1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    JonathanLeeJ

    @aGeekhere They just release Squid 7 and it is stable if you want to check it out

    "The Squid HTTP Proxy team is very pleased to announce the availability
    of the Squid-7.1 release!

    This release is, we believe, stable enough for general production use.
    We encourage all users of any previous major version of Squid to upgrade to it,
    as well as users of beta version 7.0.X.

    It can be downloaded from GitHub, at
    https://github.com/squid-cache/squid/releases/tag/SQUID_7_1

    Since version 6, Squid offers:

    better support for overlapping IP ranges and wildcard domains in acl countless security, portability, and documentation fixes

    Since version 6, some previously deprecated features have been removed:

    Edge Side Includes (ESI) access to the cache manager using the cache_object:// scheme - use
    http instead the squdclient tool - use curl
    http://<squid-address>/squid-internal-mgr/menu instead the cachemgr.cgi tool the purge tool - use the http PURGE method instead Ident protocol support basic_smb_lm_auth and ntlm_smb_lm_auth helpers - use Samba's
    ntlm_auth instead

    Further details can be found in the release notes and in the changelog

    Please remember to run "squid -k parse" when testing the upgrade to a new
    version of Squid. It will audit your configuration files and report
    any identifiable issues the new release will have in your installation
    before you "press go".

    If you encounter any issues with this release please file a bug report at
    https://bugs.squid-cache.org/

    --
    Francesco Chemolli

    squid-users mailing list
    squid-users@lists.squid-cache.org
    https://lists.squid-cache.org/listinfo/squid-users"

    I am having issues with this right now

    "I got as far as this with the make clean install no matter what I do I can’t get this package installed. I have tried pkg install heimdal same error after install and pkg install krb5 and pkg install krb5-devel. I don’t know what I am doing wrong it does the make clean for a while and crashes for the bootstrap version the other one I could get going

    ERROR: checking whether S5L_CTX_sess_set_get_cb() callback accepts a const ID argument" ... yes checking "whether X509_get0_signature() accepts const parameters" ... yes checking whether the TXT_DB use OPENSSL_PSTRING data member... yes checking whether the squid workaround for buggy versions of sk_OPENSSL_PSTRING_V alue should used... no checking whether the workaround for OpenSSL IMPLEMENT_LHASH_ macros should used ... yes configure: OpenSSL library support: yes -lcrypto -lss1 configure "Library -Kit-kros" support: no (auto) /configure: LIBHEIMDAL_KRB5_PATH+=-L/usr/lib: not found /configure: LIBHEIMDAL_KRB5_CFLAGS+=-1/usr/include: not found checking for LIBHEIMDAL_KRB5... no configure: error: Required library 'heimdal-krb5' not found ニニニン Script "configure" failed unexpectedly. Please report the problem to timp87@gmail.com maintainerl and attach the '/usr/ports/uuu/squid/uork/squid-7.1/config.log" including the output of the failure of your make command. Also, it might be a good idea to provide an overview of all packages installed on your system te.g. a /usr/local/sbin/pkg-static into -g -tal. *** Error code 1 Stop. makel1]: stopped in /usr/ports/www/squid *** Error code 1 Stop. make: stopped in /usr/ports/www/squid root@free:/usr/ports/www/squid #"

    it gets so far along and fails with this error.

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    P

    Hi. Is there any way to get Suricata working with the new PPPoE driver (available since version 2.8.0). Unfortunately, after enabling the new driver, Suricata doesn't report any alerts.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    M

    @Laxarus This worked for me as well. Though I had to search the web how to edit the file (the easiest way).

    Therefore:

    Addition for anyone struggling to find where to edit files on your pfsense system.

    Go to Diagnostics --> Edit File --> insert the location of the file:

    /usr/local/pkg/pfblockerng/pfblockerng.sh

    Go to line number 1232 by filling it in the Go to line field.

    That line should read:

    s1="$(grep -cv ^${ip_placeholder2}$ ${masterfile})"

    replace only (leave the rest intact):

    masterfile

    to

    mastercat

    Then follow the above instructions from @Laxarus https://forum.netgate.com/post/1219635

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    99 Topics
    2k Posts
    K

    @elvisimprsntr thanks for your suggestion. I will give it a try.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    johnpozJ

    @MacUsers

    https://help.zerossl.com/hc/en-us/articles/360060119933-Certificate-Revocation

    edit: oh you prob out of luck

    You can revoke any certificate issued via the ZeroSSL portal. Currently, certificates issued via ACME can not be revoked from inside the portal - please follow the instructions of your ACME client for revoking those certificates.

    the gui in pfsense does not have the ability to revoke - you prob have to move the certs to something you have certbot installed to and revoke that way.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    88 Topics
    572 Posts
    A

    We have a very basic configuration between three locations. All are running Netgate firewalls (1x 4100, 1x 6100 & 1x 4200). All are on the latest firmware (03.00.00.01-2Ct-uc-15) and system versions (24.11-RELEASE).

    The local subnets are as follows:
    4100 - 192.168.5.0/24
    4200 - 192.168.4.0/24
    6100 - 192.168.1.0/24

    The VPN traffic between the 4100 and 4200 is functioning 100% as expected

    The traffic between 6100 and the 4100 works going from the 4100 subnet (192.168.5.0/24) to the 6100 subnet (192.168.1.0/24)

    Traffic from the firewall (i.e. the 6100 device) to the 4100 subnet works (i.e. I can ping any device on the 192.168.5.0/24 subnet from the 6100 firewall) but I cannot ping any device on the 4100 (192.168.5.0/24) subnet from any device on the 6100 subnet (192.168.1.0/24) - other than from the firewall itself.

    All routes are correct, but it seems that traffic from the 192.168.1.0/24 subnet hits the firewall and then gets lost - traceroute shows that it goes off into the internet.

    Note too that the 6100 has IPsec VPN configured on it as well

    Suggestions would be appreciated

    Attached is a zipped pdf file with the relevant screenshots
    Relevant screen shots.zip

  • Discussions about WireGuard

    689 Topics
    4k Posts
    P

    @patient0 Yes, have followed that guide and infact have set up quite a few Wireguard tunnels before with no issue. The difference this time is the CGNAT. I am pretty sure its some quirk of the CGNAT that is causing this but still unsure how to diagnose.

    My firewall settings on the tunnel interfaces are correct I think and are the same as I normally use, there is no blockage there.

Log in to post
Load new posts
  • C

    Squid install problem

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S

    http://forum.pfsense.org/index.php?topic=1352.0

  • N

    Updated packages

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S

    The installed package tab will show new versions.

  • B

    Package installation

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    B

    OK, so that's the case thnx!
    I'll try BETA 4 :)

  • N

    Unable to communicate to pfSense.com

    Locked
    3
    0 Votes
    3 Posts
    7k Views
    N

    I found out why it wasn't working.
    The "Allow DNS server list to be overridden by DHCP/PPP on WAN" option was enabled in the "System: General Setup" menu.

  • S

    Freeradius

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    S

    FreeRADIUS is marked as broken.  Surely you dont' expect something marked as broken to work!?

  • F

    Pfflowd non correctly counts

    Locked
    12
    0 Votes
    12 Posts
    7k Views
    B

    @freeseacher:

    @billm:

    It's likely that pfflowd is only counting stuff that matches state.  Retransmits that got dropped for whatever reason likely don't add to the flow numbers it retains.

    pfflowd gets it's data from pfsync - I don't believe it maintains a table of inflight flows, I'm pretty sure it gets it's data from the state teardown messages.  So, the data comes directly from the PF state entry which means only data that pf forwarded itself.

    –Bill

    rules for pf was
    pass any in keep-state
    pass any out keep-state

    is there someting to miss ?

    Yes, my point ;)

    Not all packets in a given TCP flow will be considered "in state".  Consider out of window packets, out of sequence window packets (stuff that's been ack'd and had data past it acked, but was retransmitted all the same).  "normal" TCP communications do have packets that will get blocked.  I'm reasonably confident that those packets will not cound against the PF byte count for that flow.  The easiest way to determine that is to see if the PF byte count more closely matches that of the file(s) that were transferred.  If it's under, then there's a bug somewhere, if it's over, but over by less than the other accounting types (ng_netflow is going to get all packets regardless of whether pf blocks it) then it's not a bug per se, you just have to understand what/where you're monitoring.

    –Bill

  • L

    Error when installing STUNNEL

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    L

    thanks a lot Sullrich, it's OK now  ;)

  • ?

    Antivirus for PFsense

    Locked
    2
    0 Votes
    2 Posts
    7k Views
    S

    Fernando is working on it but there is no ETA.

  • R

    ClamAV

    Locked
    8
    0 Votes
    8 Posts
    8k Views
    R

    Hi,

    I have made a clamav package, it's not complete as yet and I have not added any web gui for starting or stopping or for other options in config files. As of now you can just test it from command line by running clamscan. The actual use for clamscan is for havp. As of now havp has experimental FreeBSD support and I am working on packaging it for FreeBSD. In the mean time pl test the clamav package. This is my first stab at packaging some thing for pfSense, so there will be lot's of things that can be improved.

    raj

    I am posting the clamav section from pkg_config.xml and the package configuration files.

              <package><name>clamav</name>           <website>http://www.clamav.net/</website>           <descr>Opensource anti virus</descr>           <category>Services</category>           <config_file>http://agni.linuxense.com/packages/config/clamav.xml</config_file>           <depends_on_package_base_url>http://ftp13.freebsd.org/pub/FreeBSD/ports/i386/packages-6.0-release/All</depends_on_package_base_url>           <depends_on_package>clamav-0.87.tbz</depends_on_package>           <version>0.1</version>           <status>BETA</status>           <maintainer>raj@linuxense.com</maintainer>           <configurationfile>clamav.xml</configurationfile>           <logging><facilityname>clamav</facilityname>                 <logfilename>clamav.log</logfilename></logging></package>

    config.xml

    <packagegui><name>clamav</name>         <version>0.1</version>         <title>ClamAV: Settings</title>         <include_file>/usr/local/pkg/clamav.inc</include_file>         <service><name>clamav</name>                 <rcfile>/usr/local/etc/rc.d/clamav.sh</rcfile></service>         <additional_files_needed><prefix>/usr/local/pkg/</prefix>             <chmod>0755</chmod>             http://agni.linuxense.com/packages/config/clamav.inc</additional_files_needed>         <custom_php_install_command>clamav_install_command();</custom_php_install_command>         <custom_php_deinstall_command>clamav_deinstall_command();</custom_php_deinstall_command>         <custom_delete_php_command>sync_package_clamav();</custom_delete_php_command>         <custom_php_resync_config_command>sync_package_clamav();</custom_php_resync_config_command>         <custom_add_php_command>sync_package_clamav();</custom_add_php_command></packagegui>

    clamav.inc

    function sync_package_clamav() {         conf_mount_rw();         config_lock();         global $config;         $start = "/usr/local/sbin/clamd &\n";         $stop  = "/usr/bin/killall clamd\n" .         "sleep 2";         write_rcfile(array(                           "file" => "clamav.sh",                           "start" => $start,                           "stop" =>  $stop                           )                     );         conf_mount_ro();         config_unlock();         mwexec("killall -HUP cron");         mwexec("/usr/local/etc/rc.d/clamav.sh stop");         mwexec("/usr/local/etc/rc.d/clamav.sh start"); } function clamav_install_command() {         global $config, $g;         mwexec ("mkdir -p /var/db/clamav");         mwexec ("/usr/local/bin/freshclam");         sync_package_clamav(); } function clamav_deinstall_command() {         global $config, $g;         conf_mount_rw();         unlink_if_exists("/usr/local/etc/rc.d/clamav.sh");         unlink_if_exists("/var/db/clamav/daily.cvd");         unlink_if_exists("/var/db/clamav/main.cvd");         unlink_if_exists("/var/db/clamav");         conf_mount_ro(); } ?>
  • C

    Command Line package installation

    Locked
    4
    0 Votes
    4 Posts
    6k Views
    D

    and this command line wiil not work?

    php pkg_mgr_install.php?id=packagename

  • A

    SpamD - add to whitelist working ?

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    S

    Yep, thats about it in a nutshell.

  • A

    Spamd - Add spam trap E-mail address: + nextMTA

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    S

    @Aderium:

    Add spam trap E-mail address:

    if I add a spamtrap email called spamtrap@mydomain.com do I also need to create such user in my email server ?

    No, basically if a email address is the to: address then SpamD knowns to add this servers IP to the trapped database and then further connections from that mail server will be trapped in a great tarpit which looks like a 110 baud modem communication, wasting the cpu cycles of the mail server in question.  It's neat.

    @Aderium:

    nextMTA

    my internal ip address for mailserver is 10.1.10.10  is this the IP I would add to nextMTA ?

    Yep.

  • S

    SpamD outlook button

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    H

    Install http://pfsense.com/~sullrich/SpamDOutlookAlpha/SpamD.msi . It will add the outlook plugin. You also need to have SpamD package installed at your pfSense of course.

  • R

    Might I suggest breaking out the packages to their own directories

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    B

    @ronnieredd:

    Excuse me? Why am I making you click dozens of forums? Did I do something wrong? If so, I'm sorry. Please do elaborate.

    13 packages plus the existing dozen or so forums makes for dozens of forums.  I'm old enough to remember and use BBS's, yet I still prefer email - I can sort and filter my inbox based on what I choose to read.  Which means more time spent on email worth replying to.  More forums split the attention the developers (who are still the primary support - although a few souls have certainly stepped up and chipped in on the support from) leaving us with less time to write code.  Until a package becomes enough of a nuisance filling the existing packages forum, it's really not worth splitting it out.

    –Bill

    PS. wut sullrich and hoba said

  • R

    Variables for spamd

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    S

    %A expands to the IP in the blacklist.

    Since each blacklist is added individually then you know what database url to insert for each response.

    I couldn't locate any other variables in http://www.openbsd.org/cgi-bin/man.cgi?query=spamd.conf&sektion=5 but if you come across any others, please let me know.

  • M

    Squid - Disable Access Log Patch

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    B

    @msamblanet:

    Thanks - patch form

    Sorry for all the questions for a fairly trivial patch - hopefully as my current work project calms down I can offer something of more substance…

    Commited.  Thanks

    –Bill

  • M

    Securing Package CGIs?

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    B

    @msamblanet:

    OK - thanks - I have a better sense where things are going now…as you have seen in my other email, I took the first pass option of forcing users to enable the cachemgr so you have to choose to accept the risk...

    If I ever find enough free time I am qualified to write the module you propose - but time is always the trick...my hat is off to you - I don't know how you (and many other good OpenSource authors) find the time to do this...

    An option I was toying with overnight was how one could make a PHP wrapper so that the cgi was kept outside the web directory and content was in an iframe or similar with the PHP wrapper handlng security - would even allow us to keep the pfsense menus on the screen :)  ...unfort my PHP is pretty weak (I'm just an old Asm/C/C++ dev turned Java in the current day/age) - so I don't know how hard doing the CGI calls from PHP would be...can't imagine it's too bad but caveat coder

    Hmmm…that's actually not a half bad idea.  I dunno about an iframe, but we could probably allow auth.inc to do it's job and use passthru() or something to run a cgi.  I'll have to think about that a bit.

    --Bill

  • D

    Install other packages

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    D

    Ok, thks
    Success to you in work

  • S

    Ntop errors

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    J

    Ntop has all sorts of problems.  No one is currently looking after the package as far as I know so they probably won't get fixed.  But I think something better is getting added to 1.1 anyway, maybe maybe not.

  • R

    Problem at Status>Services

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    L

    Thanks, fixed.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.