Hi,

if the installation breaks after a specific time, it is usually a timeout issue. This happens in the "extracting" phase, because no data is sent over the wire. This is a problem I had. Avahi is relatively large and last long, so this can happen easily. You could still install a package on command line.

Regarding AirPrint: Avahi is able to announce services (like an AirPrint printer) to devices, but there needs to be a CUPS Printer Spooler doing the actual print job and conversion to the actual Wifi printer, in case it is not able to do this by itself. Unfortunately you are not able to edit the services directly, but you can edit the files either thru the WebUI or via SSH. You can find the files here:

usr/pbi/avahi-i386/etc/avahi/services

By default, Avahi on pfSense announces SSH and SFTP.

Regards,

Darko

You can change the size via System - Advanced - Miscellaneous - RAM Disk Settings.

Edit:  Removed bogus advice to not increase RAM disk on nano.

See this thread:

https://forum.pfsense.org/index.php?topic=80410.0

@chemlud:

@Supermule:

When pinging from Scandinavia we get this:

PING files.pfsense.org (208.123.73.81): 56 data bytes
64 bytes from 208.123.73.81: icmp_seq=0 ttl=50 time=152.243 ms

So we dont get a mirror on the package files…

My ping goes to the same IP.

…to me this whole story is kind of VERY disturbing...

For Nano image boxes, make sure you have at least 200 MB of free space in /tmp.  The package manager code gets tripped up if it runs out of space to unpack and install a package.  That might be what's happening to you.

There was also a problem a few days ago with the SHA256 checksum files not getting uploaded to the packages servers.  The developer team pushed a fix for that I noticed a few days ago.

Bill

@mschiek01:

This should work for you.  I just tried it on one of my boxes. Again this for a 64bit box.

1. Install the broken package with the package manager.

2. from the command line "pkg_info" you will see dansguardian 2.12.0.3_2 is installed.

3. from the command line "fetch http://files.pfsense.org/packages/amd64/8/All/dansguardian-2.12.0.3-amd64.pbi"

4. from the command line "pbi_add –no-checksig -f dansguardian-2.12.0.3-amd64.pbi"

5. from the command line "pkg_info" you will now see dansguardian-2.12.0.3_1 is installed.

6. reboot.

7 from the command line "/usr/local/bin/php /usr/local/www/dansguardian.php fetch_blacklist"  download and reapply blacklist.

8 go back through and resave each configuration page.

Ever since doing this, Dansguardian no longer shows up on my pfSense GUI as a service.  Any idea why?  I've tried uninstalling the package and re-installing.  The process looks to be completing successfully, but it doesn't show up.

Like I said earlier, squid3-dev can be a real pain.  What are you trying to do that you couldn't do with Squid 2.7.9?  If you look at the system log (Status - System logs - System - General), is there anything about squid in there (use the filter to show just lines with 'squid' in them)?

Hey KOM, I used QLProxy and these instructions and it works great:

http://sichent.wordpress.com/2014/02/22/filtering-https-traffic-with-squid-on-pfsense-2-1/

You have to do a bit of console work but it is worth it. 199 euros per year for a big organization is a really good deal especially since all the site categories are being updated daily. 12 earos per year for personal use is a really good deal.

Just need to setenv PACKAGESITE http://ftp-archive.freebsd.org/pub/FreeBSD-Archive/ports/amd64/packages-8.3-release/Latest/  to get python/apache loaded.

Jim

Does someone is able to install any package under 2.14-RELEASE ? Nothing working for me. Ending up with lib* files not found etc (Case for Xauth)

@iorx:

Anything I can do to help isolate the issue?

No idea? I'm out of idea's for the moment. (tried a lot, found nothing conclusive)
I have 4 systems at hand, all on the same level (2.1.4), different breeds (nano/full) and also 2 ISP's. 2 of them give no issue, on 2 other it does not work.
Also, I've just lost connectivity again to the forum (it did not resolve so no access for more than 10min)
So I'm still suspecting it to be an issue with the server?

In meantime I think it's a better idea to wait for someone from ESF to feedback with news or instructions…

@master9712:

Hi
I wanna to integrate Snort on pfsense to snorby on ubuntu.
Can you help..!

To feed Snort data to Snorby, enable Barnyard2 on the Snort interfaces on your pfSense box.  Do this on the BARNYARD tab.  Enable MySQL DB output on the BARNYARD tab in Snort and provide the database connection credentials.  That's all on the pfSense side.

There are some How-To documents you can find from a Google search for setting up Snorby on Ubuntu.

Bill

I kept digging around in the forums looking for a way forward on this and came across this thread https://forum.pfsense.org/index.php?topic=76597.0 which was helpful.

I was puzzled as to why an address change had been detected (based on the log entry in my previous post) when it is the same and is actually static from the ISP in this case.  Looking at rc.newwanip the "ip address change" message is a little misleading in that it would seem (I don't know PHP so I am mostly going off the comments here) when all dynamic interface types (PPPoE in my case) come up a reload of lots of things, including all packages, is always triggered regardless of the IP address.

In my case I do not believe any of the packages that I have installed (Bacula, Squid, Squid Guard and Quagga) need to be reloaded when the WAN interface comes up, but I understand that there are packages that do need reloading. Does it make sense to have an option on a per package basis to enable/disable a reload on at least a WAN, or possibly any, interface state change?

I would not have thought though that Quagga should ever be reloaded just because an interface changes state?

As per the above mentioned thread I have commented out the call to restart_packages() in rc.newwanip to see if that resolves my issue without introducing any other issues.

Thanks

Mike

Happens to everyone at some time or another …  :)

Problem resolved. My IPv6 was released by my ISP, for some reason. Hence, I couldn't ping ANY IPv6 addresses, I just noticed the DNS issues first.

After a restart of the cable modem, and pfsense box, everything is operating as expected.

Any one?

Nobody knows?

@supermega:

Hi guys

I'm trying to implement an IDS/IPS system on my pfsense box. For me  it's doesn't matter if I use Snort or Suricata in the future.
I started first with snort and because snort wasn't working I tried suricata. I have seen that both packages gave me back the same error.

If I start snort or suricata (interface only or trough status –> service) the services doesn't start. (nothing happen, red cross stays there)

Following error if I try to start Suricata via shell:

[2.1.4-RELEASE][root@XXX-pfs-1.XXX.local]/root(13): /bin/sh /usr/local/etc/rc.d/suricata.sh start
7/8/2014 – 16:22:27 - <info>- This is Suricata version 1.4.6 RELEASE
7/8/2014 -- 16:22:27 - <info>- CPUs/cores online: 2
7/8/2014 -- 16:22:27 - <info>- Live rule reloads enabled
7/8/2014 -- 16:22:27 - <info>-- allocated 1572864 bytes of memory for the defrag hash... 65536 buckets of size 24
7/8/2014 -- 16:22:27 - <info>-- preallocated 65535 defrag trackers of size 120
7/8/2014 -- 16:22:27 - <info>-- defrag memory usage: 9437064 bytes, maximum: 33554432
7/8/2014 -- 16:22:27 - <info>-- AutoFP mode using "Active Packets" flow load balancer
7/8/2014 -- 16:22:27 - <error>-- [ERRCODE: SC_ERR_ADDRESS_ENGINE_GENERIC(89)] - failed to parse address "fe80::250:56ff:fe9e:43df%em0"
7/8/2014 – 16:22:27 - <error>-- [ERRCODE: SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - failed to parse address var "HOME_NET" with value "[8.8.8.8,10.0.0.0/24,10.0.0.252/24,10.0.2.0/24,10.0.2.252/24,10.0.3.0/24,10.0.3.252/24,10.0.4.0/24,10.0.4.252/24,10.0.5.0/24,10.0.5.252/24,10.0.6.0/24,10.0.6.252/24,10.0.7.0/24,10.0.7.252/24,10.0.8.0/24,10.0.8.252/24,10.0.9.0/24,10.0.9.252/24,127.0.0.1,172.16.0.0/16,172.16.1.252/16,192.168.1.0/24,192.168.77.0/24,194.246.118.118,212.25.27.51,212.25.28.55,212.25.29.73,212.25.29.74/32,2001:XXX:40:304::dead:beef,2001:XXX:80::dead:beef,2001:XXX:XXX::1fe/120,2001:XXX:XXX::2fc/120,2001:XXX:XXX::3fc/120,2001:XXX:XXX::4fc/120,2001:XXX:XXX::5fc/120,2001:XXX:XXX::6fc/120,2001:XXX:XXX::7fc/120,2001:XXX:XXX::8fc/120,2001:XXX:XXX::9fc/120,2001:XXX:XXX::100/120,2001:XXX:XXX::200/120,2001:XXX:XXX::300/120,2001:XXX:XXX::400/120,2001:XXX:XXX::500/120,2001:XXX:XXX::600/120,2001:XXX:XXX::700/120,2001:XXX:XXX::800/120,2001:XXX:XXX::900/120,2001:4860:4860::8888,fd34:fe56:7891:2f3a::/64,fe80::250:56ff:fe9e:43df%em0]". Please check it's syntax
7/8/2014 – 16:22:27 - <error>-- [ERRCODE: SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - basic address vars test failed. Please check /usr/pbi/suricata-amd64/etc/suricata/suricata_29766_em1/suricata.yaml for errors

On snort I doesn't get any messages but I saw the same error (failed to parse address) in previous versions of snort. In the System Logs I'm not able to see any errors from snort or suricata.

Hopefully somebody can help me out.

regards

supermega</error></error></error></info></info></info></info></info></info></info>

There is currently an issue with IPv6 Link Local addresses in both packages.  I have a fix for Snort posted that is awaiting review and approval by the pfSense Developer Team.  Hopefully they can get it approved and posted in a few days.

I also have a fix for Suricata in the works that will come out with the next update.

If you know how to transfer files over to your firewall via scp (secure copy), then PM me and I can send you the Snort fix and you can help me test it.

Bill

@panz:

Sorry, I didn't ask my question with the right words.

Q: is there a method to setup SNORT in a manner that it will alert me for fragmented packets even if I disabled the frag3 engine detection?

No, that frag3 engine is where those alerts come from.

Bill

Well, Squid and SquidGuard are common FOSS packages for doing caching and filtering, so you could actually download those packages and try for yourself.  Or, you could use a search engine to read up on the documentation to get most of your answers.

Yes, you can create custom groups.  No, there is not just one common profile/group.  Look into Group ACL.