Subcategories

• Cache/Proxy

  Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.
  4k Topics

  21k Posts

  O

  Hey that is familiar :

  [2.8.0-RELEASE][admin@fw1.man.mylocal]/root: squid -z
  ld-elf.so.1: /usr/local/sbin/squid: Undefined symbol "ZTVNSt3__117bad_function callE"

  Hopefully it is resolved soon!

• IDS/IPS

  Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.
  2k Topics

  16k Posts

  B

  @Darkk said in GUIDE: Snort's AppID custom rules Quick Guide to blocking. Example shows OpenAI ChatGPT or Itunes.:

  @bmeeks

  I have a question. Why can't we get Snort 3 on pfsense since version 2 is being depreciated? I know there's Suricata but like to have options.

  Snort and Suricata are both volunteer maintained packages. That means a volunteer contributes the programming effort required to create and maintain the package without compensation and without any involvement from the pfSense developer team other than that team manually merging code changes submitted by the maintainer into the official pfSense repository. For Snort, I assumed the maintainer role for that package many years ago when the original developer grew weary and moved on. I wanted certain features to be available in the package (flowbits primarily), and so I added the necessary code and submitted the Pull Request to GitHub. It was accepted, and so I offered a few more updates such that over the years I became the defacto maintainer for Snort. For Suricata, I created that package from scratch, submitted the Pull Request to the Netgate team, and have been maintaining it since as a volunteer contributer sharing my work with the pfSense community for free.

  For both packages, I am getting ready to step aside. There is no compensation for volunteer maintainers, and since I retired from an IT role in a Fortune 500 US company several years ago, I am slowly disentangling myself from committments to more fully enjoy my retirement. That's one of the reasons you have seen fewer Snort and Suricata updates over the last year.

  I tried on two separate occasions in the recent past to create a Snort3 package for pfSense. But I gave up in frustration both times. Partly because my heart was not totally in it for the reasons outlined above (my retirement), but also because it's very hard to do since Snort3 is a radical departure code-wise from Snort 2.9.x on the binary side. It will require rewriting things in C++ and adapting all the old Snort 2.9.x configuration parameters over to Lua scripting. The use of Lua will require substantial changes in the GUI package code.

  The only way Snort3 will come to pfSense is if either some other new volunteer steps forward to create the required package, or if Netgate decides to take it over. Everything needed is available on the pfSense GitHub repo here -

  Snort Binary Package Code: https://github.com/pfsense/FreeBSD-ports/tree/devel/security/snort
  Snort GUI Package Code: https://github.com/pfsense/FreeBSD-ports/tree/devel/security/pfSense-pkg-snort

  If Snort3 is important to you, perhaps you might consider stepping into the volunteer maintainer role like I did many years ago and then sharing your work with the pfSense community ... 😀.

• Traffic Monitoring

  Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.
  569 Topics

  3k Posts

  K

  @pulsartiger
  The database name is vnstat.db and its location is under /var/db/vnstat.
  With "Backup Files/Dir" we are able to do backup or also with a cron.

• pfBlockerNG

  Discussions about the pfBlockerNG package
  3k Topics

  20k Posts

  T

  Looks like dev (@BBcan177) is already reviewing. Good teamwork, y'all.

  Responsible commit here. Remark indicates it was a cleanup commit. I don't have the coding skills to say for sure, but this pfblocker.php update and this pfblocker_alerts.php update look odd for some reason, in addition to whatever the pfblockerng.sh L1281 fix exposed.

  @marcosm

• UPS Tools

  Discussions about Network UPS Tools and APCUPSD packages for pfSense
  94 Topics

  2k Posts

  V

  @Vancejo1 said in apcupsd causes restart:

  When I stop the apcupsd service and run apctest then select 10 battery calibration. It cause my router to reboot after reporting the calibration was aborted.

  Is it really rebooting? Or does the UPS cut the power?
  Check the logs to get sure.
  I've seen the latter already, but with old batteries, however.

• ACME

  Discussions about the ACME / Let’s Encrypt package for pfSense
  491 Topics

  3k Posts

  J

  Let's Encrypt is removing the TLS Client Authentication EKU from certificates they sign in the near future:

  https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/

  This shouldn't affect many, if any, users of ACME on pfSense as it isn't used as a client certificate, only as a server certificate in various context (e.g. GUI, Captive Portal, HAProxy)

  In the past we have discouraged using Let's Encrypt certificates in certain contexts (like for clients) since it wasn't typically a secure practice. For example, if you use a Let's Encrypt certificate for OpenVPN, it would trust any certificate signed by Let's Encrypt, which makes it useless as an authentication factor.

  So while this is something to be aware of and check, it's unlikely to be a problem for most people.

• FRR

  Discussions about the FRR Dynamic Routing package on pfSense
  291 Topics

  1k Posts

  F

  After further troubleshooting, I discovered that, for some reason, the file /var/etc/frr/frr.conf is missing the line "ip ospf area 0.0.0.0" on every interface.

  However, whenever I restart the FRR services, the file is rewritten and the "ip ospf area 0.0.0.0" line is correctly added to every interface.

  I’m not sure if this is the root cause of the problem or just a symptom. The fact is, when I reboot my HA PFSense box, /var/etc/frr/frr.conf is missing the "ip ospf area 0.0.0.0" statements, and only after restarting the FRR service does the file get updated.

  In practical terms, I observe that no OSPF hello packets are sent until this is fixed—that is, until the services are restarted.

  EDIT:

  /usr/local/pkg/frr/inc/frr_ospf.inc

  line 215, remove:

  if (empty($interface_ip)) { continue; }

  This fixes the problem.

• Tailscale

  Discussions about the Tailscale package
  86 Topics

  552 Posts

  J

  Looks like Tailscale updated their Oauth to include client ID and client secret. Currently, I cannot login with client secret only.

• WireGuard

  Discussions about WireGuard
  681 Topics

  4k Posts

  R

  @The-Party-of-Hell-No I did that already. I also looked into DNS access list. On the client side, I added the tunnel network and the server lan to the access list. On the server side, I added the the tunnel network and client lan to the access list. I do see one strange feature. My main site is running local websites. If I put a dns override for on my client site, it will successfully complete that dns request.