Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    J
    @andrew_cb ChatGPT had the right idea but gave me 100 different places to put "load-server-state-from-file none". Your post was worth more than ChatGPT could ever offer!
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    JonathanLeeJ
    @bmeeks your work outclasses so many individuals and developers. Your stuff is amazing. Cheers
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    572 Topics
    3k Posts
    keyserK
    @Antibiotic No it’s not possible with NtopNG as it is not a Netflow collector. You need nProbe for that which will “translate” recieved netflows into flows that NtopNG understands and can visualize (with very very little detail might I add as Netflows has no additonal information apart from sender/reciever and volume). The NtopNG package and the product in general is more geared towards visualising and recording traffic details from actual packet captures. This contains MUCH more metadata about the sessions than netflows (DNS names, protocol information and myriads of other things). But pffSense Plus has a builtin Netflow exporter if you have an external netflow collector on hand.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    N
    @jrey those pfb_*.sh files are the executables Thanks for clarifying the executables. I do not think that the hardware and table entry size won't be problem as the current configuration provides sufficient computation and memory for its operations. Pfsense is running in different hardware, e.g., Intel Xenon Platinum 8272CL processor and maximum table entries is set to 10 times than the default. pfSense Table Stats ------------------- table-entries hard limit 4000000 Table Usage Count 465931
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    501 Topics
    3k Posts
    A
    Hi, Please help to forward / report the bugs in ACME 1.0 package. Thanks.
  • Discussions about the FRR Dynamic Routing package on pfSense

    295 Topics
    1k Posts
    J
    Anyone else happen to notice that when configuring BFD, if you create a peer and select a profile - after save, re-edit the peer and the Profile is not represented. It appears as "None". You have to check the raw config to determine if the profile was actually assigned to the peer. This is on 2.8.1 (all packages up to date as of the date/time of this post). UPDATE: if re-edit and save (without re-configuring the profile none to what you want) - the save will strip the profile from the peer.
  • Discussions about the Tailscale package

    91 Topics
    611 Posts
    T
    Hi All, I use HAProxy to redirect to a range of https internal resources, this works really well at the moment through the WAN where I have source limits set up, and I can connect to the internal resources from limited external IP Addresses. Given I have tailscale I would like to basically be able to put custom dns entries in to point these hostnames to my pfsense tailscale IP4 address (100.89.148.118) but I am not having any luck getting this working. At the moment, I am just trying to connect to HAProxy using https://100.89.148.118 but it is getting blocked by the firewall. Sep 11 11:55:58 tailscale0 Default deny rule IPv4 (1000000103) 100.89.148.10:53148 100.89.148.118:443 TCP:S I have tried with and without NAT redirecting internally to 127.0.0.1, and I also have rules set up to allow any traffic to and from my tailnets (defined in an alias) but I still keep getting these connections from my other tailscale machines being blocked on the pfsense machine. Can someone give me some pointers on what I am missing because I can see the requests are coming through to the pfsense machine, and in theory the rules should allow it through but I cant see why they don't. I do have tailscale ACL in place, but clearly that is not an issue as the requests are making it through to the firewall. 0/0 B IPv4+6 TCP/UDP TailNets * TailNets * * none Allow across Tailnets 0/0 B IPv4+6 TCP/UDP * * * 443 (HTTPS) * none Allow Tailscale IP4 I also tried adding a EasyRule but because the tailscale0 interface doesn't exist in pfsense it throws an error and won't let me add that rule. Appreciate any help or tips, Cheers.
  • Discussions about WireGuard

    702 Topics
    4k Posts
    P
    Yes
  • Adzapping with Squid package (2.6.21_xx)

    Locked
    2
    0 Votes
    2 Posts
    9k Views
    belleraB
    Hello! I integrated squidGuard + VideoCache using zapchain script from AddZapper. My installation uses a separate FreeBSD box to my pfSense and I documented it at http://www.bellera.cat/josep/videocache Perhaps it could help (for caching youtube videos and similar) if somebody want to try it in a pfSense box. Regards, Josep Pujadas
  • Fatal error: when I click on add extensions

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    C
    The problem with the 'extensions' tab is now fixed for pfSense 2.0.
  • Installing two copies of BandwidthD

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Darkstat package broken after upgrade

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Imspector on 1.2.1* - patch (works for me!)

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • SPAMD in Blacklist Mode Broken?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    I
    I should say that unchecking the box STOPS all e-mail from being delivered unless its' on the whitelist. (I'm assuming because the rules aren't re-written it's trying to send it to spamd internally, which isn't on) Changing the rules just gets them re-written on reboot obviously so that's no dice either.. Chris
  • Patch to include SMTP server name to SpamD package

    Locked
    6
    0 Votes
    6 Posts
    2k Views
    I
    @iced98lx: Are you using the developer release? I'm on 1.2.1 rc3 and after installing patch the command gpatch is not found… Nix that- reboot and now i can use gpatch.
  • SpamD: Add DNSWL's legitimate SMTP servers to whitelist

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    I
    Comrax: doing excellent work here!! I'm updating to RC3 just so i can use this and the other patch you released to SPAMD!! Are you running greylisting or just white/black?
  • Changing SPAMD to Listen on an IP Address vs an Adapter

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Spamd whitelist/blacklist strange behavior

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • BGP problems

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    D
    looks like you are binding bgpd on one subnet. here's a bgpd.conf that works with the latest pfsense version. (note that I set the announce on the group level, you can do this on the neighbor level also, also I like to define things even tho they are the default - just for my own sanity) AS 12345 holdtime 60 listen on 127.0.0.1  #try this to so solve your binding problem router-id 111.111.111.111 network 123.123.123.0/24 group "upstream" {         announce self         announce capabilities yes         set localpref 90         softreconfig in yes         softreconfig out yes         neighbor 63.169.230.189 {                 descr "Sprint Upstream"                 remote-as 1239                 depend on em1                 max-prefix 270000         }         neighbor 204.9.204.29 {                 descr "US Colo Upstream"                 multihop 3                 remote-as 32743                 depend on em2                 max-prefix 270000         } } group "any2_peers" {          announce self          announce capabilities yes          depend on em3          set localpref 110          softreconfig in yes          softreconfig out yes          neighbor 206.223.143.33 {                 descr "WV Fiber"                 remote-as 19151                 max-prefix 4000         }         neighbor 206.223.143.79 {                 descr "Peer 1 Networks"                 remote-as 13768                 max-prefix 2000 }         neighbor 206.223.143.63 {                 descr "Singapore Telecom"                 remote-as 7473                 max-prefix 20000         } } Sample filter section: Filter Section First deny everything from all deny from any deny to any Allow to/from our peers All groups  must be listed here to receive and send updates allow from group upstream allow to group upstream allow from group any2_peers allow to group any2_peers Filter out Default Route, RFC1918 and other IANA reserved IP blocks deny from any prefix 0.0.0.0/0 deny from any prefix 10.0.0.0/8 prefixlen >= 8 deny from any prefix 172.16.0.0/12 prefixlen >= 12 deny from any prefix 192.168.0.0/16 prefixlen >= 16 deny from any prefix 169.254.0.0/16 prefixlen >= 16 deny from any prefix 192.0.2.0/24 prefixlen >= 24 deny from any prefix 224.0.0.0/4 prefixlen >= 4 deny from any prefix 240.0.0.0/4 prefixlen >= 4 +++++++++++++++++++++++++++++++++ hope this helps
  • Multiple subnets with Bandwidthd

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    C
    Same phenomena here… Anyone can shed more light on this? and how to correct the situation? I am running pfSense 1.2.1-RC2.
  • SNORT BLOCKING EVERYTHING

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • NUT and UPS via USB

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    G
    I was also having problems with the nut package in 1.2.1 RC2 and a APC ES-350 using a usb cable. I was able to resolve the issue by running a search and replace on "nut.xml"  and replacing all instances of "newhidups" with "usbhid-ups" Hope that helps GP P.S as always it would be a good idea to make a backup of "nut.xml" before you start!
  • VmWare Package - 1.2 Release but can't see it?!

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    B
    @GruensFroeschli: This is the post for you :) http://blog.pfsense.org/?p=293 I assume from that it's only available as a package in 1.2.1? :-) I tried to go to the doc page mentioned in my first post and create an account in order to edit the doc to make it clear that this is only available for 1.2.1 and upwards. However the only option is to log in, not to create an account! Could some kind soul please edit this page to make it clear which version(s) it applies to?
  • Trouble shooting 1.2.1 RC2 Snort Pkg Rule update

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    G
    I have searched the forums several times, thank you. I am using the "ac-bnfa"  mode that was the solution in one post ( I have also tried "lowmem" that has worked other types of installation). It's weird in that my first install it worked fine.  I had to reinstall on new hardware and it stopped working. I have reinstalled half a dozen times with no luck. In another post a delay to allow for the interfaces to come up was sugguested.  I have tried turning automatic updates off to provide that delay with no luck. Can anyone at least provide a manual method of updating as a work around? Well after two days it ran successfully! I have no clue why.  Please ignore post
  • GEO Filtering

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    M
    Interesting idea - you might start a bounty and see if anyone else latches onto this.
  • Problem in squid while on failover

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    I
    I believe that Squid does not support a multi-wan environment (load balance/failover). I will check on this and get back to you…
  • Question about BandwidthD

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • LightSquid and 500 - Internal Server Error

    Locked
    21
    0 Votes
    21 Posts
    14k Views
    D
    @ipnet: Hello all, I get the 500 Internal Server Error when I try to get the graphics from Lightsquid. I followed this thread and made it up to the point where the conclisions are that the libperl.so file has to be replaced. Well, the link http://diskatel.narod.ru/libperl.so (mentiones early in this thread) seems not to exist any more. Anybody knows where can I get this file from ???? Best regards Pls restore you lib back and look lastest recomendations http://forum.pfsense.org/index.php/topic,11594.15.html –- Possible close this topic - here not actual information?
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.