Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    D
    Retested on 24.11-RELEASE (amd64) all seems to work. So it seems right to file a bug for this issue.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    cyb3rtr0nianC
    @rlrobs Yes it’s still working fine here.
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K
    @pulsartiger The database name is vnstat.db and its location is under /var/db/vnstat. With "Backup Files/Dir" we are able to do backup or also with a cron.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    R
    hey forum. maybe someone can help me with pfBlocker. I have this nice overview on pfsense mainpage but it logs nothing. [image: 1754330105763-overview.png] I found a related thread that never got resolved however https://forum.netgate.com/topic/175045/pfblockerng-not-logging-everything Is this normal behaviour? I am using the default out of the box settings here. When doing a nslookup of a blocked domain I seem to be getting the correct response. nslookup c.bing.com Server: 127.0.0.53 Address: 127.0.0.53#53 Non-authoritative answer: Name: c.bing.com Address: 10.10.10.1 But I don't see anything logged in the main tab. Do I need to change something in this setting here: Global Logging/Blocking Mode By default it is set to "No Global Mode" [image: 1754330032261-stats.png] Under alerts I see my nslookups but it only shows "unknown" and not the actual website. I also expect more than just this to show up here when browsing the web. What do i need to change to get this to resolve properly? I have searched already and couldn't find a good answer. I am using Unbound btw. and this under general setup: [image: 1754330288353-dns-settings.png]
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG
    @EChondo What's your pfSense version ? The instructions are shown here : [image: 1753262126227-1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png] A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate. @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy: I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess. No need to wait x days. You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.
  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    J
    @div444 i'm finding the same - did you find a solution or did reverting fix it? Hoping there is a patch fix or something to get it working! Rather not rollback if i can avoid it
  • Discussions about the Tailscale package

    90 Topics
    582 Posts
    dennypageD
    @Gertjan said in can I install a FreeBSD 14 pkg on a FreeBSD 15 pfSense?: If the package contains binaries : forget it. The ABI is different. It's not a hard and fast rule like that. It depends upon what the binary is, what dependencies it has, and how everything was compiled. I am currently running a binary package, which was built on FreeBSD 14.2-RELEASE, on pfSense 25.07 (FreeBSD 15.0-CURRENT) without issue.
  • Discussions about WireGuard

    692 Topics
    4k Posts
    F
    Hi again, to be honest: I guess, I did not remember exactly what I did 2 years ago. May I was mistaken by the interface name opt2 because the SG-3100 has a physical port OPT1 and I mixed up physical and virtual names. The goal was to use 2 different tunnels, one for the mobile clients and one for the site-2-site connection. And now all is running in that way . Regards
  • How filter youtube.com on pfsense using squadgard and rules firewall

    9
    0 Votes
    9 Posts
    729 Views
    stephenw10S
    If you already have Squid and Squidguard installed you just need to set Times for that time slot and apply them to the Group ACLs. Steve
  • FreeRadius CA Validation Broken 2.4.5

    26
    0 Votes
    26 Posts
    3k Views
    S
    @jimp thanks for the fix. It works now.
  • FreeRadius 0.15.6 CA Validation Broken on pfSense 2.4.4

    3
    0 Votes
    3 Posts
    474 Views
    T
    Fixed in 0.15.7. https://redmine.pfsense.org/issues/9082 Thanks @jimp for addressing this issue so quickly.
  • Looking For A Monitoring API or Service

    2
    0 Votes
    2 Posts
    416 Views
    C
    Collectd can gather your interface stats and output to several different types of storage, you could script against that. For pf blocking stats i honestly don't know there are probably some, you could manually poll from a script using pfctl but there could well be a service that works better.
  • OpenVPN - Client Export for Yealink Phone - Not Working

    4
    0 Votes
    4 Posts
    2k Views
    F
    @jimp said in OpenVPN - Client Export for Yealink Phone - Not Working: e they have fixed that in a recent update, though. Thank you very much for you reply. Finally got it to work. SHA1 and TLS Encryption ON is crucial. Otherwise it wont work according to my testing. Also i had to edit the configuration file manually: the line ncp disable had to be commented out (not supported by yealink phones) Maybe this could be fixed in the export for yealink phones...
  • 0 Votes
    34 Posts
    5k Views
    S
    Thanks for all the help pointing me in the right direction. I'll keep my list at 10 years for now.
  • install zabbix server in pfsense

    2
    0 Votes
    2 Posts
    458 Views
    jimpJ
    You cannot install the server or frontend on pfSense. Only the agent and proxy packages are available.
  • Packages not starting after config restore on pfSense 2.4.4

    6
    0 Votes
    6 Posts
    1k Views
    A
    Thanks for the prompt reply. One of the first things that I noticed didn't resolve was the repository. No packages were available, and the Status page couldn't check for updates. Since I was restoring a config from a backup, that's why I thought this might help.
  • BIND Package

    17
    0 Votes
    17 Posts
    3k Views
    johnpozJ
    Out of the box access list are going to be auto - but you might need to add that for your vpn tunnel network sure. query name min is when you are walking down from roots and vs asking for www.domain.tld you only ask roots for tld, he says oh .com go ask the ns for .com, you then go ask .com ns hey whats ns for domain.tld.. Only when you get to the actual authoritative NS do you ask for the full record. Keep in mind this can cause issues with some domains and cnames, etc.. There are some threads here where testing that and believe technet and stuff from ms one of the domains that wouldn't resolve.. How is it you couldn't look up the RFC that is clearly listed in the notes about that setting "Only send minimum required labels of the QNAME and set QTYPE to A when possible. Best effort approach; full QNAME and original QTYPE will be sent when upstream replies with a RCODE other than NOERROR, except when receiving NXDOMAIN from a DNSSEC signed zone. Default is off. Refer to RFC 7816 for in-depth information on Query Name Minimization." You really have little use in the advanced section until you know what your doing ;) And are wanting to do something a bit out of the box. Quick look there and one thing you might want to enable is "Serve cache records even with TTL of 0" Prob give you better cache hits. Your hide options are exactly that - they will NOT answer those sorts of queries.. Unless you were going to let the public query it there is no reason to enable those... Unless you think someone on your own local network or connected to your vpn is going to query your unbound for its version info and then from that HACK it ;)
  • APCUPSD package

    1
    1 Votes
    1 Posts
    403 Views
    No one has replied
  • tinc: Establishing a gateway to tinc network

    1
    1 Votes
    1 Posts
    459 Views
    No one has replied
  • Unable to Update 2.4.3 packages

    3
    0 Votes
    3 Posts
    485 Views
    A
    @grimson guess we have to plan earlier than expected. thank you!
  • Bind manual configuration...

    5
    0 Votes
    5 Posts
    825 Views
    GertjanG
    @johnpoz said in Bind manual configuration...: Read this http://shop.oreilly.com/product/9780596100575.do It will change your life.. I confirm. Live did become easier when one knows what DNS is (and not what one thinks it is). I have an old edition and will order the new one.
  • watchdog schedule

    6
    0 Votes
    6 Posts
    734 Views
    C
    oh yes it was because watchdog was empty as i have removed the vpn from. Sorted thank you
  • haproxy not starting

    9
    0 Votes
    9 Posts
    2k Views
    S
    same behavior for me, 2.4.4 on SG-1000. Although I have one lua-file in HAproxy, for doing the LetsEncrypt-Challenge. EDIT: solved by uninstalling and reinstalling the 2 packages, and re-adding the lua-script.
  • Tinc 1.0.35 security release.

    3
    0 Votes
    3 Posts
    463 Views
    M
    Yep. Thanks Jim.I appreciate the good work that goes into keeping pfSense current.
  • Squid Reverse proxy works inconsistently

    1
    0 Votes
    1 Posts
    264 Views
    No one has replied
  • Monitoring bandwidth by month on a system using an SSD Drive

    4
    0 Votes
    4 Posts
    705 Views
    B
    I don't think that is much of an issue with modern SSD drives. Disk writes like these were problematic with unmanaged flash memory like CF-Cards and USB sticks, but it should be safe to treat an SSD like any other disk. If you installed using ZFS, I believe TRIM should already be active.
  • Zabbix agent broken on 2.4.4? PHP error

    32
    0 Votes
    32 Posts
    4k Views
    J
    @jimp said in Zabbix agent broken on 2.4.4? PHP error: As has been covered in numerous threads all over the forum, you can't install new packages on 2.4.3 because it will break the system as it's trying to pull things in from the 2.4.4 upgrade repo. Ok, noted. Thanks.
  • Offline Package Management?

    4
    0 Votes
    4 Posts
    4k Views
    jimpJ
    The forum conversion apparently mangled the syntax above. In this case, you'd just put haproxy there, so pkg install pfsense-pkg-haproxy. But pkg add works for local files as well.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.