1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    JonathanLeeJ
    Squid can be configured externally, I would love a how to guide on how to do this correctly.

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    DARAD
    Hello team, I have a Netgate 8200 running 24.11-RELEASE (amd64) with Suricata 7.0.8_5 package installed. Suricata doesn't seem to start. It loops to red once I press the Play button on the interface. It leaves no logs in the System logs, it leaves no logs in suricata.log at /var/log/suricata/suricata_ovpns933787/suricata.log I tried launching it manually: # /usr/local/bin/suricata -V or # /usr/local/bin/suricata -c /usr/local/etc/suricata/suricata_33787_ovpns9/suricata.yaml -i suricata_ovpns933787 and I get this output ld-elf.so.1: /usr/local/bin/suricata: Undefined symbol "__strlcpy_chk@FBSD_1.8" Thanks in advance, Dara

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    573 Topics
    3k Posts
    dennypageD
    @kabeda If memory serves, that old version of ntopng did not run as user ntopng, but as user nobody. There are lots of problems in that old version. Anyway, check the ownership and permissions of /var/db/ntopng and make sure it matches the user that ntopng runs as. You may need to set ownership of the entire hierarchy. Example: /usr/sbin/chown -R nobody:nobody /var/db/ntopng However, the better choice would be to upgrade to a more recent version.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    tinfoilmattT
    @vicking said in No blocks on IP: Is it a bad idea to have the action set to deny both instead of inbound only? Question is squarely for admin. Per the infoblock which explains, in part, the "Deny Inbound", "Deny Outbound", and "Deny Both" actions: 'Deny' Rules: 'Deny' rules create high priority 'block' or 'reject' rules on the stated interfaces. They don't change the 'pass' rules on other interfaces. Typical uses of 'Deny' rules are: Deny Both - blocks all traffic in both directions, if the source or destination IP is in the block list Deny Inbound/Deny Outbound - blocks all traffic in one direction unless it is part of a session started by traffic sent in the other direction. Does not affect traffic in the other direction. One way 'Deny' rules can be used to selectively block unsolicited incoming (new session) packets in one direction, while still allowing deliberate outgoing sessions to be created in the other direction. In other words: When set to "Deny Inbound", incoming connection requests from WAN hosts are blocked and therefore no state will be created. However a LAN host can still establish state to an otherwise listed IP. If set to "Deny Outbound", outgoing connection requests from LAN hosts are blocked and therefore no state will be created. However an incoming connection request from an otherwise listed IP to an 'open' WAN port can still establish state. If set to "Deny Both", both incoming connection requests and outbound connections requests are blocked and therefore no state will be created regardless of connection direction.

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    102 Topics
    3k Posts
    C
    @dennypage Nicely done sir!

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    503 Topics
    3k Posts
    M
    I am using the DNS-Update method I have to use a DNS-Sleep of 5 minutes to let the letsencrypt txt dns record update propagate. During this 5 minutes the acme-webgui times out. when the acme-webgui times out the Action list is NOT executed. How can I solve this ? Would it maybe be an idea to let the acme.sh script execute the actions in the action list as a post-hook instead of the web-gui? Or maybe add an option to add post-hooks in the webUI ?

  • Discussions about the FRR Dynamic Routing package on pfSense

    296 Topics
    1k Posts
    C
    This one has been tricky still not sure what to try. Any ideas?

  • Discussions about the Tailscale package

    93 Topics
    656 Posts
    C
    @elvisimprsntr Updated 25.07.1 to 1.90.6_1, copied and pasted from @elvisimprsntr's post: pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.90.6_1.pkg (Why it worked this time and not on previous updates: Over the last couple of days, I ran into the "Shared object "libutil.so.10, not found..." error that triggered the version 25.07.1 update issues some of us have been having. After I fixed that error, I decided to go back to the usual update method, and it worked.)

  • Discussions about WireGuard

    716 Topics
    4k Posts
    chpalmerC
    Im trying to set up Fubo TV for my mother using AT&T Wireless.. problem is they keep showing her California news channels... She wants local. Even though the website asks for her zip code they seem to default to the IP location. I have tried several times to sit down with this but can never get the thing to even ping from the other side. Connected with Wireguard here successfully for helping troubleshoot things for her otherwise.. Fubo is a PITA and keeps reverting back so I am finished trying to deal with them. Anyone got any tips? or a good tutorial??
Log in to post
Load new posts
  • R

    Zabbix to monitor site to site links openvpn

    Locked
    5
    0 Votes
    5 Posts
    9k Views
    R
    Hiya, Thanks for the reply and I hope you could assist me a bit further. Here is my setup zabbix server                pfsense main firewall                        pfsense another site 192.168.0.31                    192.168.0.251 (Local)                        192.168.20.250(local)                                 192.168.23.251 ( different vlans)            this is linked to 192.168.23.0/24 vlan There are multiple vlans on the main firewall some connection to other remote pfsense firewalls. So my question is on the remote pfsense, I install the zabbix client. In the client  setting, I will put the following : server:192.168.20.251 server Active:192.168.20.251:10050 Hostname:(name of firewall) Listen IP:0.0.0.0 listen port:10050 refresh active checks:120 timeout:3 buffer send:5 buffer size:100 start agents:3 On the main pfsense install the settings for the proxy is : Proxy settings server:192.168.0.31 server port:10051 hostname:(Proxyname) Mode Active: yes config frequency:3600 On the Zabbix server I created a proxy called (Proxyname) and then added the remote pfsense as a client but I do not get any results. On the remote pfsense agent logs is as follows: 6469:20130211:090609.894 Got signal [signal:15(SIGTERM),sender_pid:55456,sender_uid:0,reason:65537]. Exiting …   6054:20130211:090609.894 One child process died (PID:6653,exitcode/signal:65280). Exiting ...   6361:20130211:090609.894 Got signal [signal:15(SIGTERM),sender_pid:55456,sender_uid:0,reason:65537]. Exiting …   6054:20130211:090611.895 Zabbix Agent stopped. Zabbix 2.0.4 (revision 31984).   4277:20130211:090614.908 Starting Zabbix Agent [tfcfire01]. Zabbix 2.0.4 (revision 31984).   4348:20130211:090614.909 agent #0 started [collector]   4679:20130211:090614.910 agent #2 started [listener]   4457:20130211:090614.910 agent #1 started [listener]   5290:20130211:090614.910 agent #4 started [active checks]   4972:20130211:090614.910 agent #3 started [listener]   5290:20130211:092305.201 Got signal [signal:15(SIGTERM),sender_pid:6797,sender_uid:0,reason:65537]. Exiting …   4679:20130211:092305.202 Got signal [signal:15(SIGTERM),sender_pid:6797,sender_uid:0,reason:65537]. Exiting …   4348:20130211:092305.202 Got signal [signal:15(SIGTERM),sender_pid:6797,sender_uid:0,reason:65537]. Exiting …   4972:20130211:092305.202 Got signal [signal:15(SIGTERM),sender_pid:6797,sender_uid:0,reason:65537]. Exiting …   4457:20130211:092305.203 Got signal [signal:15(SIGTERM),sender_pid:6797,sender_uid:0,reason:65537]. Exiting …   4277:20130211:092305.203 One child process died (PID:4679,exitcode/signal:65280). Exiting ...   4277:20130211:092307.204 Zabbix Agent stopped. Zabbix 2.0.4 (revision 31984). 18350:20130211:092310.215 Starting Zabbix Agent [tfcfire01]. Zabbix 2.0.4 (revision 31984). 18681:20130211:092310.216 agent #0 started [collector] 18873:20130211:092310.216 agent #2 started [listener] 19115:20130211:092310.216 agent #4 started [active checks] 18710:20130211:092310.217 agent #1 started [listener] 18972:20130211:092310.217 agent #3 started [listener] 19115:20130211:092310.438 No active checks on server: host [tfcfire01] not found 19115:20130211:202847.418 No active checks on server: host [tfcfire01] not found The proxy logs on the main pfsense is as follows: 44419:20130211:091238.401 Zabbix Proxy stopped. Zabbix 2.0.4 (revision 31984). 10294:20130211:091258.834 Starting Zabbix Proxy (active) [bpsproxy]. Zabbix 2.0.4 (revision 31984). 10294:20130211:091258.834 **** Enabled features **** 10294:20130211:091258.834 SNMP monitoring:      YES 10294:20130211:091258.834 IPMI monitoring:        NO 10294:20130211:091258.834 WEB monitoring:        YES 10294:20130211:091258.835 ODBC:                  NO 10294:20130211:091258.835 SSH2 support:          NO 10294:20130211:091258.835 IPv6 support:          YES 10294:20130211:091258.835 ************************** 10357:20130211:091258.848 proxy #1 started [configuration syncer #1] 10482:20130211:091258.848 proxy #2 started [heartbeat sender #1] 10730:20130211:091258.849 proxy #3 started [data sender #1] 11948:20130211:091258.854 proxy #13 started [trapper #4] 11816:20130211:091258.853 proxy #11 started [trapper #2] 10294:20130211:091258.856 proxy #0 started [main process] 12588:20130211:091258.857 proxy #17 started [http poller #1] 13293:20130211:091258.859 proxy #21 started [history syncer #3] 11923:20130211:091258.863 proxy #12 started [trapper #3] 12007:20130211:091258.865 proxy #14 started [trapper #5] 13238:20130211:091258.911 proxy #20 started [history syncer #2] 12571:20130211:091258.914 proxy #16 started [housekeeper #1] 12571:20130211:091258.914 executing housekeeper 11498:20130211:091258.916 proxy #9 started [unreachable poller #1] 13572:20130211:091258.917 proxy #22 started [history syncer #4] 10756:20130211:091258.945 proxy #4 started [poller #1] 11278:20130211:091258.959 proxy #7 started [poller #4] 10892:20130211:091258.966 proxy #5 started [poller #2] 11374:20130211:091259.004 proxy #8 started [poller #5] 12790:20130211:091259.013 proxy #18 started [discoverer #1] 12225:20130211:091259.013 proxy #15 started [icmp pinger #1] 12959:20130211:091259.014 proxy #19 started [history syncer #1] 11534:20130211:091259.015 proxy #10 started [trapper #1] 10990:20130211:091259.017 proxy #6 started [poller #3] 12571:20130211:091259.190 housekeeper deleted 0 records from history (spent 0.004097 seconds) 10482:20130211:091358.853 Unable to connect to the server [192.168.0.31]:10051 [cannot connect to [[192.168.0.31]:10051]: [4] Interrupted system call] 10357:20130211:091414.095 Unable to connect to the server [192.168.0.31]:10051 [cannot connect to [[192.168.0.31]:10051]: [60] Operation timed out]. Will retry every 120 second(s) 10730:20130211:091414.198 Unable to connect to the server [192.168.0.31]:10051 [cannot connect to [[192.168.0.31]:10051]: [60] Operation timed out]. Will retry every 1 second(s) 10482:20130211:091458.860 Unable to connect to the server [192.168.0.31]:10051 [cannot connect to [[192.168.0.31]:10051]: [4] Interrupted system call] 10357:20130211:091529.103 Still unable to connect… 10730:20130211:091529.205 Still unable to connect... 10482:20130211:091558.868 Unable to connect to the server [192.168.0.31]:10051 [cannot connect to [[192.168.0.31]:10051]: [4] Interrupted system call] 10730:20130211:091645.215 Still unable to connect… 10482:20130211:091658.877 Unable to connect to the server [192.168.0.31]:10051 [cannot connect to [[192.168.0.31]:10051]: [4] Interrupted system call] Do I need any rules on the fiirewall pls. The link between the remote and main firewall is an openvpn site to site link always on.
  • T

    Snort and 2.1

    Locked
    6
    0 Votes
    6 Posts
    2k Views
    E
    Normally yes the fix is https://github.com/bsdperimeter/pfsense-packages/commit/c81902f92799a1f566667f8fae07ecb92069372f
  • M

    Lightsquid 1.8.0 v2.32 - view report prompts to save index.cgi?

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    jimpJ
    Mostly "If it isn't broke, don't fix it" but if you encounter a problem, first thing to try is a firmware update to a recent snapshot. Or an update once a month or every couple weeks is OK too. Difficult to generalize it really since it depends on the features you use and what work has been done on those since the last update that was done.
  • J

    Apache Mod Security package broken

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • N

    Allow videos to play on ESPN.com

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    marcellocM
    Firebug plugin on Firefox can help too.
  • D

    Any way to get Squid to load balance gateways ?

    Locked
    3
    0 Votes
    3 Posts
    1k Views
    S
    If you are trying to do this with automatic outbound nat howto's on the forum, it can be frustrating getting it to work, but I managed to get it going out both WAN's last night. First off make sure you dont have "Sticky connections" enabled, this was the prime reason why I noticed all my http traffic was only going out my primary wan, secondary wan was not utilised at all. Also when I created the floating rule, I chose [action:pass | quick:ticked | interface:wan1:wan2 | direction:out | protocol:tcp | destination port range:HTTP | gateway:MultiWan] In my firewall rule for the proxied interface, i.e LAN I created a default rule that passed all traffic to 'Gateway':MultiWan. Maybe the above LAN rule does'nt need to be set as your multiwan and can be just default gateway, as the floating 'quick' rule catches it before hand, also make sure you reset states and restart squid. If you have setup up squid correctly then it should work with the above notes/tips. Hope this helps anyone who had a frustrating time trying to get this to work :0)
  • A

    What's up with https url block?

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    marcellocM
    @AbdulCebbar: Well, thank you very much :) Be the first to post a bounty  :)
  • R

    Quagga OSPF + OpenBGP

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • O

    Installing Squid package on embedded version

    Locked
    1
    0 Votes
    1 Posts
    884 Views
    No one has replied
  • P

    Openvpn Client Export Utility little bug

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    D
    Thanks for posting this; I'd noticed the same bug and hadn't gotten around to posting about it but either you or someone else reported it and it got fixed and hasn't been an issue in recent versions. So thanks for mentioning it!
  • B

    PfSense 2.0.2 64-bit and download station

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    I
    You might be best off looking into something like freenas or commercial solutions such as those offered by synology. pfSense is a firewall with some options for IDS and UTM, but it probably will never be a download station.
  • R

    Pfblocker report

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • C

    Zabbix_proxy in version 2.0.x

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    D
    It was updated.
  • V

    HELP! Cant get transparent proxy to work.

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    marcellocM
    What squid version are you using?
  • R

    Does Stunnel work on pfSense 2.0.2?

    Locked
    3
    0 Votes
    3 Posts
    1k Views
    R
    Thanks Wupsje. Assuming it didn't work we uninstalled it and have gone for a different system. The biggest problem I found was the lack of documentation.
  • C

    Snort RuleSet Definition

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    C
    click on the rules tab.. you should see all the rules under each category
  • P

    How to manually restart Mod_Security+Apache+Proxy?

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    P
    I went through the backup and restore process, but there was nothing to clean up in the XML file. Everything had a matching opening/closing tag. Any new reverse proxy entries that I add, through the GUI, show up in the XML file, but the GUI stop and restart commands don't work. To restart the proxy service, I still have to reboot the server, so I go back to my original question (until I can investigate a different reverse-proxy pkg). From the command line, how can I stop and then start the Mod_Security+Apache+Proxy package, so that I don't have to reboot the firewall? Anyboday know where the scripts are for this pkg? TIA Paul
  • A

    OpenBGPD flaps [SOLVED]

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    A
    Ok, so I solved it with some assistance from the local "Senior Network Ninjas" and google! Solution: Assign an interface to your GRE tunnel, Interfaces -> Assign -> Add new, choose your GRE in dropdown Enable the interface but keep type as "none" Add a floating rule allowing anything in both directions (probably tweakeable), enable quick, and set state type to "none" That's it!
  • D

    Possible Problem with Squidguard Schedules causing Kernel Panic.

    Locked
    8
    0 Votes
    8 Posts
    2k Views
    jimpJ
    Possibly, if it's that easy to reproduce only with powerd enabled, it may be worth checking on a BIOS update to see if the manufacturer fixed and power management issues. If the fix is as easy as disabling powerd, at least you can stabilize it.
  • R

    Using Stunnel for SQL encrypted external connections

    Locked
    6
    0 Votes
    6 Posts
    2k Views
    R
    Ah, I searched for SSL in the packages so didn't see it. I don't care what I use as long as it works TBH
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.