Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    JonathanLeeJ
    @firefox I don’t think so, to be honest with you I am on an older version also. Just make sure you do the patch package and install all the system patches.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    M
    Hi, I had a problem with my home network today, so I checked pfsense and discovered that suricata had blocked the wan ip. After some tests and triggering some suricata alerts, the wan ip was blocked. I restarted pfsense and ran some more tests, but the problem no longer occurred. I then checked the wan interface settings and indeed the ip list does not include the wan ip, both now that it's working and before, when it was blocked. I'm using pfsense 2.8.0 and suricata 7.0.8_2. I use PPPoE to access the Internet.
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    dennypageD
    @Leon-Straathof Data retention settings are handled inside of ntopng. Documentation here. Pay attention to the RRD note. Also, if you've turned on some of the slice and dice time series information (is off by default), I'd suggest turning them back off. These balloon the storage requirements and are of little actual use.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    keyserK
    @jrey said in pfBlockerNG syslog logentries to remote SIEM: @keyser I so want to answer this, but then at the same time (no I don't) ... pfblocker using syslog messaging in real time. no tailing of files, no other packages, just code. Huuuh? That seems very very interesting I noticed your name in other posts around the forum where you seemed to be QUITE proficient at coding/developing. Are you by any chance considering involvement in developing and refining the pfBlockerNG package? It would be SO great if you are looking into adding native syslog to the pfBlockerNG package - or an easy workaround that does not require additional packages and “temporary” edits in files that does not survive service restarts or pfSense updates. Here’s that you will fill me/us in on the solution you are using to your Greylog - please, pretty please with sugar on top
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    496 Topics
    3k Posts
    R
    @provels said in updating to acme 1.0 breaks system beyond repair: need to restore from backup: This same mess happened to me, even w/o Acme, going from 25.07 to *.1. Blew, reinstalled w/ Crowdsec, blew again, reinstalled, clipped all the Crowdsec info from config.xml, restored config, back to normal. Crowdsec is a great concept, but I think I'm out. I never had this issue with Crowdec before the ACME update, even with updating from 2.7 to 2.8 there was no issues. In fact after restoring from a backup after the ACME update, Crowdsec reinstalled just fine, and this was before the recent release a couple days ago that contained a fix.
  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1
  • Discussions about the Tailscale package

    90 Topics
    606 Posts
    M
    @yobyot I've SSHed into pfsense and for the sake of testing I've simply run the command: tailscale up --auth-key=tskey-client-kQ_THE_REST_IS_A_SECRET\?preauthorized=true\&ephemeral=false --accept-dns=false --accept-routes --advertise-exit-node --advertise-routes=X.X.X.X/24 --advertise-tags=tag:pfsense Note the preauthorized=true and ephemeral=false I gave this key all permissions (temporarly as I just wanted to verify it's working) of course I had to register the tag used also in the ACL tags pane: https://login.tailscale.com/admin/acls/visual/tags so far so good
  • Discussions about WireGuard

    697 Topics
    4k Posts
    lvrmscL
    Same here. It started after I installed 25.07. Then it settled down by itself after a few days. It started again after upgrading to 25.07.1. WireGuard works fine (it merely connects to the remote site from this one). However, I am refraining from upgrading the remote, because if the 'service' does not start, I fear it will not listen to incoming connections, which would leave me in a difficult situation. The other topic I had opened before finding this: https://forum.netgate.com/topic/198449/25.07-release-amd64-wireguard-service-reported-stopped-yet-tunnel-trafic-clearly-is-ok
  • NUT on Alix 2d2 with USB/serial adapter - dead-end?

    Locked
    4
    0 Votes
    4 Posts
    5k Views
    jimpJ
    You should use /dev/cuaU0 for USB serial ports, not the tty device.
  • Can Squid bind to a LAN CARP VIP?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    marcellocM
    Listen on loopback and create a nat rule from carp to 127.0.0.1
  • PfBlocker and AntiP2P list

    Locked
    2
    0 Votes
    2 Posts
    4k Views
    marcellocM
    Increase even more the value and check what this url is returning also check pfblocker topic http://forum.pfsense.org/index.php/topic,42543.0.html
  • Does squid already have Videocache on 2.0??

    Locked
    13
    0 Votes
    13 Posts
    10k Views
    J
    Sorry for wait reply. I was trying to do a fresh install on my box but it seems my squid is not working properly. I will try again this weekend for another fresh install. I'll post what I can get after it.
  • Squid optimize

    Locked
    4
    0 Votes
    4 Posts
    4k Views
    J
    Under your Proxy Server>Cache Management>Hard Disk Cache System, try selecting null. null Does not use any storage. Ideal for Embedded/NanoBSD.
  • Start freeRadius error

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    N
    I installed freeRADIUS on i386 and amd64 and I did not have such problems. Perhaps a "Clear package lock", complete deinstallation of freeradius und clearing the config.xml from freeRADIUS entries and the a new installation of freeRADIUS solves the problem.
  • Snort enable\disable rules

    Locked
    9
    0 Votes
    9 Posts
    3k Views
    K
    You can see VRT changes here http://blog.snort.org/, here http://www.snort.org/snort-rules/#rules or here http://www.snort.org/vrt/advisories.xml/ You can see emergingthreats (open & pro) changes here http://www.emergingthreatspro.com/blog/ I am not sure about automating it to actually put it on your pfsense. Most sure way may be just to run pulledpork and sftp them over and restart. At least with pulledpork with enable and disable you can disable CVEs (i..e just disable all CVEs before a certain year if you wanted), rulesets etc. So once you go through the rules you can easily run it. It does output only 1 file for each (normal snort rules and shared object rule file) which I can see as being both good but i find it annoying and a  little less refined, especially in tuning as you could just cat an individual rule file or open it and see what is enabled/disabled (presence or lack of # to comment it out) and then make the adjustment where needed in pulledpork. Hopefully maintainer of the package will work on the updating so it remembers your changes either from GUI or provides you access to config file for disable, enable rules.
  • How to whitelist in squidguard using pfsense 2.0

    Locked
    2
    0 Votes
    2 Posts
    10k Views
    N
    Go to "Target categories" and enter all sites you want to allow/whitelist. Than go to "Group ACL" and "Common ACL" and chose "allow" or "whitelist" for this target categorie. Than "General Settings" and "Save" and "apply". PS: If an URL is in different categories and one categorie is "block" and another is "allow" than the URL will be blocked. "Block" is stronmger than "allow". To solve this problem chose "whitelist". If an URL is one times "blocked" and another time "whitelisted" than "whitelist" ist stronger.
  • Snort issues…

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    K
    thanks a lot :D I'll try it out and try to get it going. Sorry if this has been covered multiple times, I can assure you I did many many searches prior to posting this.
  • Squid/havp preventing certain downloads, help please.

    Locked
    3
    0 Votes
    3 Posts
    4k Views
    D
    The problem isn't squid, it's HAVP. from: http://forum.pfsense.org/index.php?topic=34199.0 Use the pfsense edit file tool under diagnostics and open this file:  /usr/local/pkg/havp.inc search for the following line: "$conf[] = "DetectBrokenExecutables   yes"; Change to: "$conf[] = "DetectBrokenExecutables   no"; save and restart HAVP.
  • Unbound for dual wan 2.0 setup

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    W
    You can specify which interfaces Unbound can use to do outbound queries, so if you select both the WAN interfaces then queries will be balanced across the two interfaces. However if once interface goes down then you will get delays. So you can try this what Ermal mentioned in this forum post http://forum.pfsense.org/index.php/topic,31125.msg167503.html and see if that works for you. Would be interested to know as i can then update the doc site.
  • Squid on pfsense stable or not

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    T
    I dont know why but i found my trouble relate with DNS, My clients can not resolved domain name therefore i change to other DNS.
  • HAVP and Steaming video

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    J
    Works, thanks!
  • Postfix mailrelay

    Locked
    17
    0 Votes
    17 Posts
    14k Views
    P
    @marcelloc: The location of this file in pfsense is /var/db/postfix/postscreen_cache.db Postscreen readme says that it's a temporary white list, not persistent. I pulled what I posted from the README. So, the temporary white like might be persistent if set and will be cleared if not set? Documentation seems to not be clear on that. It might be temporary as in the age thing will remove entries. I cannot test this ATM … but should be something the maintainers of postscreen could clear up.
  • HAVP Antivirus

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    S
    I have the same problem. It seems to be working perfectly and without any errors, test virus sites are detected and blocked and all functions appear to work. I set it up in transparent mode and have not tried the other proxy modes. After a number of hours it completely kills my internet connection. Stopping havp and the proxy and clearing states not fix the problem. I have to reboot my pfsense and my router. Any one has any ideas how to troubleshoot this? Package list: pfblocker snort havp vnstat I tried disabling and removing snort and pfblocker but the problem still occurred.
  • Snort Package Upgrade Ques ??

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • How do i suppress this rule

    Locked
    14
    0 Votes
    14 Posts
    4k Views
    I
    [image: FGQop.png] http://www.youtube.com/watch?v=uQ7OrxtiAes
  • Small snort alerts hack

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    D
    Made it more useful and submitted it http://redmine.pfsense.org/issues/2008 tcpdump format was problematic and doesnt add much but not having to run snort to interpret the dump would be nice. Cant get snort to dump only alert packets in binary (tcpdump) format. It wants to dump the whole world or not at all. Not sure how to make optional on alert type beyond hard coding a list or adding a checkbox to every rule or category.
  • Where would I contribute to package development funding?

    Locked
    10
    0 Votes
    10 Posts
    3k Views
    E
    No comment for now :)
  • 0 Votes
    1 Posts
    2k Views
    No one has replied
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.