1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    I
    @andrew_cb said in haproxy 0.63_2 weird behavior, edits not working: @iSagen @TheCyborgWeasel The issue is likely the same as in https://forum.netgate.com/topic/178348/haproxy-backend-port-changes-are-not-applied/ Try adding load-server-state-from-file none to the Advanced Settings > Backend pass thru section of each backend. Great! I will do this.

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB
    @NRgia said in Suricata on Pfsense: @bmeeks Thank you for what you did for Snort or Suricata. I'm not sure what you want me to do on Redmine, due to is a bug tracker. My question is for Product Management, which I will ask it here to be public: What is the plan for these 2 packages, Suricata and Snort? Thank you Yes, Redmine is for both bug reports and feature requests. Asking for the Suricata binary to be updated to the latest 7.0.11 version from upstream is a legitimate Redmine request. I would suggest simply asking for the binary version update instead of asking about future Netgate strategy (such as the support plans for the packages). Strategy discussions typically don't get very far because they deal with proprietary information or plans that a company may not want to publicly discuss. Redmine is where the Netgate developer team tracks all the code changes they make for pfSense. They will see Redmine reports much quicker than a forum post.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    dennypageD
    @Leon-Straathof Data retention settings are handled inside of ntopng. Documentation here. Pay attention to the RRD note. Also, if you've turned on some of the slice and dice time series information (is off by default), I'd suggest turning them back off. These balloon the storage requirements and are of little actual use.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    J
    @keyser if you want the less random more static time this: the code that needs to be changed is in pfblockerng.inc best to make yourself a patch file and apply it that way , so if the package is reinstalled (updated) or whatever. you can just "verify" the patch and just reapply. I ran with this (but different time) under 24.11 when I upgraded to 25.07 just verified and re-applied the patch. if you want look to look at at the code for the lines being changed just above that "if statement" is the comment // Define pfBlockerNG MaxMind/TOP1M/ASN Cron job name the patch whatever you like and set these behaviour options [image: 1755355045857-screenshot-2025-08-16-at-10.35.14-am.png] This is the patch contents (made just for you to hit the time before 2am) --- pfblockerng.inc.orig 2025-08-16 10:30:40 +++ pfblockerng.inc 2025-08-16 10:29:52 @@ -10669,8 +10669,8 @@ if ($pfb['enable'] == 'on') { $pfb_gcmd = "/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dcc >> {$pfb['extraslog']} 2>&1"; // CRON hour is randomized between 0-23 Hour to minimize effect on Servers - $pfb_gmin = '0'; - $pfb_ghour = rand(0,23); + $pfb_gmin = '35'; + $pfb_ghour = '1'; $pfb_gmday = '*'; $pfb_gmonth = '*'; $pfb_gwday = '*'; In this I changed the time from the random top of the hour to 1 35 am (just before your 2am pfblocker update and with time to spare. However, I would recommend anything that is not at the top of the hour (0) minutes as that is when almost everything else gets scheduled.) FWIW. I also changed the "top" of the hour on my system so the pfblocker cron setting so that everything is offset by 30 minutes, and therefore don't conflict with other jobs that are also at 0 minutes (as most are) If you make this change on the dialog, then you might need to change the above, so it runs at say 1 15 am (adjust accordingly to suit your needs) pfblocker general page cron settings GUI [image: 1755356115122-screenshot-2025-08-16-at-10.53.11-am.png] next time it creates the job it will schedule it for the now not so random time of your choice. If you want to adjust the time and the patch has been applied, revert - edit the patch times (minutes/hours) only - then reapply. (unlikely you want to change the day month or week day, but if you did you would need a modified patch)

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    495 Topics
    3k Posts
    M
    @raidflex said in updating to acme 1.0 breaks system beyond repair: need to restore from backup: maybe uninstall Crowdsec when applying other updates first. It seems like it doesn't help at least from what I see on my system... it changes something.. so it must be definitely reported to their github. I have never experienced that before and crowsec was installed.. maybe with 2.8.0 something have changed

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1

  • Discussions about the Tailscale package

    90 Topics
    596 Posts
    V
    With Tailscale, I just recommend sticking with the FreeBSD15 version. Yes, it may currently work using the FreeBSD 14 package despite being on 15, but any number of other updates could result in that not being the case anymore. Not to mention the fact that any updates newer than 1.84.2_1 don't really impact functionality for what people would be using Tailscale for with PfSense so updating past that is not an absolute necessity. I run 1.86.4 on my desktop+phone and 1.84.2_1 on my pfsense router. Phone commonly uses the PfSense router as an exit node and there's no difference for PfSense. TL;DR: Better to be safe than sorry and stick with the FreeBSD 15 version even if it's not the latest version of Tailscale.

  • Discussions about WireGuard

    693 Topics
    4k Posts
    lvrmscL
    Strangely enough, checking the system 4 days later, I now see that Wireguard service is reported running! The last thing I did 4 days ago was to disable Wireguard service monitoring by the Service Watchdog. Anyway, even when it was reported stopped at first, 4 days ago, the tunnels were working flawlessly. Very strange. I will keep an eye on it.
Log in to post
Load new posts
  • L

    Squid Block log deleted or name changed

    Locked
    10
    0 Votes
    10 Posts
    4k Views
    D
    Updated.
  • A

    Ntop filter out opt1 interface and settings

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • J

    Snort IP Block will not work with the latest 2.0 snapshots built on the 15th

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    jimpJ
    If it's the amd64 snapshot from very late on the 15th ("Tue Feb 15 23:25:41 EST 2011") or and i386 snapshot from the 16th ("Wed Feb 16 02:41:43 EST 2011") it should be OK again.
  • K

    Squid Custom Rule refresh_pattern help needed

    Locked
    7
    0 Votes
    7 Posts
    17k Views
    K
    Sorry For late reply. These are my refresh pattern rules…. refresh_pattern -i .(gif|png|jpg|jpeg|ico) 43200 90% 129600 ignore-reload ignore-no-cache ignore-private; refresh_pattern -i .(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv|mpg|wma|ogg|wmv|asx|asf) 43200 90% 432000 override-expire ignore-reload ignore-no-cache ignore-private; refresh_pattern -i .(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff|pdf|jar) 43200 90% 129600 override-expire ignore-reload ignore-no-cache ignore-private; To avoid no-cache response from servers & increase hit rate. Note: "ignore-private" command may give a warning message as "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP". I just Ignored it. refresh_pattern .dnl..geo.kaspersky.com/..(zip|avc|kdc) 2160 100% 10080 ignore-no-cache reload-into-ims; refresh_pattern ..avg.com/..(bin) 2160 100% 10080 ignore-no-cache reload-into-ims; refresh_pattern ..avast.com/..(vpu|vpaa) 2160 100% 10080 ignore-no-cache reload-into-ims; refresh_pattern ..kaspersky-labs.com/..(cab|zip|exe|msi|msp) 4320 100% 43200 ignore-no-cache reload-into-ims; refresh_pattern ..kaspersky.com/..(cab|zip|exe|msi|msp|avc) 2160 100% 10080 ignore-no-cache reload-into-ims; refresh_pattern ..nai.com/.*.(gem|zip|mcs) 2160 100% 10080 ignore-no-cache reload-into-ims; Anti virus update Cache Not so much luck Only 5% hit increased. Its only 3 days i am running my pfsense box. HOPE BETTER PERFORMANCE AFTER SOME DAYS. any suggestion is much appreciable. Thanks in advance.
  • M

    Squidguard deny report

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    D
    It is not envisaged.
  • M

    Log (not block) porn, time-wasting sites

    Locked
    8
    0 Votes
    8 Posts
    6k Views
    R
    @hugo: @mellow-yellow: I need to log, not block porn, gambling, facebook, and related (i.e. "time-wasting sites" as our management calls them) websites. We want to know WHO (reverse IP is fine) is viewing them and WHEN (squid). We already have pfsense, squid, and lighttpd running. These forums seem to recommend openDns or squidguard. However those products, while excellent, appear to block, not simply log such sites. lighttpd is also excellent, but it returns too many websites, since we're not interested in employees' visiting our already approved sites, including gmail, yahoo, google, etc, which represent 95% or more of the traffic. In short, how can we simply log, not block, such sites? There are specific software applications that can do that… One of them is: MyPornBlocker. Which has many options and can log access to time wasting sites and even take screenshots. That site and software sounds like a scam site or something that are trying to sell useless software to a high price to protective parents and that tip is also useless because the topic is about a BSD firewall, not a Windows client. // rancor
  • A

    PhpSysInfo from WAN?

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    A
    Any ideas? I still want to do this…
  • F

    What commands to use to properly stop/start freeswitch via Cron?

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Q

    SquidGuard Blacklists

    Locked
    13
    0 Votes
    13 Posts
    7k Views
    Q
    Oh thanks. :) # Do not edit manually ! http_port 10.10.200.254:8080 icp_port 0 pid_filename /var/run/squid.pid cache_effective_user proxy cache_effective_group proxy error_directory /usr/local/etc/squid/errors/English icon_directory /usr/local/etc/squid/icons visible_hostname ffdfw002 cache_mgr ithelp@dontcare.com access_log /var/log/httpproxy/access.log cache_log /var/log/httpproxy/cache.log cache_store_log none logfile_rotate 8 shutdown_lifetime 3 seconds # Allow local network(s) on interface(s) acl localnet src  10.10.200.0/255.255.255.0 uri_whitespace strip cache_mem 512 MB maximum_object_size_in_memory 32 KB memory_replacement_policy lru cache_replacement_policy lru cache_dir aufs /var/squid/cache 2500 16 256 minimum_object_size 0 KB maximum_object_size 1024 KB offline_mode off cache_swap_low 90 cache_swap_high 95 # No redirector configured # Setup some default acls acl all src 0.0.0.0/0.0.0.0 acl localhost src 127.0.0.1/255.255.255.255 acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 1025-65535 acl sslports port 443 563  acl manager proto cache_object acl purge method PURGE acl connect method CONNECT acl dynamic urlpath_regex cgi-bin \? acl allowed_subnets src 10.10.200.0/24 cache deny dynamic http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !safeports http_access deny CONNECT !sslports # Always allow localhost connections http_access allow localhost request_body_max_size 0 KB reply_body_max_size 0 allow all delay_pools 1 delay_class 1 2 delay_parameters 1 -1/-1 -1/-1 delay_initial_bucket_level 100 delay_access 1 allow all # Setup allowed acls # Allow local network(s) on interface(s) http_access allow allowed_subnets http_access allow localnet # Custom options redirect_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf redirector_bypass on redirect_children 3 # Default block all to be sure http_access deny all Thoughts?
  • J

    OSPF kills traffic

    Locked
    5
    0 Votes
    5 Posts
    2k Views
    J
    Bump
  • O

    SQUID - Cache renew

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    _
    Your info is here: http://doc.pfsense.org/index.php/Squid_Package_Tuning You can find that infos for (not all pages/packages at the moment) by clicking at the blue help-point ahich is present on every page in the upper right white space near the page-name.
  • N

    Pfsense + squid + Windows

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    K
    I have been having the same problem. And was thinking of using a linux box in between to authenticate Squid users on pfsense. Did you find a better solution? Or did this work for you? Thanks
  • S

    Fatal error: Call to undefined function: str_split() in /usr/local/pkg/squidguar

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    D
    What would you like me to do (?), without the following information: pfSense version; squidGuard version; full text of the error / screenshot.
  • N

    DenyHost

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    W
    Did you try checking /etc/hosts.allow? Here is a quote from: http://www.mail-archive.com/ossec-list@googlegroups.com/msg00939.html "Freebsd does not use /etc/hosts.deny but rather inserts all wrapper rules into /etc/hosts.allow." Also the formatting is ALL: XXX.XXX.XXX.XXX: deny @tracer: thanks for the file, this made my day. It seems to work now. Any idea where it creates the rules to block these IPs ?
  • W

    Squid different .confs on different NICs

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • C

    Error message on snort startup

    Locked
    3
    0 Votes
    3 Posts
    5k Views
    C
    Hey Chris! Problem is that you need to enable the HTTP inspect preprocessor. To do that… Thanks - made the changes and still got some fatal errors on startup, but these were related to the snort rule files. Deleted one rule line in /usr/local/etc/snort/snort_31447_fxp0/rules/exploit.rules and around 6 in ..specific-threat.rules and everything now starts up without any errors. Can't say I completely know what i'm doing here, but all seems to work. It's my first introduction to FreeBSD and their seem to be a whole load of options in pfsense that I don't recognise at all, so will have to get FreeBSD installed on an old machine later in the year to see how all the bits fit together. Had an uptime almost since install, with constant memory usage, so no memory leaks and a very robust, fit and forget system thus far... Regards, Chris
  • T

    Snort blocks users connection to OpenVPN

    Locked
    1
    0 Votes
    1 Posts
    3k Views
    No one has replied
  • I

    Snort

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    CrossEyeC
    @jamesdean: Im working on Snort 2.9.0.3 package for Pfsense 2.0. Please be patient. james Thanks a lot James, it is truly appreciated!! Gabriel
  • G

    Snort in Pfsense

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    G
    http://www.wiley.com/WileyCDA/WileyTitle/productCd-0764568353.html
  • N

    Proxy filter Log issue

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    D
    http://forum.pfsense.org/index.php/topic,32994.0.html
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.