Subcategories

• Cache/Proxy

  Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

  3.8k
  Topics
  20.6k
  Posts

  J

  Update: Set your SSH on the wpad to only allow access during business hours. This can be done with the PAM

  edit the following file

  /etc/security/time.conf

  add:

  sshd;*;*;AL0500-2300

  Meaning I can only access ssh into my wpad durring 5-2300

  After adapt /etc/ssh/sshd_config

  make sure your listenaddress is the ip of the wpad set your AllowUsers to your login

  Example

  Port 8085 #change port if needed AddressFamily inet #ipv4 only ListenAddress 192.168.1.6 #address of wpad AllowUsers Jonathan@192.168.1.* # any device that is 192.168.1.X

  Change

  PermitRootLogin no #no ssh login for root UsePam yes # turn on pam for use with time restrictions

  after adapt
  /etc/passwd

  for added security also change your login to use the shell rbash and lock down the wad.

  Also if you use ipv6 and ipv4 you will have a race condition and sshd will not start on reboots you must also adapt

  sudo -i systemctl edit --full sshd.service

  under [unit] add

  Requires=network-only.target After=network-only.taget

  This will only start sshd once the network target is running in my example 192.168.1.6 I also have ipv6 running so it would cause issues unless I changed this. If you do not use ipv4 forget about this.

• IDS/IPS

  Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

  2.2k
  Topics
  15.7k
  Posts

  T

  @tchadrack

  Thermal Sensors
  Zone 1: 29.9 °C
  Zone 0: 27.9 °C

  Name ..**
  User admin@192.168..** (Local Database)
  System pfSense
  Netgate Device ID: ******************
  BIOS Vendor: American Megatrends Inc.
  Version: F2
  Release Date: Mon Oct 7 2013
  Version 2.7.2-RELEASE (amd64)
  built on Fri Dec 8 17:55:00 -03 2023
  FreeBSD 14.0-CURRENT

  The system is on the latest version.
  Version information updated at Sat Feb 1 9:35:25 -03 2025
  CPU Type Intel(R) Pentium(R) CPU G3220 @ 3.00GHz
  2 CPUs: 1 package(s) x 2 core(s)
  AES-NI CPU Crypto: No
  QAT Crypto: No
  Hardware crypto Inactive
  Kernel PTI Enabled
  MDS Mitigation Inactive
  Uptime 1 Day 03 Hours 20 Minutes 04 Seconds
  Current date/time
  Sat Feb 1 9:44:46 -03 2025
  DNS server(s)
  8.8.8.8
  8.8.4.4
  Last config change Sat Feb 1 9:05:02 -03 2025
  State table size
  0% (222/1000000) Show states
  MBUF Usage
  5% (18856/371768)
  Temperature
  27.9°C
  Load average
  0.47, 0.48, 0.42
  CPU usage
  4%
  Memory usage
  53% of 5980 MiB
  SWAP usage
  17% of 3851 MiB

  DISKS:
  Mount Used Size Usage
  / 28G 447G
  7% of 447G (ufs)

  SERVICES:
  arpwatch Arpwatch Daemon
  bandwidthd BandwidthD bandwidth monitoring daemon
  captiveportal Captive Portal: **********
  darkstat Darkstat bandwidth monitoring daemon
  dpinger Gateway Monitoring Daemon
  kea-dhcp4 Kea DHCP Server
  ntopng ntopng Network Traffic Monitor
  ntpd NTP clock sync
  openvpn OpenVPN server: *************
  pfb_dnsbl pfBlockerNG DNSBL service
  pfb_filter pfBlockerNG firewall filter service
  radiusd FreeRADIUS Server
  sshd Secure Shell Daemon
  suricata Suricata IDS/IPS Daemon
  syslogd System Logger Daemon
  unbound DNS Resolver
  vnstatd Status Traffic Totals data collection daemon

  S.M.A.R.T. Status
  Drive Ident S.M.A.R.T. Status
  ada0 WD-************ PASSED

• Traffic Monitoring

  Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

  559
  Topics
  2.7k
  Posts

  M

  @periko I agree with you. Most if not all firewalls today provide some ability to peak into what kind of traffic is flowing through your device.

• pfBlockerNG

  Discussions about the pfBlockerNG package

  2.6k
  Topics
  19.4k
  Posts

  P

  Hello,

  I've been trying to find a way to use the same list of IP's in both pfB and snort, so I don't have to maintain two independent whitelists.

  One would think that it would be easy but I couldn't get it to work.

  Snort only allows system-wide aliases (Firewall > Aliases). It doesn't seem capable of retrieving IP's from an URL...

  Using "Alias Native" in pfB allows to use the list in a FW rule but doesn't allow to be used in Snort for the above mentioned reason... (URL)

  I thought creating a system wide alias with the IP's, then create a list in pfB (ipv4) and enter the alias name in the source but pfB wont let me do this.

  Short of treating these two packages as completely independent and maintain two identical whitelists, how can I make them use the same IP list?

• UPS Tools

  Discussions about Network UPS Tools and APCUPSD packages for pfSense

  90
  Topics
  2.3k
  Posts

  G

  @rdibley said in Linefeed in pfSense email notifications (with Network UPS Tools):

  So one more question: if most people don't use the Advanced section (and the users.conf is blank), how does a secondary system connect to the primary? Is it that most people don't define a user/password for monitoring, but that the primary is just open to any secondary system that might want to connect?

  I'm using it 😊

  b852fa0b-7f4c-4461-8c73-3867487db57f-image.png

  The third entry is for my Synology NAS :

  And the NAS side :

  c67da02f-ce7a-456c-a7e1-fede22ed4b6b-image.png

  and done.

  I've also installed "Windows NUT Client" on two PC's nearby.
  Example : PC 1 with user name "pcrecep1" and password "secret1" :

  e41ec81d-1698-431f-98f9-17e142c93132-image.png

  Works fine also.
  So I've 4 devices protected with one big 1000 VA APC UPS, where pfSense is the NUT 'server' as it has a USB cabled UPS hooked up to it, and now 4 devices are controlled by this UPS instead of one.

• ACME

  Discussions about the ACME / Let’s Encrypt package for pfSense

  484
  Topics
  2.7k
  Posts

  I

  @Gertjan Thank you so much for the help. I've removed all of the child nodes of <acme>, reinstalled the package and it completed.

  Thanks again!

• FRR

  Discussions about the FRR Dynamic Routing package on pfSense

  283
  Topics
  1.2k
  Posts

  M

  @michmoor said in FRR 10 coming with script support ?:

  Yep yep that's right. Sorry for confusing issues.

  Np, we need more people engaged in this, FRR is a great software but it is not working smoothly with pfsense IPsec VTIs.

• Tailscale

  Discussions about the Tailscale package

  77
  Topics
  436
  Posts

  E

  @atlmcw

  I had no issues.

• WireGuard

  Discussions about WireGuard

  649
  Topics
  3.4k
  Posts

  D

  Ohhh i forgot the gateway.

  Its working now.

  thank you so much.