Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    A
    I found what is adding these directives to the config file! The behavior is hard-coded in /usr/local/pkg/haproxy/haproxy.inc which is what generates /var/etc/haproxy/haproxy.cfg Line 727 function write_backend($configpath, $fd, $name, $pool, $backendsettings) { ... Line 1006 (always executes, not subject to any conditional statements) fwrite ($fd, "\tload-server-state-from-file\tglobal\n"); Line 1520 function haproxy_writeconf($configpath) { ... Line 1612 (always executes, not subject to any conditional statements) fwrite ($fd, "\tserver-state-file /tmp/haproxy_server_state\n"); Line 2498 function haproxy_check_run($reload) { ... Lines 2507-2508 (executes if haproxy is running when a reload is requested, which is almost always true) if ($reload) { if (haproxy_is_running()) { $r = haproxy_socket_command("show servers state"); file_put_contents("/tmp/haproxy_server_state", $r); } These lines result in the following behavior: Whenever HAProxy's settings are saved using the GUI, the server-state-file directive is added to the global section of the resulting config file. Whenever HAProxy's settings are saved using the GUI, the load-server-state-from-file directive is added to each backend of the resulting config file. Whenever HAProxy reloads, it writes the backend server state to /tmp/haproxy_server_state, and due to the server-state-file directive, it then always reads and applies the previous state data. There is no GUI text that mentions that this behavior is hard-coded, and there is no way to disabled it other than commenting out the lines (1006, 1612, 2507, 2508) in haproxy.inc that are responsible for adding the directives to the config file. The GUI option Reload behaviour is responsible for the directive hard_stop_after which is for a different behavior. I've added these findings to the redmine.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB
    @NRgia said in Suricata on Pfsense: @bmeeks Thank you for what you did for Snort or Suricata. I'm not sure what you want me to do on Redmine, due to is a bug tracker. My question is for Product Management, which I will ask it here to be public: What is the plan for these 2 packages, Suricata and Snort? Thank you Yes, Redmine is for both bug reports and feature requests. Asking for the Suricata binary to be updated to the latest 7.0.11 version from upstream is a legitimate Redmine request. I would suggest simply asking for the binary version update instead of asking about future Netgate strategy (such as the support plans for the packages). Strategy discussions typically don't get very far because they deal with proprietary information or plans that a company may not want to publicly discuss. Redmine is where the Netgate developer team tracks all the code changes they make for pfSense. They will see Redmine reports much quicker than a forum post.
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K
    @pulsartiger The database name is vnstat.db and its location is under /var/db/vnstat. With "Backup Files/Dir" we are able to do backup or also with a cron.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    GertjanG
    @rasputinthegreatest said in pfBlockerNG not logging anything by default?: its made up of multiple sources so it does make sense that it resolves some of these weird private hosts An public NTP pool like pool.ntp.org would not list host names with weird random paddings that reference local devices. "domaincontroller-gPHvwjYS.local,192.168.1.86" is a reverse PTR, and is requested by one of your local devices. Why , I don't know. @rasputinthegreatest said in pfBlockerNG not logging anything by default?: I find them in pfblockerNG dns_reply log under Logs No URLs there, only host names. [image: 1754736735409-c09607c2-c95a-4971-bdb4-f63fe08bebe8-image.png]
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG
    @EChondo What's your pfSense version ? The instructions are shown here : [image: 1753262126227-1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png] A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate. @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy: I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess. No need to wait x days. You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.
  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1
  • Discussions about the Tailscale package

    90 Topics
    594 Posts
    E
    @totalimpact Tailscale 1.54.0 is 2+ years out of date. Tailscale has made quite a number of changes since Tailscale 1.54.0, likely rendering it incompatible with their servers. I would consider manually updating the Tailscale FreeBSD package. FreshPorts does not maintain an archive of all the releases, only the latest compiled by the volunteer maintainers. The key to manually upgrading is knowing which FreeBSD version your pfSense release is running, i.e. 14 or 15. You can following along here.
  • Discussions about WireGuard

    692 Topics
    4k Posts
    M
    This is still an issue as of 2.8.0 / 25.07, and it drives me crazy. Gateway failure works as expected, the wireguard tunnels will fail over to the backup gateway and continue on as normal, but will never recover once the failed gateway comes back online. While a reboot will (usually) fix it, I usually just go into my routing settings and mark the secondary gateway as down, forcing it to revert back to the primary... the users tend to dislike it when I reboot the firewall in the middle of the day
  • Proxy only for por 80

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    X
    hello jose, i'm not a portugeese.. :) since mhab tell me bout the link, i followed that and its solved my probs. yes, i'll follow ur suggestion :) thanks for that…
  • Snort crashed and won't restart correctly

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    J
    There's a problem with the snort package (or maybe the web configurator?). Sometimes it does not put the full startup command in the snort startup config (/usr/local/etc/rc.d/snort.sh). If you look in that config, it should point to the snort binary, but sometimes after you make a configuration change that entry gets removed. I've also noticed that the web configurator's service page often does not show the correct status for whether snort is running (or not). The only way to know for sure is to login via ssh and look at the "top" status, or type "ps auxw | grep snort" to see if the process is running. Also… some of the rulesets do not work at all (snort will not startup). Additionally, if you run too many rules, snort will not start. It takes a bit of work to get the snort package to work reliably on pfsense.
  • ASSP

    Locked
    5
    0 Votes
    5 Posts
    4k Views
    ?
    No one should be running pfSense 1.2-RCs anymore.  If this package only works in an RC and not the final release, then that's a problem.
  • Openbgpd - bgpd.sock missing

    Locked
    3
    0 Votes
    3 Posts
    6k Views
    D
    search is your friend… http://forum.pfsense.org/index.php/topic,6628.0.html
  • 1 WAN, 2 LAN, cache on WAN?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S
    at the moment i am using squid and lightsquid, as caching is one of the main reasons i chose pfsense over m0n0wall. if its not possible to cache a 2nd lan interface (by any method, trying to bind to WAN was just an experiment) its not a huge loss, but it would be useful
  • Squid starts many ' pinger ' processes

    Locked
    4
    0 Votes
    4 Posts
    20k Views
    ?
    The proper way to do this would be to notify the package maintainer to fix this.  If you go about fixing this yourself, be sure to pass the patch along to the maintainer as you are right, almost nobody running pfSense needs to use the pinger process.
  • I would love to get my hands on an ettercap package for pfsense

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    C
    Do this on a test system like a vmware version fo pfsense to test out prior to testing on your production box Doing this setup is at your own risk First off I recommend etherape instead of ettercap because the version on the site is ettercap gtk2 which requires X do a uname on your system determine the release version you have 6.2 Release in my case.(using pfsense 1.2 release ) then setup the environment variable to the appropriate version of freebsd. the env is as follows set PKG_PATH=ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ the do pkg_add -v ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ettercap-gtk2-0.7.3_5,1.tbz
  • Configuration of squidguard

    Locked
    13
    0 Votes
    13 Posts
    9k Views
    D
    Edit and store you ACL's.
  • IMspector and WLAN connections.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    J
    No, encryption is done at link layer, imspector dont even know what is happening at link layer, it works at a higher layer. But, prolly the redirection rule used by IMspector is issued only to packets comming from/to the LAN/WAN interfaces. does your WLAN is a WLAN board inside pfSense itself ? Or a AP attached to a switch on Lan port ? (Sorry for bad english)
  • FreeRadius

    Locked
    13
    0 Votes
    13 Posts
    6k Views
    M
    This is my first screenshot… [image: screen.jpg]
  • Block msn (messenger) using squid

    Locked
    6
    0 Votes
    6 Posts
    5k Views
    J
    @submicron: It's hardly simpler.  In fact, your method requires the installation of many packages, some of which are problematic.  This approach is much simpler, requiring a few squid ACLs.  Incidentally, there are a number of posts on the squid support mailing list talking about using squid to filter various IM clients.  They're all very detailed and helpful. Hello “submicron” “submicron”, as a Packages Moderator,  I think I only now have understand your point. The problem, is that I have been blind and stupid till now, and haven’t already seem a so simple ting. You told  “installation of many packages”, and this are the key words! Only now I understood the key word: 5 packages are “many” Pf sense does not support the installation of several (“many”) packages, and I was trying to do that. So, in conclusion, I should not try to install so many packages, and I should install fewer, might one or two in maximum. Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid. It would be nice that we could install a minimum set of packages that could transform PFSense in a true and decent firewall, doing some cache (Squid ) at the same time we had some evidences that the tings were working (Lightsquid ). I thought that I was not trying to install nothing special…. (like Dashboard, LCDproc, Zabbix, Spand nider (even) Snort)) Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid. Regards.
  • Squid crashes frequently need help !!!

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    M
    I have done that, but did not helped. But when i change back the Level 1 subdirectories from 32 back 16 it works…. Bug in in the package ?
  • Release of squid and squidguard Package

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    R
    thank's!!
  • Lightsquid package Test

    Locked
    70
    0 Votes
    70 Posts
    72k Views
    J
    @dvserg: Do yuo click 'full refresh' button on LS gui? Yes I did, I click both Refresh Now and Refresh full to no avail. I have another pfsense deployment yesterday and squid/lightsquid package works just fine, I can't seem to figure out this one though, perhaps a hard drive failure?
  • Confusion on package installation

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    D
    I wrote the quote in Perry's post, based in no small part on my experience as a developer elsewhere (but not in this project). Though I didn't make it clear, the mention about downloading and bootstrapping was thinking of the developer ISO in the context of giving early access to those who are conversant with the internals of pfSense. When you first run the developer ISO after installation, a bootstrap process grabs the latest version of the configured FreeBSD and pfSense CVS branches (or HEAD in the pfSense case; you can't use FreeBSD HEAD nor should you want to) and builds a normal ISO. Whilst you can check out pfSense 1.3, you'll find it almost impossible to build as I don't think there's a publicly available pfSense developer ISO based on FreeBSD 7.0. Upgrading the FreeBSD version in a developer installation is very much non-trivial. I am sure we will see snapshots and, later on, beta builds of 1.3 - but the code needs to be ready for those builds to be released. Giving early access when it isn't ready for public viewing causes the problems mentioned in my quote. Neither pfSense nor FreeBSD works on a timed release schedule - in a similar vein, there is currently no timescale for FreeBSD 7.1. As someone who is very familiar with FreeBSD, though not as familiar with the pfSense internals, I thought I'd try to explain some background that will hopefully help silvermage and others in a similar position. pfSense 1.2.1 is on its way, which is based on FreeBSD 6.3 rather than the 6.2 of pfSense 1.2-RELEASE. The pfSense team have stated that they hope to release 1.2.1 by the end of May 2008, which is the end of life date of FreeBSD 6.2-RELEASE (and the point at which there's no longer any FreeBSD security team support for it). There are a great deal of improvements in FreeBSD 6.3 - including better hardware support together with various enhancements and bug fixes that were suitable for backporting from the active development in the HEAD of FreeBSD CVS. FreeBSD refers to such backports as MFC - Merge From Current (FreeBSD CVS HEAD is referred to as FreeBSD CURRENT). Because FreeBSD 6.3-RELEASE was released so long after 6.2-RELEASE, the 6.3 FreeBSD packages are much more up to date than the 6.2 ones. In fact, the FreeBSD 6.3-RELEASE packages are the same versions as in 7.0-RELEASE because the release cycles of the two OS versions were aligned from a ports/packages point of view. (There were a handful of cases where there were security flaws found in packages between the two OS release dates, so a later version might just have shipped in 7.0-RELEASE in that case). This should help pfSense package developers, as work done on pfSense 1.2.1 should hopefully be easy to port to the FreeBSD 7 based pfSense 1.3. You talked about different Linux distributions (or 'flavours'). There's no such concept with the BSDs - each is a kernel and userland, unlike Linux where Linux is technically only the kernel and it's up to each distribution to come up with a userland. Each approach has strengths and weaknesses - I prefer the FreeBSD approach, but I can see how there are advantages in being able to have an OS distribution that's packaged to suit your intended application. Of course, there is code sharing between the BSDs and even from beyond the BSDs when licences are compatible. OpenBSD's OpenSSH, in its portable guise, is used in almost every free *NIX operating system, incluidng the other BSDs. OpenSolaris's ZFS has been ported to FreeBSD - though it's still an experimental feature in FreeBSD 7.0. There are also derivative distributions - from FreeBSD there's the FreeSBIE Live CD, m0n0wall and pfSense amongst others. There's usually no trickery needed to install software on FreeBSD. If a FreeBSD port is compatible with a particular major OS version, a binary package will be produced for that version. The port itself, in conjunction with the ports framework, deals with the differences between the OS versions. If the source material for a port is only available as a binary for a particular major OS version, it is usually possible to use that binary on a later major OS version using the compatibility features of the OS and the compatibility libraries, so a package is still possible - if so, this is transparent to the user. The port maintainers and ports committers do all this work for the end users - though FreeBSD PRs (problem reports) with feature requests, bug reports and especially patches are always welcome for any issue you have with a FreeBSD port or package. Some Linux binaries can be used on FreeBSD via FreeBSD's Linux emulation. There are some examples amongst the ports and packages of this - usually linux appears in the name of the port or package. As is often said on these forums, FreeBSD is not Linux. Linux shell scripters can get caught out on FreeBSD because bash is not the default shell, /bin/sh is not bash, and bash is not installed unless you install the bash port/package or install bash from source. Similarly, the default make program on FreeBSD is BSD make - if you need GNU make (gmake on FreeBSD), you need to install the gmake port/package or install from source. If you wish to do any pfSense development, it may pay to familiarise yourself with FreeBSD, its documentation and ports/packages system. A FreeBSD port is simply the recipe to create a binary package - though installing from ports often allows you to tune the port to your requirements. I've yet to get into pfSense package development, though I'm going to explore the possibility of an apcupsd package. apcupsd has better support for SNMP managed UPSes than nut - my server rack has such a UPS. I'm grateful for Perry's links - I knew about the devwiki, but the last one is new to me. I wonder if the right way to develop this is to experiment on the version of FreeBSD i386 corresponding to the pfSense version you're developing for, check your work at the shell of a pfSense developer ISO, then start to build the UI and other components required for a pfSense package. That's only a thought from me, however - it's not based on any experience.
  • I need support for APC SNMP in NUT

    Locked
    7
    0 Votes
    7 Posts
    5k Views
    D
    I am still looking into making an apcupsd package for pfSense. Unfortunately I'm very busy at the moment, including with a couple of other tasks in my software development pipeline that really need doing before this one. The FreeBSD side of this holds no fears - I'm used to administering FreeBSD machines, and I'm very familiar with the FreeBSD ports and packages system (I maintain several FreeBSD ports). However, I'm not very familiar with the pfSense package system yet - I need some time to familiarise myself with it. For now, my pfSense machine is running from a LiveCD with the configuration on a USB memory key. A power failure is unlikely to damage such a system, even though there's no way for it to interact with the UPS. At least deploying the new hardware put my production pfSense system on its permanent hardware platform and I could retire the horrid Cyrix 333MHz PC I threw together from junk box parts when the Ethernet switch in my old router failed in December. I want to move pfSense onto the new machine's hard disks so that I can install packages. That is blocking on two things - I need a UPS monitoring solution I'm happy with, also I need to decide if I'm going to install a RAID controller so that I can use two hard disks in RAID 1 for added robustness (as it stands, the machine has two identical hard disks but no RAID controller). I have the pfSense developer ISO running under VMware Workstation 6 on a Windows machine, so I have a platform to experiment on before deploying my eventual solution to my production firewall. I will update this thread if I have anything to share. If I do develop an apcupsd package, it will be contributed to the pfSense project.
  • BandwitdthD - CoreDump after few hours.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    Z
    512MB of DDR ram, 1.7GHz Pent4, 40GB hdd. Running pfSense 1.2, squid and bandwidthD. Serving only 6 or so PC's. I know squid isnt causing the problem as i just installed, as in bandwithd was acting up before installing it. Not that it might not contribute to the problem. Edit: Stats page currently reporting 34% Ram usage. I have another 512MB stick i could use if 512 is not enough.
  • Monitor web based chat and meebo using imspector

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    Cry HavokC
    Hint: Search - this has been discussed before. Short answer: no.
  • Playing with XTRadius

    Locked
    9
    0 Votes
    9 Posts
    5k Views
    J
    i´ll try those tools you mentioned, but, one of my tasks is to make the current accounting software (that accounts most things in the company) compatible with the RADIUS backend (currently they do everything using a small software developed using Delphi, but this software cannot enforce anything upon users, the network owner must manually do everything, from blocking users to creating logins… this sux) so i thought freepascal was a nice way to go, extending the software and porting (actually, just copy and paste) some of its functions to the radius backend running at pfSense... and the current setup (using monowall captive portal user list) cannot even give per user bandwidth... Everyone has the same network speed (bad comercial model). These people wont understand RADIUS reply, RADIUS bla bla bla, this is out of this world for them...
  • Custom Error Page redirect for SquidGuard?

    Locked
    9
    0 Votes
    9 Posts
    15k Views
    M
    [smacks head]duh![/smacks head] Thanks, I had a major brain fart.  We do use a different than 80 port, and of course that fixed it. Thanks for everything (including SG!) -Marty
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.