1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    E
    I even tried deleting and creating a new certificate. Any suggestions?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB
    It was all CVE fixes in the PHP GUI part of the package. See the Redmine ticket here: https://redmine.pfsense.org/issues/16414.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    572 Topics
    3k Posts
    keyserK
    @Antibiotic No it’s not possible with NtopNG as it is not a Netflow collector. You need nProbe for that which will “translate” recieved netflows into flows that NtopNG understands and can visualize (with very very little detail might I add as Netflows has no additonal information apart from sender/reciever and volume). The NtopNG package and the product in general is more geared towards visualising and recording traffic details from actual packet captures. This contains MUCH more metadata about the sessions than netflows (DNS names, protocol information and myriads of other things). But pffSense Plus has a builtin Netflow exporter if you have an external netflow collector on hand.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    V
    @Gertjan Thanks for your reply – that’s also my impression. The point is: I don’t really see any lists right now that are actually “maintained” in the sense of being actively cleaned up, checked for dead domains, categorized, etc. That’s why my main interest is more about the demand: Would curated lists really be a game changer for admins? Would they be more helpful than what’s available today, or are most people already using other alternatives? If so, which ones? And from your perspective, what would be your expectation towards “community lists”? (e.g. reliability, update frequency, categories, fewer false positives?)

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    501 Topics
    3k Posts
    A
    Hi, Please help to forward / report the bugs in ACME 1.0 package. Thanks.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1

  • Discussions about the Tailscale package

    90 Topics
    610 Posts
    E
    Updated CE 2.7.2 to 1.86.4_1 Changelog pkg add -f https://pkg.freebsd.org/FreeBSD:14:amd64/latest/All/tailscale-1.86.4_1.pkg Freshports

  • Discussions about WireGuard

    700 Topics
    4k Posts
    Bob.DigB
    @HFADmin If it is no Site2Site-VPN then you don't need any gateways in the first place... If that is true but you want to monitor the connection then you could create dummy-gateways just to ping the remote ip-addresses.
Log in to post
Load new posts
  • N

    Redirction loop with SquidGuard rewrite option

    1
    0 Votes
    1 Posts
    611 Views
    No one has replied
  • D

    Can't access ISP's IPv6 DNS servers (pfblocker issue?)

    2
    0 Votes
    2 Posts
    1k Views
    D
    Problem resolved. My IPv6 was released by my ISP, for some reason. Hence, I couldn't ping ANY IPv6 addresses, I just noticed the DNS issues first. After a restart of the cable modem, and pfsense box, everything is operating as expected.
  • C

    Add packages using pkg_add

    2
    0 Votes
    2 Posts
    988 Views
    C
    Any one? Nobody knows?
  • S

    Same error with Snort and Suricata

    2
    0 Votes
    2 Posts
    1k Views
    bmeeksB
    @supermega: Hi guys I'm trying to implement an IDS/IPS system on my pfsense box. For me  it's doesn't matter if I use Snort or Suricata in the future. I started first with snort and because snort wasn't working I tried suricata. I have seen that both packages gave me back the same error. If I start snort or suricata (interface only or trough status –> service) the services doesn't start. (nothing happen, red cross stays there) Following error if I try to start Suricata via shell: [2.1.4-RELEASE][root@XXX-pfs-1.XXX.local]/root(13): /bin/sh /usr/local/etc/rc.d/suricata.sh start 7/8/2014 – 16:22:27 - <info>- This is Suricata version 1.4.6 RELEASE 7/8/2014 -- 16:22:27 - <info>- CPUs/cores online: 2 7/8/2014 -- 16:22:27 - <info>- Live rule reloads enabled 7/8/2014 -- 16:22:27 - <info>-- allocated 1572864 bytes of memory for the defrag hash... 65536 buckets of size 24 7/8/2014 -- 16:22:27 - <info>-- preallocated 65535 defrag trackers of size 120 7/8/2014 -- 16:22:27 - <info>-- defrag memory usage: 9437064 bytes, maximum: 33554432 7/8/2014 -- 16:22:27 - <info>-- AutoFP mode using "Active Packets" flow load balancer 7/8/2014 -- 16:22:27 - <error>-- [ERRCODE: SC_ERR_ADDRESS_ENGINE_GENERIC(89)] - failed to parse address "fe80::250:56ff:fe9e:43df%em0" 7/8/2014 – 16:22:27 - <error>-- [ERRCODE: SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - failed to parse address var "HOME_NET" with value "[8.8.8.8,10.0.0.0/24,10.0.0.252/24,10.0.2.0/24,10.0.2.252/24,10.0.3.0/24,10.0.3.252/24,10.0.4.0/24,10.0.4.252/24,10.0.5.0/24,10.0.5.252/24,10.0.6.0/24,10.0.6.252/24,10.0.7.0/24,10.0.7.252/24,10.0.8.0/24,10.0.8.252/24,10.0.9.0/24,10.0.9.252/24,127.0.0.1,172.16.0.0/16,172.16.1.252/16,192.168.1.0/24,192.168.77.0/24,194.246.118.118,212.25.27.51,212.25.28.55,212.25.29.73,212.25.29.74/32,2001:XXX:40:304::dead:beef,2001:XXX:80::dead:beef,2001:XXX:XXX::1fe/120,2001:XXX:XXX::2fc/120,2001:XXX:XXX::3fc/120,2001:XXX:XXX::4fc/120,2001:XXX:XXX::5fc/120,2001:XXX:XXX::6fc/120,2001:XXX:XXX::7fc/120,2001:XXX:XXX::8fc/120,2001:XXX:XXX::9fc/120,2001:XXX:XXX::100/120,2001:XXX:XXX::200/120,2001:XXX:XXX::300/120,2001:XXX:XXX::400/120,2001:XXX:XXX::500/120,2001:XXX:XXX::600/120,2001:XXX:XXX::700/120,2001:XXX:XXX::800/120,2001:XXX:XXX::900/120,2001:4860:4860::8888,fd34:fe56:7891:2f3a::/64,fe80::250:56ff:fe9e:43df%em0]". Please check it's syntax 7/8/2014 – 16:22:27 - <error>-- [ERRCODE: SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - basic address vars test failed. Please check /usr/pbi/suricata-amd64/etc/suricata/suricata_29766_em1/suricata.yaml for errors On snort I doesn't get any messages but I saw the same error (failed to parse address) in previous versions of snort. In the System Logs I'm not able to see any errors from snort or suricata. Hopefully somebody can help me out. regards supermega</error></error></error></info></info></info></info></info></info></info> There is currently an issue with IPv6 Link Local addresses in both packages.  I have a fix for Snort posted that is awaiting review and approval by the pfSense Developer Team.  Hopefully they can get it approved and posted in a few days. I also have a fix for Suricata in the works that will come out with the next update. If you know how to transfer files over to your firewall via scp (secure copy), then PM me and I can send you the Snort fix and you can help me test it. Bill
  • panzP

    SNORT (spp_frag3) Fragmentation overlap (again and again and again)

    8
    0 Votes
    8 Posts
    7k Views
    bmeeksB
    @panz: Sorry, I didn't ask my question with the right words. Q: is there a method to setup SNORT in a manner that it will alert me for fragmented packets even if I disabled the frag3 engine detection? No, that frag3 engine is where those alerts come from. Bill
  • P

    Privileges by Groups of user

    4
    0 Votes
    4 Posts
    1k Views
    KOMK
    Well, Squid and SquidGuard are common FOSS packages for doing caching and filtering, so you could actually download those packages and try for yourself.  Or, you could use a search engine to read up on the documentation to get most of your answers. Yes, you can create custom groups.  No, there is not just one common profile/group.  Look into Group ACL.
  • J

    Unable to find "onatproto" package on the "available package" tab

    2
    0 Votes
    2 Posts
    1k Views
    BBcan177B
    Did you see this thread: https://forum.pfsense.org/index.php?topic=78935.msg431084#msg431084 "FreeBSD is moved them to ftp-archive since the release is no longer officially supported upstream."
  • Z

    Snort not working on the LAN interface?

    5
    0 Votes
    5 Posts
    2k Views
    bmeeksB
    @zerodamage: I am trying to figure out why my Snort will not work on the LAN interface. I originally had it running on the WAN interface and it worked fine. I noticed some alerts with regards to Trojan but the source IP was my WAN interface, not the culprit within my network. So I made a LAN interface and used the same IPS policy (connectivity) and rules (I have a Snort subscription) and I get no alerts. The interface goes active without any issues but I do not receive any alerts at all.  This is my home network so it isn't the end of the world but I would like for it to work. This is how my network is laid out: LAN => WAP / Switch => pfSense / Snort => Internet There may simply be nothing too nefarious happening in your LAN.  I get maybe one or two alerts per week on my LAN.  I get a ton on my WAN, but that's because I run some IP Reputation rules there and known spammer and other malicious IPs make connection attempts.  Also remember that Snort puts the interface it runs on in promiscuous mode, so that would mean the WAN sees a lot of extra stuff, for example. If you want to test Snort on your LAN, install a tool like nmap on a host and scan your firewall.  That should trigger some alerts. Bill
  • C

    Snort inline mode

    6
    0 Votes
    6 Posts
    4k Views
    BBcan177B
    While the packet can't be dropped, any open states in the firewall can be killed. I hope the devs implement those changes.
  • R

    NMAP doesn't scan all ports

    2
    0 Votes
    2 Posts
    883 Views
    jimpJ
    Unless your PC is actually listening for a connection from anywhere on port 21, then nmap won't see that as "open". To nmap, "open" means that a service is waiting for inbound connections and accepts them (listening on a port), such as a web server or FTP server on the IP being scanned. If your client has a connection "open" to a remote server, that isn't something nmap can see as it's a fundamentally different concept.
  • Z

    Suricata unable to install Snort VRT rules

    2
    0 Votes
    2 Posts
    2k Views
    BBcan177B
    See the following thread: https://forum.pfsense.org/index.php?topic=79918.0#lastPost
  • N

    Squid3-dev Transparent Mode

    5
    0 Votes
    5 Posts
    2k Views
    N
    @KOM: Enable Squid3-dev Transparent Proxy then disable SquidGuard3.  Does it work now?  Squid by itself doesn't do any blocking, only caching.  SquidGuard does the blocking. I have disabled the SquidGuard, Set the proxy interface as LAN in squid and enabled Transparent mode, No SSL filtering. It still gives the same error i.e TCP_MISS 403 @KOM: Here's the thing about SSL filtering.  To do it, you will need to do one of the following: install a certificate on every client, or set the proxy server on every client You have to touch the client one way or the other, so you may as well use Squid2 which is stable.  Block off outgoing port 80 so that only the proxy has web access, set the proxy server for all your static IP clients and then set up WPAD for DHCP clients. I believe that HTTPS bypasses Squid unless you have it manually set to be your proxy or you're running transparently with a cert installed.  Same reason why setting a domain block in SquidGuard doesn't work for HTTPS.  HTTPS creates a point-to-point encrypted tunnel between you and the external server.  Squid has no idea what's going on unless it's "inside" the encrypted tunnel, and it can only do that if you have your client it manually set to use pfSense as your web proxy, or if you're using a certificate on the client to trust your pfSense server. I will surely try this method. SquidGuard or SquidGuard-devel has to be used with Squid2. because those two SquidGuard versions might not work with Squid3
  • arrmoA

    Apache breaks WebConfigurator?

    8
    0 Votes
    8 Posts
    1k Views
    arrmoA
    Makes complete sense, and agree with you! This is a smaller (home) environment, so having a separate machine just to serve a web page or two is a bit of an overkill … ;). Thanks!
  • T

    Multiple problems with Suricata service - (instability and crashes)

    11
    0 Votes
    11 Posts
    4k Views
    T
    It crashed a few times on my guest wifi network. 3/8/2014 -- 14:37:18 - <info> -- allocated 786432 bytes of memory for the defrag hash... 65536 buckets of size 12 3/8/2014 -- 14:37:18 - <info> -- preallocated 65535 defrag trackers of size 88 3/8/2014 -- 14:37:18 - <info> -- defrag memory usage: 6553512 bytes, maximum: 33554432 3/8/2014 -- 14:37:18 - <info> -- AutoFP mode using "Active Packets" flow load balancer 3/8/2014 -- 14:37:18 - <info> -- preallocated 1024 packets. Total memory 3135488 3/8/2014 -- 14:37:18 - <info> -- allocated 49152 bytes of memory for the host hash... 4096 buckets of size 12 3/8/2014 -- 14:37:18 - <info> -- preallocated 1000 hosts of size 60 3/8/2014 -- 14:37:18 - <info> -- host memory usage: 109152 bytes, maximum: 16777216 3/8/2014 -- 14:37:18 - <info> -- allocated 786432 bytes of memory for the flow hash... 65536 buckets of size 12 3/8/2014 -- 14:37:18 - <info> -- preallocated 10000 flows of size 144 3/8/2014 -- 14:37:18 - <info> -- flow memory usage: 2226432 bytes, maximum: 33554432 3/8/2014 -- 14:37:18 - <info> -- IP reputation disabled 3/8/2014 -- 14:37:18 - <info> -- Added "35" classification types from the classification file 3/8/2014 -- 14:37:18 - <info> -- Added "19" reference types from the reference.config file 3/8/2014 -- 14:37:18 - <info> -- using magic-file /usr/share/misc/magic 3/8/2014 -- 14:37:18 - <info> -- Delayed detect disabled 3/8/2014 -- 14:37:45 - <info> -- 2 rule files processed. 14865 rules successfully loaded, 0 rules failed 3/8/2014 -- 14:38:47 - <info> -- 14873 signatures processed. 891 are IP-only rules, 4227 are inspecting packet payload, 11353 inspect application layer, 0 are decoder event only 3/8/2014 -- 14:38:47 - <info> -- building signature grouping structure, stage 1: adding signatures to signature source addresses... complete 3/8/2014 -- 14:38:52 - <info> -- building signature grouping structure, stage 2: building source address list... complete 3/8/2014 -- 14:39:46 - <info> -- building signature grouping structure, stage 3: building destination address lists... complete 3/8/2014 -- 14:40:03 - <info> -- Threshold config parsed: 0 rule(s) found 3/8/2014 -- 14:40:03 - <info> -- Core dump size is unlimited. 3/8/2014 -- 14:40:03 - <info> -- fast output device (regular) initialized: alerts.log 3/8/2014 -- 14:40:03 - <info> -- http-log output device (regular) initialized: http.log 3/8/2014 -- 14:40:03 - <info> -- Using 1 live device(s). 3/8/2014 -- 14:40:04 - <info> -- using interface ath0_wlan1 3/8/2014 -- 14:40:04 - <info> -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets. 3/8/2014 -- 14:40:04 - <info> -- Found an MTU of 1500 for 'ath0_wlan1' 3/8/2014 -- 14:40:04 - <info> -- Set snaplen to 1500 for 'ath0_wlan1' 3/8/2014 -- 14:40:04 - <info> -- RunModeIdsPcapAutoFp initialised 3/8/2014 -- 14:40:04 - <info> -- stream "max-sessions": 262144 3/8/2014 -- 14:40:04 - <info> -- stream "prealloc-sessions": 32768 3/8/2014 -- 14:40:04 - <info> -- stream "memcap": 33554432 3/8/2014 -- 14:40:04 - <info> -- stream "midstream" session pickups: disabled 3/8/2014 -- 14:40:04 - <info> -- stream "async-oneside": disabled 3/8/2014 -- 14:40:04 - <info> -- stream "checksum-validation": disabled 3/8/2014 -- 14:40:04 - <info> -- stream."inline": disabled 3/8/2014 -- 14:40:04 - <info> -- stream.reassembly "memcap": 67108864 3/8/2014 -- 14:40:04 - <info> -- stream.reassembly "depth": 0 3/8/2014 -- 14:40:04 - <info> -- stream.reassembly "toserver-chunk-size": 2560 3/8/2014 -- 14:40:04 - <info> -- stream.reassembly "toclient-chunk-size": 2560 3/8/2014 -- 14:40:04 - <info> -- all 2 packet processing threads, 1 management threads initialized, engine started. 3/8/2014 -- 14:40:04 - <info> -- Signal Received.  Stopping engine. 3/8/2014 -- 14:40:04 - <info> -- 0 new flows, 0 established flows were timed out, 0 flows in closed state 3/8/2014 -- 14:40:04 - <info> -- time elapsed 0.261s 3/8/2014 -- 14:40:04 - <info> -- (RxPcapath0_) Packets 0, bytes 0 3/8/2014 -- 14:40:04 - <info> -- (RxPcapath0_) Pcap Total:0 Recv:0 Drop:0 (nan%). 3/8/2014 -- 14:40:04 - <info> -- AutoFP - Total flow handler queues - 1 3/8/2014 -- 14:40:04 - <info> -- AutoFP - Queue 0  - pkts: 0            flows: 0          3/8/2014 -- 14:40:04 - <info> -- Stream TCP processed 0 TCP packets 3/8/2014 -- 14:40:04 - <info> -- Fast log output wrote 0 alerts 3/8/2014 -- 14:40:04 - <info> -- HTTP logger logged 0 requests 3/8/2014 -- 14:40:04 - <info> -- host memory usage: 109152 bytes, maximum: 16777216 3/8/2014 -- 14:40:05 - <info> -- cleaning up signature grouping structure... complete 3/8/2014 -- 14:40:06 - <error> -- [ERRCODE: UNKNOWN_ERROR(87)] - Child died unexpectedly</error></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info></info> That's a wifi interface off Pfsense
  • N

    Enforcing Youtube Safety Mode

    17
    0 Votes
    17 Posts
    9k Views
    N
    @sowen: Well…yes, no and maybe.... the header rewrite $rewrite_item[] = array(F_TARGETURL => '(http://www.youtube.com/watch?v=.*)',        F_REPLACETO => '\1&edufilter=XXXXXXXXXXXXXXXXXXXXXXXX', F_MODE => 'i'); Forces the users to use your specific educational channel, which you can then control. However, I do not know how to rewrite the header to force all proxy users to use "safety mode". YouTube Safety Mode is enforced by rewriting a specific cookie in client request headers, while SafeSearch (for google etc...) is enforced by simply adding a string to the request URL (which is what the edufilter filtering does). a quick google of "rewrite youtube header to use safety mode" brings up some info, but most of it is at least a couple years old and I'm not sure how (or if) it could be implemented in pfSense / squidguard. Youtube Safe Search RewriteCond URL .youtube.com. RewriteHeader Cookie: (.*) PREF=f2=8000000 RewriteRule (.)?youtube.com(.?.*) $1youtube.com$2&safety_mode=true [I,L] ; === Safety Mode for YouTube ===     <proxy bc_safesearch_youtube_cookies="">url.domain=youtube.com     request.header.cookie="PREF=" action.BC_SafeSearch_YouTube_Cookie_Rewrite(yes)     action.BC_SafeSearch_YouTube_Cookie_append(yes)           define action BC_SafeSearch_YouTube_Cookie_Rewrite           rewrite( request.header.Cookie, "(PREF=[^,]+)", "$(1)&f2=8000000" )           end           define action BC_SafeSearch_YouTube_Cookie_append           append( request.header.Cookie, "PREF=f2=8000000" )           end ; === End of Safety Mode for YouTube === ***********************</proxy> Do I need edit cookies in the individual browser? If so, then its not an feasible option because cookies will erased if we clear the history. Somehow SquidGuard has to come up with the solution for this.
  • D

    Squid revers proxy with multiple domains

    1
    0 Votes
    1 Posts
    678 Views
    No one has replied
  • B

    [cron?] automatic Restart of HAPROXY if ping fails…

    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • I

    SNORT Bug?

    14
    0 Votes
    14 Posts
    2k Views
    BBcan177B
    @canux: Thanks for the info.  Do you have a paid subscription as well? Yes I use a Snort VRT and ET Pro subscription. Some of the other boxes I have use the Open Snort and ET Rulesets. Did you upgrade Snort to the latest version? There were two releases fairly recently.
  • S

    Error 422 - Snort VRT Updates - SOLVED

    2
    0 Votes
    2 Posts
    3k Views
    S
    This issue can be corrected by upgrading to Snort 2.9.6.2 pkg v3.1.1. ;D
  • D

    Proxy blocking https

    1
    0 Votes
    1 Posts
    538 Views
    No one has replied
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.