1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    I
    @andrew_cb said in haproxy 0.63_2 weird behavior, edits not working: @iSagen @TheCyborgWeasel The issue is likely the same as in https://forum.netgate.com/topic/178348/haproxy-backend-port-changes-are-not-applied/ Try adding load-server-state-from-file none to the Advanced Settings > Backend pass thru section of each backend. Great! I will do this.

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB
    @NRgia said in Suricata on Pfsense: @bmeeks Thank you for what you did for Snort or Suricata. I'm not sure what you want me to do on Redmine, due to is a bug tracker. My question is for Product Management, which I will ask it here to be public: What is the plan for these 2 packages, Suricata and Snort? Thank you Yes, Redmine is for both bug reports and feature requests. Asking for the Suricata binary to be updated to the latest 7.0.11 version from upstream is a legitimate Redmine request. I would suggest simply asking for the binary version update instead of asking about future Netgate strategy (such as the support plans for the packages). Strategy discussions typically don't get very far because they deal with proprietary information or plans that a company may not want to publicly discuss. Redmine is where the Netgate developer team tracks all the code changes they make for pfSense. They will see Redmine reports much quicker than a forum post.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    dennypageD
    @Leon-Straathof Data retention settings are handled inside of ntopng. Documentation here. Pay attention to the RRD note. Also, if you've turned on some of the slice and dice time series information (is off by default), I'd suggest turning them back off. These balloon the storage requirements and are of little actual use.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    J
    @keyser if you want the less random more static time this: the code that needs to be changed is in pfblockerng.inc best to make yourself a patch file and apply it that way , so if the package is reinstalled (updated) or whatever. you can just "verify" the patch and just reapply. I ran with this (but different time) under 24.11 when I upgraded to 25.07 just verified and re-applied the patch. if you want look to look at at the code for the lines being changed just above that "if statement" is the comment // Define pfBlockerNG MaxMind/TOP1M/ASN Cron job name the patch whatever you like and set these behaviour options [image: 1755355045857-screenshot-2025-08-16-at-10.35.14-am.png] This is the patch contents (made just for you to hit the time before 2am) --- pfblockerng.inc.orig 2025-08-16 10:30:40 +++ pfblockerng.inc 2025-08-16 10:29:52 @@ -10669,8 +10669,8 @@ if ($pfb['enable'] == 'on') { $pfb_gcmd = "/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dcc >> {$pfb['extraslog']} 2>&1"; // CRON hour is randomized between 0-23 Hour to minimize effect on Servers - $pfb_gmin = '0'; - $pfb_ghour = rand(0,23); + $pfb_gmin = '35'; + $pfb_ghour = '1'; $pfb_gmday = '*'; $pfb_gmonth = '*'; $pfb_gwday = '*'; In this I changed the time from the random top of the hour to 1 35 am (just before your 2am pfblocker update and with time to spare. However, I would recommend anything that is not at the top of the hour (0) minutes as that is when almost everything else gets scheduled.) FWIW. I also changed the "top" of the hour on my system so the pfblocker cron setting so that everything is offset by 30 minutes, and therefore don't conflict with other jobs that are also at 0 minutes (as most are) If you make this change on the dialog, then you might need to change the above, so it runs at say 1 15 am (adjust accordingly to suit your needs) pfblocker general page cron settings GUI [image: 1755356115122-screenshot-2025-08-16-at-10.53.11-am.png] next time it creates the job it will schedule it for the now not so random time of your choice. If you want to adjust the time and the patch has been applied, revert - edit the patch times (minutes/hours) only - then reapply. (unlikely you want to change the day month or week day, but if you did you would need a modified patch)

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    495 Topics
    3k Posts
    M
    @raidflex said in updating to acme 1.0 breaks system beyond repair: need to restore from backup: maybe uninstall Crowdsec when applying other updates first. It seems like it doesn't help at least from what I see on my system... it changes something.. so it must be definitely reported to their github. I have never experienced that before and crowsec was installed.. maybe with 2.8.0 something have changed

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1

  • Discussions about the Tailscale package

    90 Topics
    597 Posts
    ryan.goodfellowR
    Upgraded 25.07 and Tailscale is broken in the way users here describe. I can manually log in using sudo /usr/local/bin/tailscale login, but the tailscale service in pfSense does not pick this up and restarting the service clobbers the login state. Given 16004 was logged 7 months ago with zero activity, this is an indication that Netgate devices no longer support Tailscale.

  • Discussions about WireGuard

    693 Topics
    4k Posts
    lvrmscL
    Strangely enough, checking the system 4 days later, I now see that Wireguard service is reported running! The last thing I did 4 days ago was to disable Wireguard service monitoring by the Service Watchdog. Anyway, even when it was reported stopped at first, 4 days ago, the tunnels were working flawlessly. Very strange. I will keep an eye on it.
Log in to post
Load new posts
  • D

    Squid + Dansguardian & transparent proxy

    9
    0 Votes
    9 Posts
    8k Views
    D
    @marcelloc: @demo: No, I've tried but It doesn't work. Client can access to internet without authentication. Check your firewall rules again. clients will access internet without proxy only when firewall permits. On pf I've created a rule that redirects traffic from lan address:80 to lan address:3128 but it doesn't work. Browser, configured with proxy's automatic detection, can access to internet without any authentication or filters. So I've created a rule that blocks traffic to lan address:80 and a NAT port forward that redirects traffic from 3128 to 8080. Browser now must be configured to use 3128 port, filtered too by dansguardian. If not set, browser can't access to internet. I think it's not a good way to do what I want for my lan, but in this moment I can't find another one…
  • A

    Squid / squidguard advice needed

    7
    0 Votes
    7 Posts
    5k Views
    S
    I will look into this. I had not seen that sort of info before. Thank you!
  • bmeeksB

    Snort Pkg 2.5.8 Change Log and Screenshots

    25
    0 Votes
    25 Posts
    7k Views
    bmeeksB
    @marcelloc: @bmeeks: You can write Snort rules to block whomever you wish based on traffic content.  On the Rules tab, select "Custom Rules" in the drop-down and then create your own Snort text rules.  You must get the syntax correct before the save will be successful. I think asbirim is trying to block offenders based on snort rules but block only specific ports instead of blocking all ip traffic changing pf rule created by snort. On pfblocker I've added an option to only create alias but do not apply rules. This way sysadmin can create any rule based ou package created alias. Oh…OK.  I wasn't initially understanding his intent.  I'm not sure this idea really fits into what Snort is about, though.  Sounds more like something for one of the other packages like pfBlocker perhaps. Bill
  • B

    Snort not working on 2.1 RC0

    16
    0 Votes
    16 Posts
    5k Views
    bmeeksB
    @Mitterwald: Just did an update to the current RC0 snapshot and deinstalled snort and installed it again. The config still remained on my pfsense. But now it seems to work again. WAN is up for over 30 Minutes now, already blocked several attackers. So seems ok for me again. P.S.: I didn't changed any VMWare settings up to now. Some things changed in the latest snapshot of the RC0 release.  I have not investigated what changed, but I did notice my test 2.1RC0 box was prompting me about an update. Bill
  • S

    Squid3 and PLEX

    3
    0 Votes
    3 Posts
    2k Views
    S
    @marcelloc: Try to fill https field options. No luck with that.  Am I getting the FQDN and URI stuff correct?  The actual address that I am looking to start is something like: https://starch.hopto.org/web/ If it makes any difference that is a dynamic dns I use to keep up with my home IP as it changes often.  Would there be any issue with that?
  • I

    Squid3-dev mitm configuration

    2
    0 Votes
    2 Posts
    2k Views
    marcellocM
    @iodaddio: So if you have http/https going through squid3 proxy, I have transparent for both and mitm.  Then how does dansguardian check traffic?  It seems that once squid3 breaks into http/https it would need to send the hacked traffic to then be scanned by dansguardian…  not sure how that works.  sorry, proxy setups still mystify me. It will not, only icap/redirector calls will work as it's a ssl connection. Try squidguard or enable mitm on dansguardian(alpha code for mitm) @iodaddio: I ask because my assumption is that if I make 2 nat rules to send traffic to dansguardian. it would then be responsible for mitm, is that correct?  I think that would be setup like this: No need to do nat rules while using squid3-dev(The package will do that for you).
  • E

    Snort Memory Consumption

    2
    0 Votes
    2 Posts
    2k Views
    bmeeksB
    @ESWBitto: I'm having an issue where my snort sensors are using over 700 mb of memory each. If I only had one sensor that would not really matter, but I have 7! We've had to tweak the amount of rules and Emerging threats that are used and frankly I don't want to have to sacrifice not using all or most of the rule sets. Is this the norm? Does anyone have any suggestions on tweaking the memory usage? In the gui the selected option for the lowest memory consumption for best performance is already selected (I think it was the default) I believe I read somewhere that each sensor by default should only use 200 MB each. Bitto Snort with a lot of enabled rules and a lot of connections will eat memory.  There are settings that can be tweaked to improve this a bit, but nothing beats having at least 4 GB of RAM per sensor.  RAM is pretty cheap these days anyway. Also, there is no point in trying to run all the rules (both ET and Snort VRT).  I'm sure there are partisans on both sides of the issue who will swear one set is better than the other (ET vs. VRT), but you might consider choosing Snort VRT with the IPS-Connectivity policy to start with.  That will catch most stuff and not give a lot of false positives.  As you gain experience with Snort and its behavior with your specific network traffic, you can bump up to the IPS-Balanced or even IPS-Security policies.  Just be aware that these are likely to start giving false positives and need tuning. Here is a link about hardware sizing for Snort:  http://mikelococo.com/2011/08/snort-capacity-planning/ Bill
  • N

    OpenVPN Client Export Utility - Option Requests

    3
    0 Votes
    3 Posts
    2k Views
    N
    Figure that since the http-proxy option is already there it shouldn't be to much to just make proxy type selectable.  (http proxy or socks proxy)
  • D

    Squid3 Dynamic Content Cachine Profiles

    3
    0 Votes
    3 Posts
    1k Views
    D
    that would be terrific.
  • G

    Squidguard error page external redirect - no images

    1
    0 Votes
    1 Posts
    974 Views
    No one has replied
  • B

    Bug in squid in trasparent mode? No redirect if…

    1
    0 Votes
    1 Posts
    753 Views
    No one has replied
  • F

    DansGuardian Authentication in Windows.

    5
    0 Votes
    5 Posts
    2k Views
    F
    @marcelloc: @friskee: Any ideas? you do not need wbinfo -u. It will work only on small user lists. wbinfo -t is all you need to know if it is running or not. how do I know that it can successfully pull users from active directory?
  • L

    Squid.conf Bungled acl safeports

    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • marcellocM

    Patch to show Available Packages by category on pfsense 2.1

    12
    0 Votes
    12 Posts
    4k Views
    jimpJ
    Defaulting to a restricted one-category list tab does a few bad things (and probably more I'm not thinking of): 1. As mentioned previously, people will not see the tabs and wonder where packages disappeared to. 2. People will have to hunt through multiple tabs to find a package if they don't know and can't correctly guess the package category. What took two clicks before suddenly takes half a dozen and a lot more time. 3. It makes it less obvious just how many awesome packages there are. The giant list makes us look good there. :-) I would not use tabs at all, but do search and include categories in the search. Your "tabs" could now just be shortcut links to search the category, or a search filter that does the same job. Best thing, I think, would be that the default should be 'all packages' but have a search box right at the top. Maybe a drop down to restrict by category but it would have "All packages" as its first choice. Perhaps something like: [ Text Box For Search ] [Category Drop-Down] [ "Go"/"Search" button ] Enter search terms to filter the list, or select the category from the box, press search (no text entry) would display all packages in the category. Since the entire list of packages is known before the page is rendered, that could all be done in javascript and could do autocomplete or immediate filtering (meaning it could look like AJAX but doesn't actually make additional calls)
  • N

    Openvpn speed differences between full install & nanobsd

    3
    0 Votes
    3 Posts
    1k Views
    N
    thank you. it's weird though because i don't see a cpu spike when i download a large file over vpn on the 1 ghz system.
  • A

    Open-VM-Tools [Stable 8.7.0.3046 (build-425873)platform: 2.0]

    9
    0 Votes
    9 Posts
    2k Views
    A
    If I am not mistaken, VMware had provided the drivers for FreeBSD. Don't get me wrong here.. VMTools works, not sure what one gains by installing it other then adding drivers for network cards. I can understand VMware tools for Windows etc. but for pfSense my main goal was for VXN. If the drivers don't work, I don't want to install VMTools and break my baby ;)
  • T

    PfBlocker disabled pf when router was booted with no internet

    8
    0 Votes
    8 Posts
    2k Views
    T
    I was able to reproduce this on a test router, and I have posted this at: http://forum.pfsense.org/index.php/topic,42543.msg340581.html#msg340581
  • B

    OpenVPN Client Export Settings

    5
    0 Votes
    5 Posts
    2k Views
    B
    Thank you, found it.
  • T

    Snort update page & footer div

    6
    0 Votes
    6 Posts
    2k Views
    T
    Thanks.
  • S

    Tuning Dan's Guadian

    3
    0 Votes
    3 Posts
    1k Views
    R
    @SoFlo1: I'm having a few of problems with DG and wondered if there wasn't a tweaking/tuning guide somewhere that works through all these issues. First, the Japanese porn weighted phrase list was triggering on all kinds of random crap - like shopping for shelves at homedepot.com. So I turn that off only to find other weighted lists that keep triggering on completely random stuff. Are there better weighted lists than what the DG package for pfSense ships with are are they just generally known to be pretty useless? Anyway, the other problem is with weighted phrases turned on, certain sites like reddit get all munged - reduced to a simple links-only kind of rendering, some graphics but no layout. The other, other problem I'm having is inline JPEGs stripped out, but not other MIME types. I'm sure this is a setting somewhere but it doesn't seem to be as obvious to find as I would have thought. I'm sure everyone's run across these and more so maybe you could just point me to a "living with dansguardian" link before I give up? Thanks. I'm fairly confident this is something to do with your configuration… been using it for years with none of these issues.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.