Pfsense wan traffic differs from lan

pfsense

Having 2 pfsense FWs in a large populated area with 3 VLANs, (students + teachers + admins), I set up limiters in the firewall rules to avoid the connection speed limits to be reached (30Mb up/dwn)
This seams to work nicely on tests I've been running on devices of the 3 vlans, for whom I created firewall alliases to.
Surprisingly, it still occurs that, as before I set those rules up, I notice wan traffic being on the max of the Internet connection, with no such lan traffic.
So, what I am looking for is the reason why the wan traffic differs from the sum of my LANs.
The 2 graphs shows both of my FWs, the problem can occur on one like on the other.

Thanks for any ideas.

Pierre

enter image description here
enter image description here

Best Answer

You might want to look at your RRD graphs to see what's going on with blocked traffic, and/or examine what you have exposed to the WAN that could be getting beat on [that would be services that originate from the pfSense box and which might well be only intended for your local network, but which may have default (or non-default) settings that make them available on the WAN interface as well.]

You might also want to consider moving up to 2.3.2.