1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    cyb3rtr0nianC

    @bmeeks So after upgrading to the newest PfSense 2.8.0 everything is now working like a charm!

    Suricata no longer seems to strip off tags like it did before! Which means I can now use my network segmented by VLANs and still use the benefits of Suricata Inline IPS! Very niiize!

    I checked in the Alerts section and it is indeed generating the correct alerts from the different VLAN sections, I put Inline IPS on the parent interface of all the VLANs.

    I assume this is because the FreeBSD version is also updated with the new PfSense 2.8.0 version?

    Because before, as soon as I selected Inline IPS mode, my entire VLAN tagging would break and nothing was reachable until I switched back to Legacy mode.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    reza3swR

    @Gertjan
    Hello,
    Thank you.
    I had exactly the same issue, and your solution helped me fix it.

    Ask ChatGPT

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD

    @jhg Please post the output of the following commands:

    pkg info | grep nut usbconfig dump_all_desc

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG

    @EChondo

    What's your pfSense version ?
    The instructions are shown here :

    1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png

    A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate.

    @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy:

    I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess.

    No need to wait x days.
    You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    89 Topics
    574 Posts
    A

    Hello,
    I am unable to get the Tailscale package to work. The page at VPN > Tailscale > Authentication is stuck. It displays the error "Tailscale is not online," but also shows a "Logout and Clean" button, with no option to log in.
    link text

    This state persists even after performing the following troubleshooting steps:

    Rebooting the pfSense router.

    Completely uninstalling and reinstalling the Tailscale package multiple times.

    Clearing browser cache and using a private browser window.

    Toggling the main "Enable Tailscale" checkbox in the settings.

    Checking the logs, which show the service gets a "terminate" signal and shuts down cleanly; it does not crash.

    Manually trying to delete the state file with rm /var/db/tailscale/tailscaled.state, which failed because the file does not exist.

    It appears that the package's configuration is corrupted in a way that persists even after reinstallation. Can anyone advise on how to perform a complete manual cleanup of all Tailscale files and settings?

  • Discussions about WireGuard

    690 Topics
    4k Posts
    J

    I've read through some other posts about this, but they either didn't say whether the proposed solution worked or they were very convoluted and difficult to understand. Here is our scenario: We have 6 locations--Las Cruces (LC), Sunland Park (SP), El Paso (EP), Abilene (ABI), Fort Worth (FW), and Plano (PL). LC and ABI have software that is accessed by the other 4 locations via VPN. There are WireGuard VPNs set up between LC and those 4 locations (SP, EP, FW, PL), and ABI and those 4 locations (SP, EP, FW, PL). There is also a WireGuard VPN connection between LC and ABI. LC and ABI have 2 internet connections. SP, EP, FW, and PL each have one internet connection.

    If the primary internet connection goes down at either LC or ABI and failover occurs to the secondary internet connection, is there a way to set up the WireGuard VPN connections so that they also failover without purchasing some 3rd party application?

    Thanks.

Log in to post
Load new posts
  • P

    Snort Pass List not auto created

    3
    0 Votes
    3 Posts
    1k Views
    bmeeksB

    @propel:

    I'm new to the Snort configurations, 1st time installing and using it.

    In snort, ' A Default Pass List ' was not automatically created.

    Do I actually need to create one then?

    Usually, in a home network setup, you do not need to create or set any specific Pass List.  The "defaults" that Snort will use if you do not create or set a list are generally sufficient.  It will not block your LAN IP block, or DNS servers, your default gateway nor your WAN IP address.  If you have multiple directly-connected networks (for example, DMZ, multiple LANs, VPNs, etc.), then they will be included as well.  You only need to create a Pass List when you have specific external hosts or networks you don't ever want blocked, or you have some internal hosts that are not on directly-attached networks that you don't want blocked.

    Bill

  • P

    Https connection getting stuck in squid for random clients

    1
    0 Votes
    1 Posts
    743 Views
    No one has replied
  • A

    Custom SquidGuard error [How-To]

    3
    0 Votes
    3 Posts
    5k Views
    P

    Nevermind, i'm dumb heh. got it working.

  • A

    HAVP proxy blocking an application

    5
    0 Votes
    5 Posts
    1k Views
    A

    It's been a while since I've had to address this issue.  I can resurrect old threads :)

    Now the pfSense is on version 2.1.4 and I'm still getting the same outbound blocking when I have HAVP enabled.

    Ideas?

  • A

    New HTTP+HTTPS Proxy / DNS Filter Package

    8
    0 Votes
    8 Posts
    3k Views
    A

    @networkinggeek please submit a support ticket and we'll get you straightened out.

    @Hollander we are working out some kinks but we intend to be in the main package repo.

    @rjcrowder & @Hollander We use a cloud based categorization service that has over 500 million urls categorized. We've made it so you can install the package and be filtering https traffic within 5 mins.

  • S

    Snort uses up all memory (12GB) [SOLVED]

    34
    0 Votes
    34 Posts
    14k Views
    S

    Thanks :)

  • C

    Strange SquidGuard problem.

    3
    0 Votes
    3 Posts
    1k Views
    C

    @golmaal:

    Maybe I haven't understood your problem correctly, but this may help:

    SquidGuard (and the firewall rules too) works on the basis of first-match. The filtering rules do not cascade.

    Let us say you have Group ACL X and Group ACL Y (in that order) and then Common ACL. When someone accesses the Internet, SquidGuard tries to first match it with Group ACL X. If the match is positive (i.e. if the IP or the user belongs to Group ACL X), the Group ACL X will apply to it irrespective of your Common ACL and other Group ACL. Once the match is positive, it won't filter it using any other Group ACL or Common ACL. If the first match fails, it will try to  match it to Group ACL Y; if it matches, Group ACL Y will apply to it. If there are no matches, Common ACL will apply.

    So you need something like this:

    Group ACL X: Block Porn, Block P2P, Allow All
    Group ACL Y: Allow All
    Common ACL: Block All

    I will try this as soon as I get time to use mess around with it again..

    Thanks for the reply.  I will post what I find.

    DrClaw

  • A

    Separate squid cache drive/partition?

    4
    0 Votes
    4 Posts
    1k Views
    A

    Ok. So, I realized that 40 MB is just a teensey bit small for this kind of thing. I purchased 2 CF-style microdrives with PCMCIA adapters. I'll find a use for the other on someday, but for now, I am using one of the Microdrives (each drive is 2 GB) for the cache.

  • W

    NUT UPS with blazer_usb wont start

    2
    0 Votes
    2 Posts
    1k Views
    W

    Nobody?  :-\

  • M

    Squid Proxy Maximum object size

    4
    0 Votes
    4 Posts
    11k Views
    T

    I don't believe this had a separate topic in the old forum, here is a summary of the steps.

    The cachemgr.cgi page is a symbolic link to the file in the PBI folder.
    And external cache manager as your local box in the squid config.

    You create a symbolic of "cachemgr.cgi" in the /usr/local/www folder.
    Link that to "/usr/pbi/squid-amd64/libexec/squid/cachemgr.cgi" (or i386 when you installed 32-bit pfsense)

    Then add your pfsense box ip as a external cache manager in the Proxy server -> local cache ->"External Cache-Managers"
    (it works for me)

    Then you should be able to browse to http://pfsense-ip/cachemgr.cgi (login info is the same as the pfsense gui)

    (or you could need to edit "/usr/pbi/squid-amd64/etc/squid/cachemgr.conf" and change localhost to your pfsense-ip)

    With https you may need to add the portnumber https://pfsense-ip:666/cachemgr.cgi (whatever port your pfsense https responds to)

  • arrmoA

    Darkstat Settings Lost on Upgrade

    3
    0 Votes
    3 Posts
    1k Views
    arrmoA

    Makes sense, thanks!

  • M

    Squid3 clean install: no internet access

    8
    0 Votes
    8 Posts
    2k Views
    KOMK

    No idea.  Everyone goes for squid3-dev because that's the one that supports transparent HTTPS intercept.

  • M

    OpenVpn - Multiple instances

    4
    0 Votes
    4 Posts
    1k Views
    C

    I had enabled modem gui access from the firewall and had created an additional interface on WAN as per instructions given on https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewal …l hence there were two interfaces WAN & Modem Access which were having the same mac id, until ver 2.1 OPNVPN never created multiple instances but post 2.1.1-2.1.4 OPNVPN created multiple instances, then I removed the modem access and ( deleted modem access interface) and every thing worked fine.

  • A

    SSL Offloading with squid3 + HAProxy

    7
    0 Votes
    7 Posts
    3k Views
    A

    Well, ok I see what you mean.

    Thank you very much !

  • A

    Syslog-ng configuration

    9
    0 Votes
    9 Posts
    14k Views
    A

    thank you for your help  ;D

  • Z

    Squid authentication + Dansguardian (not NTLM)

    5
    0 Votes
    5 Posts
    2k Views
    R

    @ZGruk:

    You have to configure the proxy settings to point directly to dansguardian (port 8080) instead of port forwarding from 80 to 8080.

    Sorry for the thread resurrection. I'm not clear how to do this. Is the setting changed in squid? Or is it a firewall/NAT rule that I have to write. Any chance you (or anyone) can post more detailed steps.

    Thanks!

  • S

    OpenVPN Export doesn't work on alix board with 2.1.4

    4
    0 Votes
    4 Posts
    990 Views
    S

    Write 2.1.4 on a new CF card and boot pfsense.
    Install the OpenVPN Export package and reboot, works fine with default config.

    Restore my backup and reboot, works fine.

    Maybe the CF card was bad or something in the update process goes really wrong.

  • A

    Bypass proxy or allow domain on Squid [SSL]

    2
    0 Votes
    2 Posts
    2k Views
    D

    If I understand it correctly, you host your organization's email on Office 365?
    If so, do you have autodiscover.<your_domain>.com properly aliased (CANME) to autodiscover.outlook.com?

    Reason I am asking is that autodiscover.outlook.com does not respond on port 443 (and should not).

    In case it is configured correctly, you also have to be mindful of when to enter which credentials - some will ask you for your proxy credentials and some will ask for application (exchange) credentials.

    And another way to test this is to allow your test machine to connect directly - does it work or still prompts?</your_domain>

  • A

    Blocking HTTPS and Streaming

    11
    0 Votes
    11 Posts
    2k Views
    R

    @Legion:

    If you just want to block a short, fixed list of things, can't you use aliases and firewall rules?

    Absolutely. The hard part of doing it that way though is that some of the bigger sites can have multiple IP addresses and those addresses can change on a fairly regular basic. You really need something that keeps the list of addresses up to date if you are trying to block one of the large sites…

  • A

    Allowing mobile devices through proxy [Squid + AD Auth + WPAD]

    4
    0 Votes
    4 Posts
    2k Views
    A

    Sorry for the long come back. Been busy with some works though.

    @dig1234:

    transparent proxy?

    Nope it is not transparent. Both HTTP/HTTPS are filtered & using WPAD for auto proxy.

    @Cino:

    iphone/ipad, you can use wpad but you have to enable it in the wifi setting for automatic… android, you have to manually set the proxy server in the dhcp/wifi setting... but i dont think https will work right...

    This is a pain. May be I should use some sort of captive portal on a different subnet. But then again it break the whole point of having a proxy in place. :(

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.