provide, there's no way to tell where packets are lost.
You'll need to test the Internet link directly, with reduced complexity.
Work your way from top to bottom and check where the ...
In addition to the OpenVPN clients that need to have a route to send the packets into the tunnel, the gateway needs to have a route to the destination when that isn't the (likely configured) default route.
Also, the other gateways (pfSense, ...) require a route back to the OpenVPN clients unless they can use their default gateway.
You need to set up the tagged VLANs on the switch as well. By default, it's got a single, untagged VLANs, so all connected device are in the same L2 segment. Also by default, frames with unknown VLAN tags are simply dropped, so there's no connectivity across the switch.
Using a single connection for multiple VLANs requires a VLAN trunk. On the trunk you can ...
There is no clear answer - it depends on your workloads.
If all VLANs carry approximately the same traffic, using a separate connection per VLAN spreads the load evenly.
If load across the VLANs is uneven, a LAG with VLAN trunking might work better. Note that with a LAG, the transmitting device is responsible with traffic distribution: the SG300 distributes ...
It seems that you are using NAT instead of routing between BOX1 and BOX2. BOX2 needs to know how to reach the network behind BOX1. You can either configure static routes, or you can run a routing protocol between the two routers.
Routers learn routes in three ways:
Routers inherently know about directly connected networks
Statically through manual ...