Categories

  • 387
    Topics
    1.3k
    Posts

    M

    New features and improvements include VPF for NAT and Filters, DHCP relay support, and core performance updates.

    Netgate TNSR is a high-speed (exceeding 100 Gbps) virtual router and VPN aggregator. TNSR software is the answer for businesses, governments, and xSPs looking for scalable routing without the six-figure price tag.

    Learn More: https://www.netgate.com/blog/netgate-releases-tnsr-software-version-2410

  • 118.4k
    Topics
    745.8k
    Posts

    GertjanG

    @heper

    yeah, that's probably the one.
    It was solved. I was using 2.7.2 in the post for a while and had no issues what so ever.

  • Discussions about pfSense software packages

    Cache/Proxy IDS/IPS Traffic Monitoring pfBlockerNG UPS Tools ACME FRR Tailscale WireGuard
    19.8k
    Topics
    125.1k
    Posts

    dennypageD

    @TQKez said in Wireguard and Bonjour/Avahi:

    Bonjour advertised network shares showing up in my Finder sidebar possible with a Wireguard VPN in pfsense or no?

    No. Quoting the Wireguard doc linked in the other thread:

    "If a routing protocol relies on broadcast or multicast traffic, it is unlikely to work."

    Bonjour is a system based on mDNS (Multicast DNS).

  • 42.4k
    Topics
    266.1k
    Posts

    JeGrJ

    Follow-Up:

    Dass DHCP Server oder deren Konfiguration häufiger mal mit /30 ein Problem haben, zeigt sich bspw. auch hier, auf das wir durch Zufall bei anderem Kundenkontakt und Supportfall gestolpert sind (Kunde wollte hier auch eine /30 Delegation haben):

    https://community.ui.com/questions/How-to-setup-DHCP-30/00f029f1-9a42-46c9-a3b6-074c3de39c77

    Es ist durchaus "Besonders", nur eine einzelne IP via DHCP bereitstellen zu wollen und nicht jeder Service kommt damit klar, dass Start und Ende gleich sein sollen - da es nur eine IP gibt. Wenn zudem dann noch dazu kommt, dass man diese IP reservieren will für ein Gerät (via MAC) wird es annähernd unmöglich für Server, die es nicht mögen, wenn die static mappings im Pool Range sind. Was in der Vergangenheit selbst der ISC DHCP zu älteren Tagen nicht leiden konnte. Während der Monowall Zeit wäre das bspw. unmöglich gewesen. Das wird durch die Beobachtung gestützt, dass KEA mit /29 wohl kein Problem hat. Kleinere Netze als /29 sollte man außerdem tunlichst vermeiden, wenn man mit Segmentierung arbeitet, da /29 die kleinste Größe ist um ein Netz ggf. redundant auszulegen. Dafür werden für ein sauberes Setup alleine 3 IPs notwendig, womit /30 kategorisch ausscheidet.

    Außer bei einem Peer2Peer DirektRouting bei einem VPN Interface bspw. ist daher von /30 in Routings oder Interface Setups abzuraten. Unabhängig davon, ob man hier pfSense, OPNsense, IPfire, OpenWRT oder Unifi einsetzt. Das ist schlichtweg durch das generelle Netzlayout und -design vorgegeben. Daher laufen auch Transfernetze häufig via /29. Und darum setzt man auch so gut wie nirgends kleinere Netze als /64 bei IPv6 ein, da alles andere ein Schuß ins eigene Bein ist und man sich die verwendeten Protokolle oder Dienste sabotiert.

    Cheers :)

  • Information about hardware available from Netgate

    2.4k
    Topics
    19.3k
    Posts

    J

    Hello guys,
    I have Netgate 4200, but I think this issue is not related with this model.

    Previously I had Netgate 2100 and now 4200 and I always worked wit static IPs for all my devices at home. So I always had dedicated static IP's for all my devices and clients at home (it's not so much).
    Yesterday, I decided to add additional "small security layer" and I added in DHCP Server configuration, for each interface , under MAC Address Control \ MAC allow the list of allowed MAC addresses (comma separated without spaces) which are allowed to get IP from DHCP server. Changes saved and applied. It worked properly without rebooting. After that I even rebooted Netgate 2 or 3 times and until end of day , everything was fine.

    Later on, in the evening I shut down the pfsense (from menu "Halt system") and switched the power off during the whole night.

    On the next day, I switched Netgate appliance on, but I cannot connect to pfsense via LAN ... I just not getting the IP from DHCP. Also when I change the IP of my PC manually to the same which is configured as static IP for my PC , I cannot connect to pfsense GUI. Also if I set the IP manually to the different one , but from the same subnet ... I cannot connect to the pfsense.
    In parallel I have the box connected also thru USB to the console port and I don't see any errors.

    First try to fix it: I set pfsense back to the factory defaults from the console, then it works. But then, when I restore the last worked configuration from my local PC , it's not working. As above , I cannot connect via LAN ... I am not getting the IP.

    Second try: Restoring factory defaults from the console, then remove allowed MAC addresses from the config file manually -> "<mac_allow></mac_allow>". Then restore this configuration , it's not working. The same behavior , I cannot connect to pfsense , I am not getting the IP from the LAN.

    Now I am connected to internet via the standard ISP router, but this of course not want I want.

    Any ideas ? Is this known issue ?

    Installed version: pfsense plus 24.11-RELEASE

    best regards
    Tom

  • Information about hardware available from Netgate

    44
    Topics
    210
    Posts

    GertjanG

    @LesserBloops said in Netgate Security Advisory: CVE-2024-6387:

    I had no idea System_Patches existed until happening upon this thread

    Yeah .... well, scrap what's I've said above.
    I'll rephrase, and express my real opinion :
    It must be a package, so when an update exists, it will get flagged on the dashboard as 'update == patches' exist. That's the great thing about the pfSense package system.
    I was wondering : why isn't this build into pfSense directly ? But that would mean that there will be another thing to check, pfSense packages updates and patches updates. Another dashboard widget ?
    So : upon pfSense installation : advise the user to pick this package ?
    Or, don't signal the admin, and install the package without admin consent ?
    Humm, maybe not ...

    Right now, any package is installed with admin consent, as you have to install them 'ones'.

    Parches proposed by this package are only mostly 'quality of live' amelioration. But ones in a while they are a must have, as it solves a real issue. Then the question doesn't exist anymore : people will find the forum for support, will find that there is a solution ... a patch, and so on ...

    Real issues, like urgent software updates like (example) curl, unbound nginx etc etc (tyhese are not pfSense packages, but FreeBSD packages ! - or FreeBSD updates ported to their pfSense equivalent by Netgate ) are already getting updated using the command line ( SSH or console !! ) option 13.

    @LesserBloops : I've got one for you : Auto update check, checks for updates to base system + packages and sends email alerts
    "Install" that one also. You maybe not knowing it, but you need it 😊
    Btw : you will need to install the Cron pfSense package.

    This script file tells me, as I receive a mail, if anything has an upgrade waiting. Even pfSense itself.

  • Feel free to talk about anything and everything here

    Forum Feedback Community Job Board
    3.4k
    Topics
    18.5k
    Posts

    N

    I am looking to replace my Cisco 3650 switch with something that has at least 24(x) 10Gb ports. My network consists of a pfSense firewall --> Cisco 3650, primary goal is for ultra low latency, mainly for competitive gaming.

    Besides super low switch port latency I would like the device to pull no more than 60W of power at idle, and I would like it to be somewhat quiet.

    Does anyone here own an Arista 7150, if so at idle with no ports plugged in how much power in Watts does it consume ? The spec sheet says 191W but I cant believe that.

    Last, do the fans spin down when sitting idle, or does it scream 24/7. I would likely pull 1 of the PSU's and just run a single PSU, I'd probably also pull 2 of the 4 fans. I would run 12-16 ports at 1GB, and another 4-5 ports at 10GB when all said and done.

    If anyone has other suggestions for a 24(x) 10GB switch one can get on ebay for $400 or less that is super low latency I am all ears.