1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    cyb3rtr0nianC

    @bmeeks So after upgrading to the newest PfSense 2.8.0 everything is now working like a charm!

    Suricata no longer seems to strip off tags like it did before! Which means I can now use my network segmented by VLANs and still use the benefits of Suricata Inline IPS! Very niiize!

    I checked in the Alerts section and it is indeed generating the correct alerts from the different VLAN sections, I put Inline IPS on the parent interface of all the VLANs.

    I assume this is because the FreeBSD version is also updated with the new PfSense 2.8.0 version?

    Because before, as soon as I selected Inline IPS mode, my entire VLAN tagging would break and nothing was reachable until I switched back to Legacy mode.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    W

    @qinn
    Sent him an email Dan an email to the address on his site.. Not sure what is happening, my Teams stopped working. Disable it/turn it off and the problem went away.

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    99 Topics
    2k Posts
    K

    @elvisimprsntr thanks for your suggestion. I will give it a try.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG

    @EChondo

    What's your pfSense version ?
    The instructions are shown here :

    1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png

    A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate.

    @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy:

    I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess.

    No need to wait x days.
    You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    89 Topics
    574 Posts
    A

    Hello,
    I am unable to get the Tailscale package to work. The page at VPN > Tailscale > Authentication is stuck. It displays the error "Tailscale is not online," but also shows a "Logout and Clean" button, with no option to log in.
    link text

    This state persists even after performing the following troubleshooting steps:

    Rebooting the pfSense router.

    Completely uninstalling and reinstalling the Tailscale package multiple times.

    Clearing browser cache and using a private browser window.

    Toggling the main "Enable Tailscale" checkbox in the settings.

    Checking the logs, which show the service gets a "terminate" signal and shuts down cleanly; it does not crash.

    Manually trying to delete the state file with rm /var/db/tailscale/tailscaled.state, which failed because the file does not exist.

    It appears that the package's configuration is corrupted in a way that persists even after reinstallation. Can anyone advise on how to perform a complete manual cleanup of all Tailscale files and settings?

  • Discussions about WireGuard

    689 Topics
    4k Posts
    P

    @patient0 Thanks for further suggestions. The tunnel is definitely up and so I don't think this is a CGNAT issue after all. WAN firewall rule is in place for UDP on port 51823 (otherwise the tunnel wouldn't work, right?). I can ping from client 1 -> client 2 and visa versa and also ping all points in between like you suggest. I just can't open an HTTPS connection from pfSenseB from Client 1 using a browser. But I can do this the other way round i.e. from Client 2 to pfSenseA

    I will try and do some packet capture to see if that reveals anything.

Log in to post
Load new posts
  • F

    Snort GPLv2 community rules expected MD5 checksum blank.

    11
    0 Votes
    11 Posts
    5k Views
    bmeeksB

    @gregg1ep00:

    You're right, I just looked and it downloaded.  Must have been a hiccup.

    Thanks so much for the quick response.  Sorry it ended up being nothing (but then again, very glad it was nothing).  ;D

    I tried to make the newest rules update code as robust as possible.  It will try 4 times, with a 15-second pause in between each try, before it gives up completely and bails on any given ruleset to move on to the next one.  The idea was to get past any temporary Internet glitches.  Of course if the site is unavailable for more than 60 seconds, those rules will not download until the next scheduled update.

    Bill

  • A

    Unbound 1.4.21_0

    6
    0 Votes
    6 Posts
    2k Views
    D

    wagonza fixed this yesterday.

  • B

    Cachemgr.cgi???

    6
    0 Votes
    6 Posts
    3k Views
    B

    @Nachtfalke:

    The ACL part you did I just added on GUI squid –> Access Control --> External Cache-Managers
    There I added just an IP address of one of my VLAN interfaces (LAN site).

    unfortunately, squid 3.x GUI does not have a 'External Cache-Managers ACL' under squid GUI –> ACLs

    Or maybe I am just blind and cannot see it  :)

    Then I will be prompted for username - which is admin - an my password myVerySecretMasswordForUserAdmin

    Not sure but if you do not use any password then it could be possible for someone from your LAN to check the cachmgr.cgi which probably should not be possible.

    On my network, pfSense webConfigurator is only accessible if you are in the "management" network… clients on the lan have to tunnel through VPN to access the management network and I am the only user allowed to get there... of course, I should probably set a password because "you never know"tm

    I will look into it. Thanks.

    -bu

  • S

    Help for FreeRADIUS2!!!

    2
    0 Votes
    2 Posts
    837 Views
    N

    https://doc.pfsense.org/index.php/FreeRADIUS_2.x_package

  • M

    First time squid enable, no hits

    18
    0 Votes
    18 Posts
    15k Views
    marcellocM

    @nesense:

    I have no idea why dynamic caching doesn't work in squid 3 on pfsense when the options has been there for years… obviously no one gives a sh*t about this when you issue a bug report.

    As I told when I've pushed it to package.
    These config are based on squid wiki. If you want to help, test and/or find a working free video cache squid config. This way I can do my best to include it on squid3-dev config.

  • P

    PfBlocker firewall rule order clarification

    4
    0 Votes
    4 Posts
    2k Views
    marcellocM

    @pfNeo:

    @marcelloc:

    Do you have proxy configured on this server?

    Actually, yes!

    Change rule action to alias only and create these rules on floating tab.

    Other way to do this is to block it on proxy acls based on site name.

  • P

    Sarg on PFSense 2.1 - View graphical results on embedded (Nanobsd)

    5
    0 Votes
    5 Posts
    2k Views
    marcellocM

    I've updated the package to include these changes with no version bump.

  • H

    SNORT - FATAL ERROR! Unable to process the IP address:

    8
    0 Votes
    8 Posts
    6k Views
    bmeeksB

    @Nadrek:

    That's a limitation indeed - would it be possible for the GUI to detect (parse the system log, perhaps) a failure to start SNORT, figure out which ruleset it was, and then change the snort.conf file to disable that ruleset while recording the hash of it, and when the hash changes, re-enable and then process normally (including, again, the disable on crash due to ruleset)?

    No, the GUI can't do this except during manual rule updates.  See, the GUI code is not even running once you leave the Snort menus.  All those web page sessions in the GUI are essentially stateless.  When you exit the page or browse to another menu, that former PHP GUI process shuts down.  The automatic rule updates are done entirely via a cron job.  Trying to figure out which rule failed is a big effort.  I just don't think that is practical.  After all, this problem with a corrupted rules file has only happened once in the year I have been quasi-maintaining the Snort package.

    A better solution is for someone to create a service monitoring package for pfSense.  You could load it with the services you want monitored, and then on some interval it could canvass the running processes (services) to see what is and is not running.  It could either attempt a restart of dead services, or raise an alert or alarm if one won't restart.  Maybe something like this exists and I'm just not aware of the package?

    Bill

  • S

    PfBlocker error

    3
    0 Votes
    3 Posts
    1k Views
    S

    Thanks for directions, found it, fixed it, working :)

  • E

    Squid settings question

    5
    0 Votes
    5 Posts
    2k Views
    M

    I see your point Ecnerwal.  I would hope the author simply misused the word "swap" for "cache".  Your right, there generally isn't any swapping going on in a cache.  Operates more like a FIFO, in the case of Squid, a conditional or rules based FIFO.  I don't swap anything to my SSD either, use RAM for all I can except the occasional logging on a 4 hr interval.

  • S

    Snort kills routing to specific domains!

    6
    0 Votes
    6 Posts
    1k Views
    S

    Pfsense 2.0.3 and Snort 2.9.4.6 pkg v. 2.6.0

    :)

    I used the affected machines earlier today and suddenly it rendered the subdomain useless on all ports. Main domain was fine and even other subdomains worked.

    I rebooted and it worked fine for a couple of minutes and then the affected subdomain was unreachable. Disable snort and a reboot, then it came on fine again. Then I got the dce_iface error and disabled the preproc. and it has been running since…

  • perikoP

    Sarg segment fault pf 2.1 i386

    1
    0 Votes
    1 Posts
    834 Views
    No one has replied
  • M

    Dansguardian can work with multiples groups filtering by IP?

    3
    0 Votes
    3 Posts
    1k Views
    M

    That did it for me at least. Thank you!

  • R

    Varnish 3

    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • C

    Please start bandwidthd to populate this directory

    Locked
    2
    0 Votes
    2 Posts
    4k Views
    GruensFroeschliG

    Reported by marceloviana on Yesterday at 16:31:18. They left the following message:

    I used this line in console for resolved: /usr/pbi/bandwidthd-amd64/bandwidthd/bandwidthd

  • F

    Havp - No such file or directory

    4
    0 Votes
    4 Posts
    3k Views
    F

    Is there a way to know what the problem
    Without making changes
    Because I do not understand it and do not want to ruin

    Is the link I added to the previous message can be a solution ?

  • M

    Snort download blocked hosts = empty tar.gz?

    7
    0 Votes
    7 Posts
    2k Views
    M

    Thank you Bmeeks  ;D

  • M

    Troubles with squid and https

    4
    0 Votes
    4 Posts
    5k Views
    M

    Wow wow! Breaking my mind  :o!

    FYI I didn't try squid3-dev yet, was doing some tests with actual squid…

    Figure out that I can actually reach https://www.google.fr make search but can reach gmail or google.com.. I think my squid is possessed and making fun of me.

  • perikoP

    Pf 2.0.3 squid 2.7.x squidGuard custom not sync correctly

    3
    0 Votes
    3 Posts
    1k Views
    perikoP

    Thanks marcelloc.

  • P

    Snort alerting on deselected category

    10
    0 Votes
    10 Posts
    4k Views
    P

    Wow … Thanks much!

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.