Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    I
    @andrew_cb said in haproxy 0.63_2 weird behavior, edits not working: @iSagen @TheCyborgWeasel The issue is likely the same as in https://forum.netgate.com/topic/178348/haproxy-backend-port-changes-are-not-applied/ Try adding load-server-state-from-file none to the Advanced Settings > Backend pass thru section of each backend. Great! I will do this.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB
    @NRgia said in Suricata on Pfsense: @bmeeks Thank you for what you did for Snort or Suricata. I'm not sure what you want me to do on Redmine, due to is a bug tracker. My question is for Product Management, which I will ask it here to be public: What is the plan for these 2 packages, Suricata and Snort? Thank you Yes, Redmine is for both bug reports and feature requests. Asking for the Suricata binary to be updated to the latest 7.0.11 version from upstream is a legitimate Redmine request. I would suggest simply asking for the binary version update instead of asking about future Netgate strategy (such as the support plans for the packages). Strategy discussions typically don't get very far because they deal with proprietary information or plans that a company may not want to publicly discuss. Redmine is where the Netgate developer team tracks all the code changes they make for pfSense. They will see Redmine reports much quicker than a forum post.
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    dennypageD
    @Leon-Straathof Data retention settings are handled inside of ntopng. Documentation here. Pay attention to the RRD note. Also, if you've turned on some of the slice and dice time series information (is off by default), I'd suggest turning them back off. These balloon the storage requirements and are of little actual use.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    J
    @keyser Clarify "it makes sense if the GEOIP DB has that size" are you referencing the asn data as I have shown or the maxmind data? the asn data takes all of 15 seconds to download and process. Not really any "magic" going on there, you can see the mmdb is only a download referenced and the asn.csv.gz is basically just unzipped. I can't comment on the maxmind data specifically because I don't use for my geo location. But I can see what the code should be doing. seeing your actual log file will help determine where your specific spike may be coming from, but if I had to guess from looking at the code and my timing with respect to the asn parts of it I would guess this is most likely to be an issue with the maxmind parts - timing should be in the log. can you change when it runs ? no, not directly, there is no way to do this without changing the code to target a specific time when it creates the cron job in the first place. No you can't change the timing of the cron job and have it stick, it will eventually just go random again. On the other hand, yes, because I changed the code here so it always creates the same "not so random" time.. runnning at same time every day since this code change first became available in the pfblockerNG update for 24.11 that came out months ago, well before 25.07 curious you originally said "noticed this after upgrading to 25.07 and pfb 3.2.7" were you running the "new" format of asn data before? (would have only been possible if you upgraded from 24.11 with the latest version of pfb installed) you would have entered and ASN key at some point to make it work. did you do that under the prior version and just now with 25.07) it's likely not significant, but then again .... That likely won't help your spike, other than moving it to a different time. I moved it here to a static ("not so random") time for other reasons, nothing to do with system load at the time.. Log files would be helpful. (just the snippet that applies to this time, from extras, error and pfblockerng logs there may be nothing in error or pfblockerng related to the time it is running. .
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    495 Topics
    3k Posts
    M
    @raidflex said in updating to acme 1.0 breaks system beyond repair: need to restore from backup: maybe uninstall Crowdsec when applying other updates first. It seems like it doesn't help at least from what I see on my system... it changes something.. so it must be definitely reported to their github. I have never experienced that before and crowsec was installed.. maybe with 2.8.0 something have changed
  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1
  • Discussions about the Tailscale package

    90 Topics
    595 Posts
    E
    Updated CE 2.7.2 to 1.86.2_1 Changelog pkg add -f https://pkg.freebsd.org/FreeBSD:14:amd64/latest/All/tailscale-1.86.2_1.pkg Freshports
  • Discussions about WireGuard

    693 Topics
    4k Posts
    lvrmscL
    Strangely enough, checking the system 4 days later, I now see that Wireguard service is reported running! The last thing I did 4 days ago was to disable Wireguard service monitoring by the Service Watchdog. Anyway, even when it was reported stopped at first, 4 days ago, the tunnels were working flawlessly. Very strange. I will keep an eye on it.
  • Proxy only for por 80

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    X
    hello jose, i'm not a portugeese.. :) since mhab tell me bout the link, i followed that and its solved my probs. yes, i'll follow ur suggestion :) thanks for that…
  • Snort crashed and won't restart correctly

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    J
    There's a problem with the snort package (or maybe the web configurator?). Sometimes it does not put the full startup command in the snort startup config (/usr/local/etc/rc.d/snort.sh). If you look in that config, it should point to the snort binary, but sometimes after you make a configuration change that entry gets removed. I've also noticed that the web configurator's service page often does not show the correct status for whether snort is running (or not). The only way to know for sure is to login via ssh and look at the "top" status, or type "ps auxw | grep snort" to see if the process is running. Also… some of the rulesets do not work at all (snort will not startup). Additionally, if you run too many rules, snort will not start. It takes a bit of work to get the snort package to work reliably on pfsense.
  • ASSP

    Locked
    5
    0 Votes
    5 Posts
    4k Views
    ?
    No one should be running pfSense 1.2-RCs anymore.  If this package only works in an RC and not the final release, then that's a problem.
  • Openbgpd - bgpd.sock missing

    Locked
    3
    0 Votes
    3 Posts
    6k Views
    D
    search is your friend… http://forum.pfsense.org/index.php/topic,6628.0.html
  • 1 WAN, 2 LAN, cache on WAN?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S
    at the moment i am using squid and lightsquid, as caching is one of the main reasons i chose pfsense over m0n0wall. if its not possible to cache a 2nd lan interface (by any method, trying to bind to WAN was just an experiment) its not a huge loss, but it would be useful
  • Squid starts many ' pinger ' processes

    Locked
    4
    0 Votes
    4 Posts
    20k Views
    ?
    The proper way to do this would be to notify the package maintainer to fix this.  If you go about fixing this yourself, be sure to pass the patch along to the maintainer as you are right, almost nobody running pfSense needs to use the pinger process.
  • I would love to get my hands on an ettercap package for pfsense

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    C
    Do this on a test system like a vmware version fo pfsense to test out prior to testing on your production box Doing this setup is at your own risk First off I recommend etherape instead of ettercap because the version on the site is ettercap gtk2 which requires X do a uname on your system determine the release version you have 6.2 Release in my case.(using pfsense 1.2 release ) then setup the environment variable to the appropriate version of freebsd. the env is as follows set PKG_PATH=ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ the do pkg_add -v ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ettercap-gtk2-0.7.3_5,1.tbz
  • Configuration of squidguard

    Locked
    13
    0 Votes
    13 Posts
    9k Views
    D
    Edit and store you ACL's.
  • IMspector and WLAN connections.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    J
    No, encryption is done at link layer, imspector dont even know what is happening at link layer, it works at a higher layer. But, prolly the redirection rule used by IMspector is issued only to packets comming from/to the LAN/WAN interfaces. does your WLAN is a WLAN board inside pfSense itself ? Or a AP attached to a switch on Lan port ? (Sorry for bad english)
  • FreeRadius

    Locked
    13
    0 Votes
    13 Posts
    6k Views
    M
    This is my first screenshot… [image: screen.jpg]
  • Block msn (messenger) using squid

    Locked
    6
    0 Votes
    6 Posts
    5k Views
    J
    @submicron: It's hardly simpler.  In fact, your method requires the installation of many packages, some of which are problematic.  This approach is much simpler, requiring a few squid ACLs.  Incidentally, there are a number of posts on the squid support mailing list talking about using squid to filter various IM clients.  They're all very detailed and helpful. Hello “submicron” “submicron”, as a Packages Moderator,  I think I only now have understand your point. The problem, is that I have been blind and stupid till now, and haven’t already seem a so simple ting. You told  “installation of many packages”, and this are the key words! Only now I understood the key word: 5 packages are “many” Pf sense does not support the installation of several (“many”) packages, and I was trying to do that. So, in conclusion, I should not try to install so many packages, and I should install fewer, might one or two in maximum. Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid. It would be nice that we could install a minimum set of packages that could transform PFSense in a true and decent firewall, doing some cache (Squid ) at the same time we had some evidences that the tings were working (Lightsquid ). I thought that I was not trying to install nothing special…. (like Dashboard, LCDproc, Zabbix, Spand nider (even) Snort)) Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid. Regards.
  • Squid crashes frequently need help !!!

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    M
    I have done that, but did not helped. But when i change back the Level 1 subdirectories from 32 back 16 it works…. Bug in in the package ?
  • Release of squid and squidguard Package

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    R
    thank's!!
  • Lightsquid package Test

    Locked
    70
    0 Votes
    70 Posts
    72k Views
    J
    @dvserg: Do yuo click 'full refresh' button on LS gui? Yes I did, I click both Refresh Now and Refresh full to no avail. I have another pfsense deployment yesterday and squid/lightsquid package works just fine, I can't seem to figure out this one though, perhaps a hard drive failure?
  • Confusion on package installation

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    D
    I wrote the quote in Perry's post, based in no small part on my experience as a developer elsewhere (but not in this project). Though I didn't make it clear, the mention about downloading and bootstrapping was thinking of the developer ISO in the context of giving early access to those who are conversant with the internals of pfSense. When you first run the developer ISO after installation, a bootstrap process grabs the latest version of the configured FreeBSD and pfSense CVS branches (or HEAD in the pfSense case; you can't use FreeBSD HEAD nor should you want to) and builds a normal ISO. Whilst you can check out pfSense 1.3, you'll find it almost impossible to build as I don't think there's a publicly available pfSense developer ISO based on FreeBSD 7.0. Upgrading the FreeBSD version in a developer installation is very much non-trivial. I am sure we will see snapshots and, later on, beta builds of 1.3 - but the code needs to be ready for those builds to be released. Giving early access when it isn't ready for public viewing causes the problems mentioned in my quote. Neither pfSense nor FreeBSD works on a timed release schedule - in a similar vein, there is currently no timescale for FreeBSD 7.1. As someone who is very familiar with FreeBSD, though not as familiar with the pfSense internals, I thought I'd try to explain some background that will hopefully help silvermage and others in a similar position. pfSense 1.2.1 is on its way, which is based on FreeBSD 6.3 rather than the 6.2 of pfSense 1.2-RELEASE. The pfSense team have stated that they hope to release 1.2.1 by the end of May 2008, which is the end of life date of FreeBSD 6.2-RELEASE (and the point at which there's no longer any FreeBSD security team support for it). There are a great deal of improvements in FreeBSD 6.3 - including better hardware support together with various enhancements and bug fixes that were suitable for backporting from the active development in the HEAD of FreeBSD CVS. FreeBSD refers to such backports as MFC - Merge From Current (FreeBSD CVS HEAD is referred to as FreeBSD CURRENT). Because FreeBSD 6.3-RELEASE was released so long after 6.2-RELEASE, the 6.3 FreeBSD packages are much more up to date than the 6.2 ones. In fact, the FreeBSD 6.3-RELEASE packages are the same versions as in 7.0-RELEASE because the release cycles of the two OS versions were aligned from a ports/packages point of view. (There were a handful of cases where there were security flaws found in packages between the two OS release dates, so a later version might just have shipped in 7.0-RELEASE in that case). This should help pfSense package developers, as work done on pfSense 1.2.1 should hopefully be easy to port to the FreeBSD 7 based pfSense 1.3. You talked about different Linux distributions (or 'flavours'). There's no such concept with the BSDs - each is a kernel and userland, unlike Linux where Linux is technically only the kernel and it's up to each distribution to come up with a userland. Each approach has strengths and weaknesses - I prefer the FreeBSD approach, but I can see how there are advantages in being able to have an OS distribution that's packaged to suit your intended application. Of course, there is code sharing between the BSDs and even from beyond the BSDs when licences are compatible. OpenBSD's OpenSSH, in its portable guise, is used in almost every free *NIX operating system, incluidng the other BSDs. OpenSolaris's ZFS has been ported to FreeBSD - though it's still an experimental feature in FreeBSD 7.0. There are also derivative distributions - from FreeBSD there's the FreeSBIE Live CD, m0n0wall and pfSense amongst others. There's usually no trickery needed to install software on FreeBSD. If a FreeBSD port is compatible with a particular major OS version, a binary package will be produced for that version. The port itself, in conjunction with the ports framework, deals with the differences between the OS versions. If the source material for a port is only available as a binary for a particular major OS version, it is usually possible to use that binary on a later major OS version using the compatibility features of the OS and the compatibility libraries, so a package is still possible - if so, this is transparent to the user. The port maintainers and ports committers do all this work for the end users - though FreeBSD PRs (problem reports) with feature requests, bug reports and especially patches are always welcome for any issue you have with a FreeBSD port or package. Some Linux binaries can be used on FreeBSD via FreeBSD's Linux emulation. There are some examples amongst the ports and packages of this - usually linux appears in the name of the port or package. As is often said on these forums, FreeBSD is not Linux. Linux shell scripters can get caught out on FreeBSD because bash is not the default shell, /bin/sh is not bash, and bash is not installed unless you install the bash port/package or install bash from source. Similarly, the default make program on FreeBSD is BSD make - if you need GNU make (gmake on FreeBSD), you need to install the gmake port/package or install from source. If you wish to do any pfSense development, it may pay to familiarise yourself with FreeBSD, its documentation and ports/packages system. A FreeBSD port is simply the recipe to create a binary package - though installing from ports often allows you to tune the port to your requirements. I've yet to get into pfSense package development, though I'm going to explore the possibility of an apcupsd package. apcupsd has better support for SNMP managed UPSes than nut - my server rack has such a UPS. I'm grateful for Perry's links - I knew about the devwiki, but the last one is new to me. I wonder if the right way to develop this is to experiment on the version of FreeBSD i386 corresponding to the pfSense version you're developing for, check your work at the shell of a pfSense developer ISO, then start to build the UI and other components required for a pfSense package. That's only a thought from me, however - it's not based on any experience.
  • I need support for APC SNMP in NUT

    Locked
    7
    0 Votes
    7 Posts
    5k Views
    D
    I am still looking into making an apcupsd package for pfSense. Unfortunately I'm very busy at the moment, including with a couple of other tasks in my software development pipeline that really need doing before this one. The FreeBSD side of this holds no fears - I'm used to administering FreeBSD machines, and I'm very familiar with the FreeBSD ports and packages system (I maintain several FreeBSD ports). However, I'm not very familiar with the pfSense package system yet - I need some time to familiarise myself with it. For now, my pfSense machine is running from a LiveCD with the configuration on a USB memory key. A power failure is unlikely to damage such a system, even though there's no way for it to interact with the UPS. At least deploying the new hardware put my production pfSense system on its permanent hardware platform and I could retire the horrid Cyrix 333MHz PC I threw together from junk box parts when the Ethernet switch in my old router failed in December. I want to move pfSense onto the new machine's hard disks so that I can install packages. That is blocking on two things - I need a UPS monitoring solution I'm happy with, also I need to decide if I'm going to install a RAID controller so that I can use two hard disks in RAID 1 for added robustness (as it stands, the machine has two identical hard disks but no RAID controller). I have the pfSense developer ISO running under VMware Workstation 6 on a Windows machine, so I have a platform to experiment on before deploying my eventual solution to my production firewall. I will update this thread if I have anything to share. If I do develop an apcupsd package, it will be contributed to the pfSense project.
  • BandwitdthD - CoreDump after few hours.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    Z
    512MB of DDR ram, 1.7GHz Pent4, 40GB hdd. Running pfSense 1.2, squid and bandwidthD. Serving only 6 or so PC's. I know squid isnt causing the problem as i just installed, as in bandwithd was acting up before installing it. Not that it might not contribute to the problem. Edit: Stats page currently reporting 34% Ram usage. I have another 512MB stick i could use if 512 is not enough.
  • Monitor web based chat and meebo using imspector

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    Cry HavokC
    Hint: Search - this has been discussed before. Short answer: no.
  • Playing with XTRadius

    Locked
    9
    0 Votes
    9 Posts
    5k Views
    J
    i´ll try those tools you mentioned, but, one of my tasks is to make the current accounting software (that accounts most things in the company) compatible with the RADIUS backend (currently they do everything using a small software developed using Delphi, but this software cannot enforce anything upon users, the network owner must manually do everything, from blocking users to creating logins… this sux) so i thought freepascal was a nice way to go, extending the software and porting (actually, just copy and paste) some of its functions to the radius backend running at pfSense... and the current setup (using monowall captive portal user list) cannot even give per user bandwidth... Everyone has the same network speed (bad comercial model). These people wont understand RADIUS reply, RADIUS bla bla bla, this is out of this world for them...
  • Custom Error Page redirect for SquidGuard?

    Locked
    9
    0 Votes
    9 Posts
    15k Views
    M
    [smacks head]duh![/smacks head] Thanks, I had a major brain fart.  We do use a different than 80 port, and of course that fixed it. Thanks for everything (including SG!) -Marty
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.