With only Exploit and BAckdoor rules, snort still crashes.
It can work without "core dumping" between 1 and 4 days.

What I have seen is that snort does not give the right amount of ram in the logs :

"Ram free BEFORE starting Snort: 166M – Ram free AFTER starting Snort: 166M " 
Or

"Ram free BEFORE starting Snort: 67M -- Ram free AFTER starting Snort: 67M " 
just restarted ten minutes ago:

"SnortStartup[29480]: Ram free BEFORE starting Snort: 112M – Ram free AFTER starting Snort: 112M -- Mode ac-sparsebands -- Snort memory usage:"

I have 2GB on that machine!!!!

Any clue ?

@wompy:

good point, that might be a pain. I guess I could just cut and paste the data from blk_spyware and place that in a new destination.

My main objective is to block the spyware category, but since most of it is ads on websites, I want it to look transparent to the users.

If you use HTTP WebGIU & Internal redirection, possible another way - modification /usr/local/www/sgerror.php.
SG sent many information to redirected page
http://10.62.0.3/sgerror.php?url=404&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u
[a] - client address
#                [n] - client name
#                - client user
#                - client group
#                [t] - target group
#                - client url
need checking 't' param with 'blk_spyware' and return redirection to blank Image

Thx hoba, I read it, the rules are disabled, I've seen it before.
Memory consumption has been at ap. 40%, CPU at 10% max

Yesterday the machine slowed down the whole traffic, I had to disable snort. Today I will
try to analyse if the box itself (no shaping, no ids) is able to handle the traffic. Just NAT
some rules and that's it.

Hi

I'm interested in installing this package on 1.2 Stable and just want to check if the installation issue has been resolved before I try it on my new install and stuff up my router.

I knew it was a problem, just hoped that there was a solution now. Oh well, once again thank you!

NP

@hoba:

Download the config.xml from diagnostics>backup/restore. Edit it with a texteditor that can handle the unix specific textfile (like http://pspad.com). Strip out the section for that package, save and reupload it again (pfSense will reboot). Now pfSense won't know that this package was ever installed. Try to reinstall it. Also make sure your pfSense is on the latest version when working with packages.

This makes complete sense and is the solution to my problem. Thinking out of the box! Thank you for the quite response.

thx, i was pretty sure about that but i was expecting a specialist to say it :)

anyway, i found a way to customize the /usr/local/pkg/bandwidthd.inc so now even after the reboot the item i added is still loaded in the config !

hi

i am using squid for quite some times, i used the upstream proxy in the past when i had the option to use it by my isp, but now my isp oblige me to do so, and if i don't my internet will be very slow, so if i use it now squid stops immediately, i tried it with 5 different pfsense boxes, any body aware of this and solved it?

thanks in advance

AIM 6 uses a new version of the AIM/ICQ protocol which is not supported by IMSpector. Try an older version of AIM or ICQ and it should work fine.

Hi Guys

I too would love to see how this was setup!

Thanks in advance

Excellent work!  I've commited your changes.

I can't remember, I'll look into it, when I'm around the system again…

I am building something like this. It's already working steady, howver I can't write the webgui pages for it. If anyone is interested we could make a package. I have to questions though, it works with lighthttpd (nog the webgui's) on the outside, is this dangerous?

Is there a systemwide variable for the WAN interface, and if pptp is used do their need to be rules added on both the pptp interface and the WAN interface?

I'm running ac-sparsebands with about half of the rules enabled.  I'm using approx. 240 MB per interface.  This is on top of whatever else you're running.

-GTM

total 100
-r–r--r--  1 www  www      56 Mar 24  2007 .htaccess
-r-xr-xr-x  1 www  www    2307 Mar 24  2007 bigfiles.cgi
-r-xr-xr-x  1 www  www    2556 Mar 24  2007 check-setup.pl
-r-xr-xr-x  1 www  www    9185 Mar 24  2007 common.pl
-r-xr-xr-x  1 www  www    4740 Mar 24  2007 day_detail.cgi
-r-xr-xr-x  1 www  www    1324 Mar 24  2007 fixreport.pl
-r-xr-xr-x  1 www  www    1210 Mar 24  2007 get.cgi
-r-xr-xr-x  1 www  www    10054 Mar 24  2007 graph.cgi
-r-xr-xr-x  1 www  www    6710 Mar 24  2007 group_detail.cgi
-r-xr-xr-x  1 www  www    7015 Mar 24  2007 index.cgi
-r-xr-xr-x  1 www  www    16353 Mar 24  2007 lightparser.pl
-r-xr-xr-x  1 www  www    3779 Mar 24  2007 month_detail.cgi
-r-xr-xr-x  1 www  www    4757 Mar 24  2007 topsites.cgi
drwxr-xr-x  6 root  wheel    512 Apr  9 22:04 tpl
-r-xr-xr-x  1 www  www    4038 Mar 24  2007 user_detail.cgi
-r-xr-xr-x  1 www  www    3132 Mar 24  2007 user_month.cgi
-r-xr-xr-x  1 www  www    4049 Mar 24  2007 user_time.cgi
-r-xr-xr-x  1 www  www    3572 Mar 24  2007 whousesite.cgi

This is how it looks here, I've changed the loginpage to http, no change.

Best regards

Unsupported, but here you go:

pkg_add -r http://files.pfsense.org/packages/All/iftop-0.17.tbz

From a shell ( option 8 ).

rehash
iftop

After downloading Blacklist system start SG with non-builded bases and starting base rebuild. That's all making slowing down of system. With rebuilded base SG started on 3-5 times quickly.

@freddymc:

I solved this, reinstalling squid and squidGuard.
Fred

Good way  ::)

Somehow I dont think running a zabbix server on a firewall is a good idea. For one thing, it needs a database for the backend. Runs the risk of opening unnecessary vulns in the FW as well.