Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    cyb3rtr0nianC

    @bmeeks So after upgrading to the newest PfSense 2.8.0 everything is now working like a charm!

    Suricata no longer seems to strip off tags like it did before! Which means I can now use my network segmented by VLANs and still use the benefits of Suricata Inline IPS! Very niiize!

    I checked in the Alerts section and it is indeed generating the correct alerts from the different VLAN sections, I put Inline IPS on the parent interface of all the VLANs.

    I assume this is because the FreeBSD version is also updated with the new PfSense 2.8.0 version?

    Because before, as soon as I selected Inline IPS mode, my entire VLAN tagging would break and nothing was reachable until I switched back to Legacy mode.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    reza3swR

    @Gertjan
    Hello,
    Thank you.
    I had exactly the same issue, and your solution helped me fix it.

    Ask ChatGPT

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    J

    @dennypage Here it is, complete (rather long)

    [2.8.0-RELEASE][admin@janus.jhmg.pvt]/root: pkg info | grep nut nut-2.8.2 Network UPS Tools pfSense-pkg-nut-2.8.2_5 Network UPS Tools

    Here's what Package Manager has:

    nut-pkg-manager.png

    [2.8.0-RELEASE][admin@janus.jhmg.pvt]/root: usbconfig dump_all_desc ugen0.1: <Intel XHCI root HUB> at usbus0, cfg=0 md=HOST spd=SUPER (5.0Gbps) pwr=SAVE (0mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0300 bDeviceClass = 0x0009 <HUB> bDeviceSubClass = 0x0000 bDeviceProtocol = 0x0003 bMaxPacketSize0 = 0x0009 idVendor = 0x0000 idProduct = 0x0000 bcdDevice = 0x0100 iManufacturer = 0x0001 <Intel> iProduct = 0x0002 <XHCI root HUB> iSerialNumber = 0x0000 <no string> bNumConfigurations = 0x0001 Configuration index 0 bLength = 0x0009 bDescriptorType = 0x0002 wTotalLength = 0x001f bNumInterfaces = 0x0001 bConfigurationValue = 0x0001 iConfiguration = 0x0000 <no string> bmAttributes = 0x0040 bMaxPower = 0x0000 Interface 0 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0000 bAlternateSetting = 0x0000 bNumEndpoints = 0x0001 bInterfaceClass = 0x0009 <HUB> bInterfaceSubClass = 0x0000 bInterfaceProtocol = 0x0000 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0081 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0002 bInterval = 0x00ff bRefresh = 0x0000 bSynchAddress = 0x0000 Additional Descriptor bLength = 0x06 bDescriptorType = 0x30 bDescriptorSubType = 0x00 RAW dump: 0x00 | 0x06, 0x30, 0x00, 0x00, 0x00, 0x00 ugen0.2: <Hub Terminus Technology Inc.> at usbus0, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=SAVE (100mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0200 bDeviceClass = 0x0009 <HUB> bDeviceSubClass = 0x0000 bDeviceProtocol = 0x0001 bMaxPacketSize0 = 0x0040 idVendor = 0x1a40 idProduct = 0x0101 bcdDevice = 0x0111 iManufacturer = 0x0000 <no string> iProduct = 0x0001 <USB 2.0 Hub> iSerialNumber = 0x0000 <no string> bNumConfigurations = 0x0001 Configuration index 0 bLength = 0x0009 bDescriptorType = 0x0002 wTotalLength = 0x0019 bNumInterfaces = 0x0001 bConfigurationValue = 0x0001 iConfiguration = 0x0000 <no string> bmAttributes = 0x00e0 bMaxPower = 0x0032 Interface 0 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0000 bAlternateSetting = 0x0000 bNumEndpoints = 0x0001 bInterfaceClass = 0x0009 <HUB> bInterfaceSubClass = 0x0000 bInterfaceProtocol = 0x0000 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0081 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0001 bInterval = 0x000c bRefresh = 0x0000 bSynchAddress = 0x0000 ugen0.3: <Dell MS116 Optical Mouse Dell Computer Corp.> at usbus0, cfg=0 md=HOST spd=LOW (1.5Mbps) pwr=ON (100mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0200 bDeviceClass = 0x0000 <Probed by interface class> bDeviceSubClass = 0x0000 bDeviceProtocol = 0x0000 bMaxPacketSize0 = 0x0008 idVendor = 0x413c idProduct = 0x301a bcdDevice = 0x0100 iManufacturer = 0x0001 <PixArt> iProduct = 0x0002 <Dell MS116 USB Optical Mouse> iSerialNumber = 0x0000 <no string> bNumConfigurations = 0x0001 Configuration index 0 bLength = 0x0009 bDescriptorType = 0x0002 wTotalLength = 0x0022 bNumInterfaces = 0x0001 bConfigurationValue = 0x0001 iConfiguration = 0x0000 <no string> bmAttributes = 0x00a0 bMaxPower = 0x0032 Interface 0 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0000 bAlternateSetting = 0x0000 bNumEndpoints = 0x0001 bInterfaceClass = 0x0003 <HID device> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0002 iInterface = 0x0000 <no string> Additional Descriptor bLength = 0x09 bDescriptorType = 0x21 bDescriptorSubType = 0x11 RAW dump: 0x00 | 0x09, 0x21, 0x11, 0x01, 0x00, 0x01, 0x22, 0x2e, 0x08 | 0x00 Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0081 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0004 bInterval = 0x000a bRefresh = 0x0000 bSynchAddress = 0x0000 ugen0.4: <Multimedia Keyboard Lite-On Technology Corp.> at usbus0, cfg=0 md=HOST spd=LOW (1.5Mbps) pwr=ON (100mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0110 bDeviceClass = 0x0000 <Probed by interface class> bDeviceSubClass = 0x0000 bDeviceProtocol = 0x0000 bMaxPacketSize0 = 0x0008 idVendor = 0x04ca idProduct = 0x003a bcdDevice = 0x0115 iManufacturer = 0x0001 <Lite-On Technology Corp.> iProduct = 0x0002 <USB Multimedia Keyboard> iSerialNumber = 0x0000 <no string> bNumConfigurations = 0x0001 Configuration index 0 bLength = 0x0009 bDescriptorType = 0x0002 wTotalLength = 0x003b bNumInterfaces = 0x0002 bConfigurationValue = 0x0001 iConfiguration = 0x0000 <no string> bmAttributes = 0x00a0 bMaxPower = 0x0032 Interface 0 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0000 bAlternateSetting = 0x0000 bNumEndpoints = 0x0001 bInterfaceClass = 0x0003 <HID device> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Additional Descriptor bLength = 0x09 bDescriptorType = 0x21 bDescriptorSubType = 0x10 RAW dump: 0x00 | 0x09, 0x21, 0x10, 0x01, 0x00, 0x01, 0x22, 0x41, 0x08 | 0x00 Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0081 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0008 bInterval = 0x000a bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0000 bNumEndpoints = 0x0001 bInterfaceClass = 0x0003 <HID device> bInterfaceSubClass = 0x0000 bInterfaceProtocol = 0x0000 iInterface = 0x0000 <no string> Additional Descriptor bLength = 0x09 bDescriptorType = 0x21 bDescriptorSubType = 0x10 RAW dump: 0x00 | 0x09, 0x21, 0x10, 0x01, 0x00, 0x01, 0x22, 0x4e, 0x08 | 0x00 Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0082 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0008 bInterval = 0x000a bRefresh = 0x0000 bSynchAddress = 0x0000 ugen0.5: <PR1500LCDRT2U UPS Cyber Power System, Inc.> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (2mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0200 bDeviceClass = 0x0000 <Probed by interface class> bDeviceSubClass = 0x0000 bDeviceProtocol = 0x0000 bMaxPacketSize0 = 0x0040 idVendor = 0x0764 idProduct = 0x0601 bcdDevice = 0x0200 iManufacturer = 0x0003 <CPS> iProduct = 0x0001 <CP1500PFCLCDa> iSerialNumber = 0x0002 <CXXJV2014210> bNumConfigurations = 0x0001 Configuration index 0 bLength = 0x0009 bDescriptorType = 0x0002 wTotalLength = 0x0029 bNumInterfaces = 0x0001 bConfigurationValue = 0x0001 iConfiguration = 0x0000 <no string> bmAttributes = 0x00c0 bMaxPower = 0x0001 Interface 0 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0000 bAlternateSetting = 0x0000 bNumEndpoints = 0x0002 bInterfaceClass = 0x0003 <HID device> bInterfaceSubClass = 0x0000 bInterfaceProtocol = 0x0000 iInterface = 0x0000 <no string> Additional Descriptor bLength = 0x09 bDescriptorType = 0x21 bDescriptorSubType = 0x10 RAW dump: 0x00 | 0x09, 0x21, 0x10, 0x01, 0x21, 0x01, 0x22, 0xd1, 0x08 | 0x02 Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0081 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0040 bInterval = 0x000a bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0002 <OUT> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0040 bInterval = 0x0014 bRefresh = 0x0000 bSynchAddress = 0x0000 ugen0.6: <AX201 Bluetooth Intel Corp.> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (100mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0201 bDeviceClass = 0x00e0 <Wireless controller> bDeviceSubClass = 0x0001 bDeviceProtocol = 0x0001 bMaxPacketSize0 = 0x0040 idVendor = 0x8087 idProduct = 0x0026 bcdDevice = 0x0002 iManufacturer = 0x0000 <no string> iProduct = 0x0000 <no string> iSerialNumber = 0x0000 <no string> bNumConfigurations = 0x0001 Configuration index 0 bLength = 0x0009 bDescriptorType = 0x0002 wTotalLength = 0x00c8 bNumInterfaces = 0x0002 bConfigurationValue = 0x0001 iConfiguration = 0x0000 <no string> bmAttributes = 0x00e0 bMaxPower = 0x0032 Interface 0 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0000 bAlternateSetting = 0x0000 bNumEndpoints = 0x0003 bInterfaceClass = 0x00e0 <Wireless controller> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0081 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0040 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0002 <OUT> bmAttributes = 0x0002 <BULK> wMaxPacketSize = 0x0040 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 2 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0082 <IN> bmAttributes = 0x0002 <BULK> wMaxPacketSize = 0x0040 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0000 bNumEndpoints = 0x0002 bInterfaceClass = 0x00e0 <Wireless controller> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0003 <OUT> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0000 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0083 <IN> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0000 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 Alt 1 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0001 bNumEndpoints = 0x0002 bInterfaceClass = 0x00e0 <Wireless controller> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0003 <OUT> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0009 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0083 <IN> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0009 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 Alt 2 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0002 bNumEndpoints = 0x0002 bInterfaceClass = 0x00e0 <Wireless controller> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0003 <OUT> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0011 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0083 <IN> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0011 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 Alt 3 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0003 bNumEndpoints = 0x0002 bInterfaceClass = 0x00e0 <Wireless controller> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0003 <OUT> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0019 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0083 <IN> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0019 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 Alt 4 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0004 bNumEndpoints = 0x0002 bInterfaceClass = 0x00e0 <Wireless controller> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0003 <OUT> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0021 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0083 <IN> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0021 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 Alt 5 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0005 bNumEndpoints = 0x0002 bInterfaceClass = 0x00e0 <Wireless controller> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0003 <OUT> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0031 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0083 <IN> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x0031 bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 Alt 6 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0006 bNumEndpoints = 0x0002 bInterfaceClass = 0x00e0 <Wireless controller> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0003 <OUT> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x003f bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0083 <IN> bmAttributes = 0x0001 <ISOCHRONOUS> wMaxPacketSize = 0x003f bInterval = 0x0001 bRefresh = 0x0000 bSynchAddress = 0x0000
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG

    @EChondo

    What's your pfSense version ?
    The instructions are shown here :

    1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png

    A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate.

    @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy:

    I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess.

    No need to wait x days.
    You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    89 Topics
    574 Posts
    A

    Hello,
    I am unable to get the Tailscale package to work. The page at VPN > Tailscale > Authentication is stuck. It displays the error "Tailscale is not online," but also shows a "Logout and Clean" button, with no option to log in.
    link text

    This state persists even after performing the following troubleshooting steps:

    Rebooting the pfSense router.

    Completely uninstalling and reinstalling the Tailscale package multiple times.

    Clearing browser cache and using a private browser window.

    Toggling the main "Enable Tailscale" checkbox in the settings.

    Checking the logs, which show the service gets a "terminate" signal and shuts down cleanly; it does not crash.

    Manually trying to delete the state file with rm /var/db/tailscale/tailscaled.state, which failed because the file does not exist.

    It appears that the package's configuration is corrupted in a way that persists even after reinstallation. Can anyone advise on how to perform a complete manual cleanup of all Tailscale files and settings?

  • Discussions about WireGuard

    690 Topics
    4k Posts
    J

    I've read through some other posts about this, but they either didn't say whether the proposed solution worked or they were very convoluted and difficult to understand. Here is our scenario: We have 6 locations--Las Cruces (LC), Sunland Park (SP), El Paso (EP), Abilene (ABI), Fort Worth (FW), and Plano (PL). LC and ABI have software that is accessed by the other 4 locations via VPN. There are WireGuard VPNs set up between LC and those 4 locations (SP, EP, FW, PL), and ABI and those 4 locations (SP, EP, FW, PL). There is also a WireGuard VPN connection between LC and ABI. LC and ABI have 2 internet connections. SP, EP, FW, and PL each have one internet connection.

    If the primary internet connection goes down at either LC or ABI and failover occurs to the secondary internet connection, is there a way to set up the WireGuard VPN connections so that they also failover without purchasing some 3rd party application?

    Thanks.

  • ASSP

    Locked
    5
    0 Votes
    5 Posts
    4k Views
    ?

    No one should be running pfSense 1.2-RCs anymore.  If this package only works in an RC and not the final release, then that's a problem.

  • Openbgpd - bgpd.sock missing

    Locked
    3
    0 Votes
    3 Posts
    6k Views
    D

    search is your friend…

    http://forum.pfsense.org/index.php/topic,6628.0.html

  • 1 WAN, 2 LAN, cache on WAN?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S

    at the moment i am using squid and lightsquid, as caching is one of the main reasons i chose pfsense over m0n0wall. if its not possible to cache a 2nd lan interface (by any method, trying to bind to WAN was just an experiment) its not a huge loss, but it would be useful

  • Squid starts many ' pinger ' processes

    Locked
    4
    0 Votes
    4 Posts
    20k Views
    ?

    The proper way to do this would be to notify the package maintainer to fix this.  If you go about fixing this yourself, be sure to pass the patch along to the maintainer as you are right, almost nobody running pfSense needs to use the pinger process.

  • I would love to get my hands on an ettercap package for pfsense

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    C

    Do this on a test system like a vmware version fo pfsense to test out prior to testing on your production box
    Doing this setup is at your own risk
    First off I recommend etherape instead of ettercap because the version on the site is ettercap gtk2 which requires X
    do a uname on your system determine the release version you have 6.2 Release in my case.(using pfsense 1.2 release )
    then setup the environment variable to the appropriate version of freebsd. the env is as follows
    set PKG_PATH=ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/
    the do
    pkg_add -v ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ettercap-gtk2-0.7.3_5,1.tbz

  • Configuration of squidguard

    Locked
    13
    0 Votes
    13 Posts
    9k Views
    D

    Edit and store you ACL's.

  • IMspector and WLAN connections.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    J

    No, encryption is done at link layer, imspector dont even know what is happening at link layer, it works at a higher layer.

    But, prolly the redirection rule used by IMspector is issued only to packets comming from/to the LAN/WAN interfaces.

    does your WLAN is a WLAN board inside pfSense itself ? Or a AP attached to a switch on Lan port ?

    (Sorry for bad english)

  • FreeRadius

    Locked
    13
    0 Votes
    13 Posts
    6k Views
    M

    This is my first screenshot…

  • Block msn (messenger) using squid

    Locked
    6
    0 Votes
    6 Posts
    5k Views
    J

    @submicron:

    It's hardly simpler.  In fact, your method requires the installation of many packages, some of which are problematic.  This approach is much simpler, requiring a few squid ACLs.  Incidentally, there are a number of posts on the squid support mailing list talking about using squid to filter various IM clients.  They're all very detailed and helpful.

    Hello “submicron”

    “submicron”, as a Packages Moderator,  I think I only now have understand your point. The problem, is that I have been blind and stupid till now, and haven’t already seem a so simple ting.

    You told  “installation of many packages”, and this are the key words! Only now I understood the key word: 5 packages are “many”
    Pf sense does not support the installation of several (“many”) packages, and I was trying to do that. So, in conclusion, I should not try to install so many packages, and I should install fewer, might one or two in maximum.

    Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid.

    It would be nice that we could install a minimum set of packages that could transform PFSense in a true and decent firewall, doing some cache (Squid ) at the same time we had some evidences that the tings were working (Lightsquid ). I thought that I was not trying to install nothing special…. (like Dashboard, LCDproc, Zabbix, Spand nider (even) Snort))

    Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid.

    Regards.

  • Squid crashes frequently need help !!!

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    M

    I have done that, but did not helped.

    But when i change back the Level 1 subdirectories from 32 back 16 it works….

    Bug in in the package ?

  • Release of squid and squidguard Package

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    R

    thank's!!

  • Lightsquid package Test

    Locked
    70
    0 Votes
    70 Posts
    71k Views
    J

    @dvserg:

    Do yuo click 'full refresh' button on LS gui?

    Yes I did, I click both Refresh Now and Refresh full to no avail. I have another pfsense deployment yesterday and squid/lightsquid package works just fine, I can't seem to figure out this one though, perhaps a hard drive failure?

  • Confusion on package installation

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    D

    I wrote the quote in Perry's post, based in no small part on my experience as a developer elsewhere (but not in this project).

    Though I didn't make it clear, the mention about downloading and bootstrapping was thinking of the developer ISO in the context of giving early access to those who are conversant with the internals of pfSense. When you first run the developer ISO after installation, a bootstrap process grabs the latest version of the configured FreeBSD and pfSense CVS branches (or HEAD in the pfSense case; you can't use FreeBSD HEAD nor should you want to) and builds a normal ISO.

    Whilst you can check out pfSense 1.3, you'll find it almost impossible to build as I don't think there's a publicly available pfSense developer ISO based on FreeBSD 7.0. Upgrading the FreeBSD version in a developer installation is very much non-trivial.

    I am sure we will see snapshots and, later on, beta builds of 1.3 - but the code needs to be ready for those builds to be released. Giving early access when it isn't ready for public viewing causes the problems mentioned in my quote. Neither pfSense nor FreeBSD works on a timed release schedule - in a similar vein, there is currently no timescale for FreeBSD 7.1.

    As someone who is very familiar with FreeBSD, though not as familiar with the pfSense internals, I thought I'd try to explain some background that will hopefully help silvermage and others in a similar position.

    pfSense 1.2.1 is on its way, which is based on FreeBSD 6.3 rather than the 6.2 of pfSense 1.2-RELEASE. The pfSense team have stated that they hope to release 1.2.1 by the end of May 2008, which is the end of life date of FreeBSD 6.2-RELEASE (and the point at which there's no longer any FreeBSD security team support for it).

    There are a great deal of improvements in FreeBSD 6.3 - including better hardware support together with various enhancements and bug fixes that were suitable for backporting from the active development in the HEAD of FreeBSD CVS. FreeBSD refers to such backports as MFC - Merge From Current (FreeBSD CVS HEAD is referred to as FreeBSD CURRENT).

    Because FreeBSD 6.3-RELEASE was released so long after 6.2-RELEASE, the 6.3 FreeBSD packages are much more up to date than the 6.2 ones. In fact, the FreeBSD 6.3-RELEASE packages are the same versions as in 7.0-RELEASE because the release cycles of the two OS versions were aligned from a ports/packages point of view. (There were a handful of cases where there were security flaws found in packages between the two OS release dates, so a later version might just have shipped in 7.0-RELEASE in that case). This should help pfSense package developers, as work done on pfSense 1.2.1 should hopefully be easy to port to the FreeBSD 7 based pfSense 1.3.

    You talked about different Linux distributions (or 'flavours'). There's no such concept with the BSDs - each is a kernel and userland, unlike Linux where Linux is technically only the kernel and it's up to each distribution to come up with a userland. Each approach has strengths and weaknesses - I prefer the FreeBSD approach, but I can see how there are advantages in being able to have an OS distribution that's packaged to suit your intended application.

    Of course, there is code sharing between the BSDs and even from beyond the BSDs when licences are compatible. OpenBSD's OpenSSH, in its portable guise, is used in almost every free *NIX operating system, incluidng the other BSDs. OpenSolaris's ZFS has been ported to FreeBSD - though it's still an experimental feature in FreeBSD 7.0.

    There are also derivative distributions - from FreeBSD there's the FreeSBIE Live CD, m0n0wall and pfSense amongst others.

    There's usually no trickery needed to install software on FreeBSD. If a FreeBSD port is compatible with a particular major OS version, a binary package will be produced for that version. The port itself, in conjunction with the ports framework, deals with the differences between the OS versions.

    If the source material for a port is only available as a binary for a particular major OS version, it is usually possible to use that binary on a later major OS version using the compatibility features of the OS and the compatibility libraries, so a package is still possible - if so, this is transparent to the user. The port maintainers and ports committers do all this work for the end users - though FreeBSD PRs (problem reports) with feature requests, bug reports and especially patches are always welcome for any issue you have with a FreeBSD port or package.

    Some Linux binaries can be used on FreeBSD via FreeBSD's Linux emulation. There are some examples amongst the ports and packages of this - usually linux appears in the name of the port or package.

    As is often said on these forums, FreeBSD is not Linux. Linux shell scripters can get caught out on FreeBSD because bash is not the default shell, /bin/sh is not bash, and bash is not installed unless you install the bash port/package or install bash from source. Similarly, the default make program on FreeBSD is BSD make - if you need GNU make (gmake on FreeBSD), you need to install the gmake port/package or install from source.

    If you wish to do any pfSense development, it may pay to familiarise yourself with FreeBSD, its documentation and ports/packages system. A FreeBSD port is simply the recipe to create a binary package - though installing from ports often allows you to tune the port to your requirements.

    I've yet to get into pfSense package development, though I'm going to explore the possibility of an apcupsd package. apcupsd has better support for SNMP managed UPSes than nut - my server rack has such a UPS.

    I'm grateful for Perry's links - I knew about the devwiki, but the last one is new to me. I wonder if the right way to develop this is to experiment on the version of FreeBSD i386 corresponding to the pfSense version you're developing for, check your work at the shell of a pfSense developer ISO, then start to build the UI and other components required for a pfSense package. That's only a thought from me, however - it's not based on any experience.

  • I need support for APC SNMP in NUT

    Locked
    7
    0 Votes
    7 Posts
    5k Views
    D

    I am still looking into making an apcupsd package for pfSense. Unfortunately I'm very busy at the moment, including with a couple of other tasks in my software development pipeline that really need doing before this one.

    The FreeBSD side of this holds no fears - I'm used to administering FreeBSD machines, and I'm very familiar with the FreeBSD ports and packages system (I maintain several FreeBSD ports). However, I'm not very familiar with the pfSense package system yet - I need some time to familiarise myself with it.

    For now, my pfSense machine is running from a LiveCD with the configuration on a USB memory key. A power failure is unlikely to damage such a system, even though there's no way for it to interact with the UPS. At least deploying the new hardware put my production pfSense system on its permanent hardware platform and I could retire the horrid Cyrix 333MHz PC I threw together from junk box parts when the Ethernet switch in my old router failed in December.

    I want to move pfSense onto the new machine's hard disks so that I can install packages. That is blocking on two things - I need a UPS monitoring solution I'm happy with, also I need to decide if I'm going to install a RAID controller so that I can use two hard disks in RAID 1 for added robustness (as it stands, the machine has two identical hard disks but no RAID controller). I have the pfSense developer ISO running under VMware Workstation 6 on a Windows machine, so I have a platform to experiment on before deploying my eventual solution to my production firewall.

    I will update this thread if I have anything to share. If I do develop an apcupsd package, it will be contributed to the pfSense project.

  • BandwitdthD - CoreDump after few hours.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    Z

    512MB of DDR ram, 1.7GHz Pent4, 40GB hdd.

    Running pfSense 1.2, squid and bandwidthD. Serving only 6 or so PC's.
    I know squid isnt causing the problem as i just installed, as in bandwithd was acting up before installing it. Not that it might not contribute to the problem.

    Edit: Stats page currently reporting 34% Ram usage. I have another 512MB stick i could use if 512 is not enough.

  • Monitor web based chat and meebo using imspector

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    Cry HavokC

    Hint: Search - this has been discussed before.

    Short answer: no.

  • Playing with XTRadius

    Locked
    9
    0 Votes
    9 Posts
    5k Views
    J

    i´ll try those tools you mentioned, but, one of my tasks is to make the current accounting software (that accounts most things in the company) compatible with the RADIUS backend (currently they do everything using a small software developed using Delphi, but this software cannot enforce anything upon users, the network owner must manually do everything, from blocking users to creating logins… this sux) so i thought freepascal was a nice way to go, extending the software and porting (actually, just copy and paste) some of its functions to the radius backend running at pfSense... and the current setup (using monowall captive portal user list) cannot even give per user bandwidth... Everyone has the same network speed (bad comercial model).

    These people wont understand RADIUS reply, RADIUS bla bla bla, this is out of this world for them...

  • Custom Error Page redirect for SquidGuard?

    Locked
    9
    0 Votes
    9 Posts
    15k Views
    M

    [smacks head]duh![/smacks head]

    Thanks, I had a major brain fart.  We do use a different than 80 port, and of course that fixed it.

    Thanks for everything (including SG!)

    -Marty

  • LDAP with Squid

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    D

    Typically options such as LDAP support that create added dependencies on fairly 'heavyweight' libraries are disabled by default in FreeBSD ports - and are therefore disabled in the FreeBSD package. This is to avoid pulling in a load of unnecessary baggage that many will not use, also there are at least four options for the OpenLDAP client libraries (2.3 or 2.4; in either case with or without SASL).

    The www/squid30 port does have an LDAP option that you can set, but you'll need a FreeBSD box (or virtual machine) to build a suitable package, and you're on your own so far as getting the LDAP features going in pfSense.

  • Squid and "Do not cache" option

    Locked
    8
    0 Votes
    8 Posts
    4k Views
    ?

    In squid < 3.0, you want the no_cache directive.

    Usage  no_cache deny|allow aclname

    Description
    A list of ACL elements, which, if matched, cause the reply to be immediately, removed from the cache. In other words, use this to force certain objects to never be cached.

    Default
    acl QUERY urlpath_regex cgi-bin ?
    no_cache deny QUERY
    The word 'DENY' is to indicate the ACL names, which should NOT be cached

    Example
    acl DENYPAGE urlpath_regex Servlet
    no_cache deny DENYPAGE
    The DENYPAGE acl assures that the url containing Servlet will NOT be cached.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.