Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    O

    Hey that is familiar :

    [2.8.0-RELEASE][admin@fw1.man.mylocal]/root: squid -z
    ld-elf.so.1: /usr/local/sbin/squid: Undefined symbol "ZTVNSt3__117bad_function callE"

    Hopefully it is resolved soon!

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB

    I do not personally use either, although I did once, several years ago, toy with an ELK setup. It was installed on a separate VM in my case.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    569 Topics
    3k Posts
    dennypageD

    @StealthNet said in Outgoing Portscans - ntopng?:

    Tbh I never thought a default package would do some kind of outbound network discovery based on class C scanning of internet hosts.

    I don´t think this is ok.

    I agree. I was rather shocked when I discovered this while diagnosing the same issue with another pfSense user who happens to be a close friend of min. He had also enabled it because ntopng's description made it sound like a good thing.

    Anyway, I appreciate your, and others, input on this. I believe I will add a set of warning to the next version of the package, to at least have put forth the information/warning.

    Thank you.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    M

    @tinfoilmatt Same exact problem. Thank you.

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    94 Topics
    2k Posts
    V

    @Vancejo1 said in apcupsd causes restart:

    When I stop the apcupsd service and run apctest then select 10 battery calibration. It cause my router to reboot after reporting the calibration was aborted.

    Is it really rebooting? Or does the UPS cut the power?
    Check the logs to get sure.
    I've seen the latter already, but with old batteries, however.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    491 Topics
    3k Posts
    jimpJ

    Let's Encrypt is removing the TLS Client Authentication EKU from certificates they sign in the near future:

    https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/

    This shouldn't affect many, if any, users of ACME on pfSense as it isn't used as a client certificate, only as a server certificate in various context (e.g. GUI, Captive Portal, HAProxy)

    In the past we have discouraged using Let's Encrypt certificates in certain contexts (like for clients) since it wasn't typically a secure practice. For example, if you use a Let's Encrypt certificate for OpenVPN, it would trust any certificate signed by Let's Encrypt, which makes it useless as an authentication factor.

    So while this is something to be aware of and check, it's unlikely to be a problem for most people.

  • Discussions about the FRR Dynamic Routing package on pfSense

    290 Topics
    1k Posts
    F

    Hi Team,

    This is driving me crazy!

    I typically set up FRR manually under PFS, but would like to move to GUI to make life easier for 'new folks'.

    Here's a snippet of my config:

    router ospf
    ospf router-id id.id.id.id
    area 0.0.0.0 shortcut default
    redistribute kernel
    !
    ip prefix-list XXX seq 1 deny 10.0.0.0/16 le 32
    ip prefix-list XXX seq 2 permit any

    route-map XXX permit 10
    match ip address prefix-list XXX
    !
    ip protocol ospf route-map XXX

    I cannot for the life of me figure out how to get the last line into the config via the GUI.

    I've read that setting ABR filters in FFR-OSPF->Areas might be the answer, but that doesn't seem to be it.

    Could someone please explain what I'm missing here?

    Thanks

    ChIP

  • Discussions about the Tailscale package

    86 Topics
    552 Posts
    J

    Looks like Tailscale updated their Oauth to include client ID and client secret. Currently, I cannot login with client secret only.

  • Discussions about WireGuard

    680 Topics
    4k Posts
    T

    @TheNarc You are right!
    I configured the MTU on the Wireguard interface as described in the docs. However, it turns out that in order for getting the Zyxel switch to work I had to also specify a value for the MSS.

    For future readers: I set the MSS value to exactly the same as the MTU (1420). The field description states that the actual MSS is calculated by subtracting 40 from this value. Which results in 1380, the same value that can be found in the referenced OPNsense documentation.

    Thanks for the quick response :).

  • Error install HAVP

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S

    http://forum.pfsense.org/index.php?topic=1352.0

  • HAVP + ClamAV: some thoughts on setting it up

    Locked
    5
    0 Votes
    5 Posts
    10k Views
    R

    Updated HAVP, works with current ClamAV package. Should hit CVS any time now.

    raj

  • Installing Packages..

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    D

    @clamothe:

    wow..  i just realised that I forgot to install pfsense on my HD, and I was running it off livecd for the past two weeks lol, thanks tho

    update: Okay I have it installed on my HD now.  I'm looking at packages, but the list is limited.. how do I install lighttpd?  I don't see a package upload either.  I ssh'd in and did pkg_add -r http://pfsense.org/packages/All/lighttpd-1.4.11.tbz ala freebsd, and it installed fine, but there's no gui element installed.

    Lighttpd alredy installed - this system package - WebGUI worked in them

    type pkg_info - you see all installed FreeBSD packages. But this not some WebGui packages list. InWebGUI you can see users packages and can't see system packages.

  • Squid package questions

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • I don't know the antivirus has start?

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    A

    Hi,
    When I go to "Service"–>"Clamav"
    The page show a follow error:
    Warning: Invalid argument supplied for foreach() in /usr/local/www/pkg_edit.php on line 326
    How I to do?
    Thanks a lot.

  • Re: Transparent Squid and Traffic Shaping!!

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    ?

    http://forum.pfsense.org/index.php?topic=1352.0

  • Squid install problem

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S

    http://forum.pfsense.org/index.php?topic=1352.0

  • Updated packages

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S

    The installed package tab will show new versions.

  • Package installation

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    B

    OK, so that's the case thnx!
    I'll try BETA 4 :)

  • Unable to communicate to pfSense.com

    Locked
    3
    0 Votes
    3 Posts
    7k Views
    N

    I found out why it wasn't working.
    The "Allow DNS server list to be overridden by DHCP/PPP on WAN" option was enabled in the "System: General Setup" menu.

  • Freeradius

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    S

    FreeRADIUS is marked as broken.  Surely you dont' expect something marked as broken to work!?

  • Pfflowd non correctly counts

    Locked
    12
    0 Votes
    12 Posts
    7k Views
    B

    @freeseacher:

    @billm:

    It's likely that pfflowd is only counting stuff that matches state.  Retransmits that got dropped for whatever reason likely don't add to the flow numbers it retains.

    pfflowd gets it's data from pfsync - I don't believe it maintains a table of inflight flows, I'm pretty sure it gets it's data from the state teardown messages.  So, the data comes directly from the PF state entry which means only data that pf forwarded itself.

    –Bill

    rules for pf was
    pass any in keep-state
    pass any out keep-state

    is there someting to miss ?

    Yes, my point ;)

    Not all packets in a given TCP flow will be considered "in state".  Consider out of window packets, out of sequence window packets (stuff that's been ack'd and had data past it acked, but was retransmitted all the same).  "normal" TCP communications do have packets that will get blocked.  I'm reasonably confident that those packets will not cound against the PF byte count for that flow.  The easiest way to determine that is to see if the PF byte count more closely matches that of the file(s) that were transferred.  If it's under, then there's a bug somewhere, if it's over, but over by less than the other accounting types (ng_netflow is going to get all packets regardless of whether pf blocks it) then it's not a bug per se, you just have to understand what/where you're monitoring.

    –Bill

  • Error when installing STUNNEL

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    L

    thanks a lot Sullrich, it's OK now  ;)

  • Antivirus for PFsense

    Locked
    2
    0 Votes
    2 Posts
    7k Views
    S

    Fernando is working on it but there is no ETA.

  • ClamAV

    Locked
    8
    0 Votes
    8 Posts
    8k Views
    R

    Hi,

    I have made a clamav package, it's not complete as yet and I have not added any web gui for starting or stopping or for other options in config files. As of now you can just test it from command line by running clamscan. The actual use for clamscan is for havp. As of now havp has experimental FreeBSD support and I am working on packaging it for FreeBSD. In the mean time pl test the clamav package. This is my first stab at packaging some thing for pfSense, so there will be lot's of things that can be improved.

    raj

    I am posting the clamav section from pkg_config.xml and the package configuration files.

              <package><name>clamav</name>           <website>http://www.clamav.net/</website>           <descr>Opensource anti virus</descr>           <category>Services</category>           <config_file>http://agni.linuxense.com/packages/config/clamav.xml</config_file>           <depends_on_package_base_url>http://ftp13.freebsd.org/pub/FreeBSD/ports/i386/packages-6.0-release/All</depends_on_package_base_url>           <depends_on_package>clamav-0.87.tbz</depends_on_package>           <version>0.1</version>           <status>BETA</status>           <maintainer>raj@linuxense.com</maintainer>           <configurationfile>clamav.xml</configurationfile>           <logging><facilityname>clamav</facilityname>                 <logfilename>clamav.log</logfilename></logging></package>

    config.xml

    <packagegui><name>clamav</name>         <version>0.1</version>         <title>ClamAV: Settings</title>         <include_file>/usr/local/pkg/clamav.inc</include_file>         <service><name>clamav</name>                 <rcfile>/usr/local/etc/rc.d/clamav.sh</rcfile></service>         <additional_files_needed><prefix>/usr/local/pkg/</prefix>             <chmod>0755</chmod>             http://agni.linuxense.com/packages/config/clamav.inc</additional_files_needed>         <custom_php_install_command>clamav_install_command();</custom_php_install_command>         <custom_php_deinstall_command>clamav_deinstall_command();</custom_php_deinstall_command>         <custom_delete_php_command>sync_package_clamav();</custom_delete_php_command>         <custom_php_resync_config_command>sync_package_clamav();</custom_php_resync_config_command>         <custom_add_php_command>sync_package_clamav();</custom_add_php_command></packagegui>

    clamav.inc

    function sync_package_clamav() {         conf_mount_rw();         config_lock();         global $config;         $start = "/usr/local/sbin/clamd &\n";         $stop  = "/usr/bin/killall clamd\n" .         "sleep 2";         write_rcfile(array(                           "file" => "clamav.sh",                           "start" => $start,                           "stop" =>  $stop                           )                     );         conf_mount_ro();         config_unlock();         mwexec("killall -HUP cron");         mwexec("/usr/local/etc/rc.d/clamav.sh stop");         mwexec("/usr/local/etc/rc.d/clamav.sh start"); } function clamav_install_command() {         global $config, $g;         mwexec ("mkdir -p /var/db/clamav");         mwexec ("/usr/local/bin/freshclam");         sync_package_clamav(); } function clamav_deinstall_command() {         global $config, $g;         conf_mount_rw();         unlink_if_exists("/usr/local/etc/rc.d/clamav.sh");         unlink_if_exists("/var/db/clamav/daily.cvd");         unlink_if_exists("/var/db/clamav/main.cvd");         unlink_if_exists("/var/db/clamav");         conf_mount_ro(); } ?>
  • Command Line package installation

    Locked
    4
    0 Votes
    4 Posts
    6k Views
    D

    and this command line wiil not work?

    php pkg_mgr_install.php?id=packagename

  • SpamD - add to whitelist working ?

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    S

    Yep, thats about it in a nutshell.

  • Spamd - Add spam trap E-mail address: + nextMTA

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    S

    @Aderium:

    Add spam trap E-mail address:

    if I add a spamtrap email called spamtrap@mydomain.com do I also need to create such user in my email server ?

    No, basically if a email address is the to: address then SpamD knowns to add this servers IP to the trapped database and then further connections from that mail server will be trapped in a great tarpit which looks like a 110 baud modem communication, wasting the cpu cycles of the mail server in question.  It's neat.

    @Aderium:

    nextMTA

    my internal ip address for mailserver is 10.1.10.10  is this the IP I would add to nextMTA ?

    Yep.

  • SpamD outlook button

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    H

    Install http://pfsense.com/~sullrich/SpamDOutlookAlpha/SpamD.msi . It will add the outlook plugin. You also need to have SpamD package installed at your pfSense of course.

  • Might I suggest breaking out the packages to their own directories

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    B

    @ronnieredd:

    Excuse me? Why am I making you click dozens of forums? Did I do something wrong? If so, I'm sorry. Please do elaborate.

    13 packages plus the existing dozen or so forums makes for dozens of forums.  I'm old enough to remember and use BBS's, yet I still prefer email - I can sort and filter my inbox based on what I choose to read.  Which means more time spent on email worth replying to.  More forums split the attention the developers (who are still the primary support - although a few souls have certainly stepped up and chipped in on the support from) leaving us with less time to write code.  Until a package becomes enough of a nuisance filling the existing packages forum, it's really not worth splitting it out.

    –Bill

    PS. wut sullrich and hoba said

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.