pfSense Packages

Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

Subcategories

Cache/Proxy

Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

3.7k
Topics

20.6k
Posts

N

@all, I'm not crazy - other people have this happening, too.

Any thoughts on this, because it's making troubleshooting reverse proxy problems quite difficult.
IDS/IPS

Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

2.2k
Topics

15.7k
Posts

M

@slu said in ETA on Suricata 7.0.8?:

The point is, this packages are listet under Features and you "can't know" its maintained by volunteers:

There are quite a few posts here on the forum (some from me) highlighting that exact problem. I hope the marketing on the site gets cleared up one day !
Traffic Monitoring

Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

556
Topics

2.7k
Posts

K

@dennypage Nice detective work!

Here's hoping that you can find the time to "modernize" the package so it becomes proper usable again. Not a critical package, but rather nice to have in smaller in L2 setups.
pfBlockerNG

Discussions about the pfBlockerNG package

2.6k
Topics

19.3k
Posts

D

I recently added the ISC_Miner list and looks like it may be dead too.
UPS Tools

Discussions about Network UPS Tools and APCUPSD packages for pfSense

89
Topics

2.3k
Posts

Z

@dennypage I will go for your suggested solution:

UPS 1: pfSense as NUT server and the rest as NUT clients
UPS 2: one system attached to the UPS as the NUT server and the others as NUT clients

Since I don't have enough knowledge of NUT I guess I will be back several time to this forum.
Thanks for you gudelines and Merry Christmas !!!
ACME

Discussions about the ACME / Let’s Encrypt package for pfSense

480
Topics

2.7k
Posts

G

@stephenw10

Had my first renewal attempt (<30 days remaining) since upgrading to 24.11.

Using cloudflare dns w/token api for TXT record validation. In the cloudflare dash, under user api tokens, the token used by pfsense/acme has "CLIENT IP ADDRESS FILTERING" enabled. Effectively only certain ip's are valid for this token.

The attempt failed because only the ipv4 is whitelisted. Pfsense acme made the connection to api.cloudflare.com using ipv6.

Running curl within the pf shell shows the following. It appears to prefer ipv6 over ipv4 by default. I'm not sure if this is a change in curl behavior or acme, or the setting below (prefer ipv4) is not being applied.

In pf, under System/Advanced/Networking, Prefer IPv4 over IPv6 is checked. Is acme not validating this setting?

For now as a workaround i've whitelisted the ipv6 prefix. However my ip's are semi static and do change periodically. Normally just update the new ip in several places that need updating when that happens.
curl -v https://api.cloudflare.com * Host api.cloudflare.com:443 was resolved. * IPv6: 2606:4700:300a::6813:c0af, 2606:4700:300a::6813:c0ae, 2606:4700:300a::6813:c11d, 2606:4700:300a::6813:c0b0, 2606:4700:300a::6813:c01d, 2606:4700:300a::6813:c0b1 * IPv4: 104.19.192.177, 104.19.192.176, 104.19.193.29, 104.19.192.175, 104.19.192.29, 104.19.192.174 * Trying [2606:4700:300a::6813:c0af]:443...
EDIT

I could just add "-4" to line 1878 of https://github.com/pfsense/FreeBSD-ports/blob/devel/security/pfSense-pkg-acme/files/usr/local/pkg/acme/acme.sh .

This would be the less elegant solution. Thinking more about this, it's possible previous acme/24.03 didn't encounter this issue because of the way dns presented the ip's and the ipv4 was chosen first.

Should prefer ipv4 apply to acme?
FRR

Discussions about the FRR Dynamic Routing package on pfSense

281
Topics

1.1k
Posts

P

I am attempting to replace a VyOS device with pfSense version 2.7.2 for a branch location.

Below is the current VyOS configuration for the branch device.
interfaces { ethernet eth0 { address 192.168.178.205/30 description MPLS hw-id 00:90:27:e6:23:78 offload { gro gso sg tso } } ethernet eth1 { address 10.168.120.130/29 description ILL hw-id 00:90:27:e6:23:79 offload { gro gso sg tso } } ethernet eth2 { address 10.168.100.146/28 description LAN hw-id 00:90:27:e6:23:7a offload { gro gso sg tso } } ethernet eth3 { address 172.16.32.1/24 duplex auto hw-id 00:90:27:e6:23:7b offload { gro gso sg tso } speed auto } loopback lo { } wireguard wg100 { address 172.17.0.2/30 description Towards_MPLS peer to-wg_peer { address 10.60.81.131 allowed-ips 0.0.0.0/0 persistent-keepalive 2 port 50000 public-key eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee } private-key yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy } wireguard wg500 { address 172.19.0.2/30 description Towards_ILL peer to-wg_peer { address 1xx.124.117.yyyy allowed-ips 0.0.0.0/0 persistent-keepalive 2 port 55000 public-key xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx } private-key yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy } } policy { prefix-list Extended_LAN { rule 10 { action permit prefix 10.168.110.0/24 } rule 20 { action permit prefix 10.168.100.0/25 } rule 30 { action permit prefix 10.168.111.0/24 } } route-map Extended_LAN { rule 10 { action permit match { ip { address { prefix-list Extended_LAN } } } } } } protocols { ospf { area 0 { network 172.17.0.0/30 network 172.19.0.0/30 network 10.168.110.0/23 network 10.168.100.0/24 network 10.168.111.0/24 } interface wg100 { bfd { } cost 10 } interface wg500 { bfd { } cost 30 } redistribute { static { route-map Extended_LAN } } } static { route 0.0.0.0/0 { next-hop 10.168.120.129 { distance 210 } } route 10.9.99.96/27 { next-hop 192.168.178.206 { } } route 10.60.81.128/26 { next-hop 192.168.178.206 { } } route 10.168.6.0/24 { next-hop 192.168.178.206 { } } route 10.168.100.0/25 { next-hop 10.168.100.145 { } } route 10.168.110.0/24 { next-hop 10.168.100.145 { } } route 10.168.111.0/24 { next-hop 10.168.100.145 { } } route 192.168.36.0/24 { next-hop 192.168.178.206 { } } route 192.168.64.0/24 { next-hop 192.168.178.206 { } } route 192.168.71.0/24 { next-hop 192.168.178.206 { } } route 192.168.73.0/24 { next-hop 192.168.178.206 { } } route 192.168.75.0/24 { next-hop 192.168.178.206 { } } route 192.168.81.0/24 { next-hop 192.168.178.206 { } } route 192.168.151.0/24 { next-hop 192.168.178.206 { } } route 192.168.153.0/24 { next-hop 192.168.178.206 { } } route 192.168.154.0/24 { next-hop 192.168.178.206 { } } route 192.168.161.0/24 { next-hop 192.168.178.206 { } } route 192.168.162.0/24 { next-hop 192.168.178.206 { } } route 192.168.163.0/24 { next-hop 192.168.178.206 { } } route 192.168.177.0/24 { next-hop 192.168.178.206 { } } route 192.168.179.0/24 { next-hop 192.168.178.206 { } } } }
My current frr.conf look like below
##################### DO NOT EDIT THIS FILE! ###################### ################################################################### # This file was created by an automatic configuration generator. # # The contents of this file will be overwritten without warning! # ################################################################### ! frr defaults traditional hostname AU99K7D8WSTK.aucbakola.local password AK0L@urb@N service integrated-vtysh-config service password-encryption ! ip router-id ! interface tun_wg1 description "ospfd: WG500_ILL" ip ospf network point-to-point ip ospf cost 30 ip ospf bfd ip ospf mtu-ignore ip ospf area interface tun_wg0 description "ospfd: WG100_MPLS" ip ospf network point-to-point ip ospf cost 10 ip ospf bfd ip ospf mtu-ignore ip ospf area ! router ospf ospf router-id redistribute static route-map Extended_LAN timers throttle spf 200 1000 10000 passive-interface tun_wg1 passive-interface tun_wg0 network 172.17.0.0/30 area 0.0.0.0 network 172.19.0.0/30 area 0.0.0.0 network 10.168.110.0/24 area 0.0.0.0 network 10.168.100.0/24 area 0.0.0.0 network 10.168.111.0/24 area 0.0.0.0 ! ip prefix-list Extended_LAN 10.168.110.0/24 10 permit ip prefix-list Extended_LAN 10.168.100.0/25 20 permit ip prefix-list Extended_LAN 10.168.100.0/25 30 permit ! route-map Extended_LAN permit 10 match ip address prefix-list Extended_LAN ! bfd ! line vty !
If I remove the ip ospf area 0.0.0.0 setting from the interface configuration, the connection works, but I still encounter some challenges. The main issue is that OSPF Network is now deprecated, and we cannot rely on manual configurations in frr.conf because they often get overwritten.

Additionally, the ip prefix-list Extended_LAN 10.168.110.0/24 10 permit configuration is sometimes overwritten.

Another challenge is that I am at the spoke/branch location and do not have access to the hub location device. It seems that pfSense relies heavily on GUI-based configuration.

Could you please suggest the exact configuration steps I need to follow to successfully connect the branch device to the network without requiring manual intervention? Thank you.

Below are current config in GUI.

sa.1.jpg sa.2.jpg sa.3.jpg
Tailscale

Discussions about the Tailscale package

77
Topics

433
Posts

M

Unfortunaetly I don't have much to add in a solution, but I seem to be in the same boat as you are. This only seems to happen on pfSense+ from what I can tell though. Have 3 boxes on CE and those work great with the NAT rule, but I can't seem to have anything behind the plus box route through the tailnet. Hopefully someone has some info no this.
WireGuard

Discussions about WireGuard

643
Topics

3.4k
Posts

P

@poldus
My "thinking" of this PROBLEM are
all KEYS (publics, privates and preshareds) are OK (because of handshaking OK) in both peers (Android, Windows)
2.. what else? rules? "default 51820 port (not working too)
WireGuard is so "experimental" to me? so experimental that UNUSED from me?

J

System Patches Package v2.2.20_1 / v2.2.11_17

• • jimp

8

12
Votes

8
Posts

397
Views

J

I edited the original post to reflect that I pushed out a 2.2.20_1 for 24.11.
1

DNS Broken for pkg.pfsense.org

• • 10101000

3

0
Votes

3
Posts

12.2k
Views

J

https://forum.netgate.com/topic/115789/pkg-pfsense-org-appears-to-be-dead/2
R

Packages wishlist?

• • rds_correia

661

0
Votes

661
Posts

1.2m
Views

O

PRTG
T

Suricata fails install

• • TravisH

9

0
Votes

9
Posts

120
Views

B

@TravisH said in Suricata fails install:

@bmeeks That gave me the same errors, I might try a fresh install just to see if it has something else going on.

Cheers

I don't have any other suggestions, then. Those error messages appear to definitely originate from the pkg utility itself as it is creating the directories and copying the Suricata install files to the correct locations. The Suricata package is not even "alive" at that point (since it is in the process of being installed by the pkg utility).

Have you monkeyed with any user permissions on the firewall?

Can you remove and then successfully reinstall another package? What about trying to reinstall Snort again?

What kind of hardware do you have? Is it something with an eMMC disk? Perhaps it has gone into "read only" mode ???
L

cron package lead to boot issue

• • luxopok

2

0
Votes

2
Posts

44
Views

G

@luxopok said in cron package lead to boot issue:

and tried to implement a cronjob via the cron package

Still console access ?
Not afraid of using vi ?

If you answered yes and no, access console, use option 8.
The 'viconfig' and search for the <cron> section.

It should (start) look like this (up until the closing </cron>:
<cron> <item> <minute>*/1</minute> <hour>*</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command>/usr/sbin/newsyslog</command> </item> <item> <minute>1</minute> <hour>3</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command>/etc/rc.periodic daily</command> </item> <item> <minute>15</minute> <hour>4</hour> <mday>*</mday> <month>*</month> <wday>6</wday> <who>root</who> <command>/etc/rc.periodic weekly</command> </item> <item> <minute>30</minute> <hour>5</hour> <mday>1</mday> <month>*</month> <wday>*</wday> <who>root</who> <command>/etc/rc.periodic monthly</command> </item> <item> <minute>1,31</minute> <hour>0-5</hour> <mday>*</mday> <month>*</month> .....
Find the one(s) you've added, and delete their de entire
<item> ...... </item>
now save, and boot again.

Btw : I'm using the con package for many years now.
I guess some error checking is done when you enter one yourself, but something has failed for you for sure.
E

haproxy does not start when pfsense start

• • ewok2

1

0
Votes

1
Posts

318
Views

No one has replied
J

Avahi reflection filtering

• • JonH

3

0
Votes

3
Posts

84
Views

J

@dennypage said in Avahi reflection filtering:

You are conflating local services and service reflection between interfaces. They are unrelated.

Thank you, I'll remove those entries.
R

How to update to the latest Telegraf version

• • rocket

4

0
Votes

4
Posts

207
Views

R

Updated Dec 30-2024

pfsense 24.11 - Telegraf freebsd-15 
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/telegraf-1.33.0.pkg

pfsense 2.7.2 - Telegraf freebsd-14 
pkg add -f https://pkg.freebsd.org/FreeBSD:14:amd64/latest/All/telegraf-1.33.0.pkg
T

Telegraf service keeps stopping

• • Target-Bravo

4

0
Votes

4
Posts

212
Views

C

@Target-Bravo How did you enable debugging on this plugin?
C

HAProxy - Include subdirectories in the HTTP Redirect

• • ColdBrew

9

0
Votes

9
Posts

125
Views

V

@ColdBrew
Check the log on the backend server, to see, what HAproxy requests exactly.
As mentioned above, HArproxy uses the IP and port, you've stated in the backend config.
And I guess, if you use this IP an port and append the subdirectory (e.g. http://10.65.10.5:3454/subdir) you get nothing from the backend device as well.
L

Avahi Crash on pfSense 2.7.2

• • LukeT

5

0
Votes

5
Posts

128
Views

S

Hmm, not familiar. Backtrace:
db:0:kdb.enter.default> bt Tracing pid 87885 tid 100340 td 0xfffffe006a4e7ac0 kdb_enter() at kdb_enter+0x32/frame 0xfffffe0063881830 vpanic() at vpanic+0x163/frame 0xfffffe0063881960 panic() at panic+0x43/frame 0xfffffe00638819c0 trap_fatal() at trap_fatal+0x40c/frame 0xfffffe0063881a20 calltrap() at calltrap+0x8/frame 0xfffffe0063881a20 --- trap 0x9, rip = 0xffffffff80ee0935, rsp = 0xfffffe0063881af0, rbp = 0xfffffe0063881ba0 --- in_joingroup_locked() at in_joingroup_locked+0x335/frame 0xfffffe0063881ba0 inp_setmoptions() at inp_setmoptions+0x11c6/frame 0xfffffe0063881d30 sosetopt() at sosetopt+0xb4/frame 0xfffffe0063881d80 kern_setsockopt() at kern_setsockopt+0xa5/frame 0xfffffe0063881de0 sys_setsockopt() at sys_setsockopt+0x24/frame 0xfffffe0063881e00 amd64_syscall() at amd64_syscall+0x109/frame 0xfffffe0063881f30 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0063881f30 --- syscall (105, FreeBSD ELF64, setsockopt), rip = 0x82687dd0a, rsp = 0x8203704f8, rbp = 0x820370550 ---
Panic:
<6>vlan0: changing name to 'ixv0.7' <6>ixv0: link state changed to DOWN <6>ixv0: link state changed to UP arprequest_internal: cannot find matching address Fatal trap 9: general protection fault while in kernel mode cpuid = 6; apic id = 06 instruction pointer = 0x20:0xffffffff80ee0935 stack pointer = 0x28:0xfffffe0063881af0 frame pointer = 0x28:0xfffffe0063881ba0 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 87885 (avahi-daemon) rdi: fffff80003c2c480 rsi: 0000000000000000 rdx: 00000000000000a0 rcx: 0000000000000020 r8: 0000000000000000 r9: 00000000000000f8 rax: 14d81dff33337b20 rbx: fffffe006a4e7ac0 rbp: fffffe0063881ba0 r10: 0000000000000000 r11: fffffe006a4e7fe0 r12: 0000000000000000 r13: fffffe0063881c04 r14: fffff800797d9800 r15: fffff80003c2c400 trap number = 9 panic: general protection fault cpuid = 6 time = 1734052404 KDB: enter: panic
It's interesting that it seems to re-create the interface after boot. Did you resave something there?

I'd have to guess it's some hardware off-loading in the ixv driver causing problem there when it tried to jpin the multicast group.
What hardware offloading is shown as capable or enabled by ifconfig -m ixv0 or for ifconfig -m ixv0.7?
D

Email Reports WebGUI crashes when trying to edit the reports

• • Darkk

12

0
Votes

12
Posts

242
Views

D

@marcosm said in Email Reports WebGUI crashes when trying to edit the reports:

@Darkk You'll need to add and apply the diff yourself - it's not included.

I've applied the patch and it's working perfectly now.

Thank you!
S

WAF for pfSense/pfSense+ - eg. Coraza WAF via haproxy SPOE?

• • sandie

1

0
Votes

1
Posts

141
Views

No one has replied
N

Packages 24.11 Issue

• • NogBadTheBad

5

0
Votes

5
Posts

167
Views

M

@jimp said in Packages 24.11 Issue:

Plus 24.11 should be good now, the others are still rebuilding and will be fixed shortly.

Confirmed, thanks Jimp, 24.11 fixed already.
J

Vhosts

• • JonathanLee

1

0
Votes

1
Posts

59
Views

No one has replied
A

Freeradius with PIN+OTP plus group membership in AD

• • aldomoro

1

0
Votes

1
Posts

47
Views

No one has replied
J

PIMD Invalid Interfaces?

• • jeffscott

3

1
Votes

3
Posts

114
Views

J

I've been able to confirm...

If the interface does not show in the PIMD Virtual Interface Table on the Status Tab, it gives the "Invalid phyint address" error in the logs. Sooo....

It appears that there is some limit that is preventing PIMD from seeing all the interfaces. The closest information I found is related to Linux and the limit is defined in the kernel...

I'm guessing even though I've been able to reverse my settings and avoid the errors in the logs, that any interfaces not shown in the Table are just ignored and are not participating in IGMP :-(
J

Squid Proxy Server Automatically Disables

• • jucelio_rosa

1

0
Votes

1
Posts

61
Views

No one has replied
1

Arpwatch reports bogons frequently

• • 1OF1000Quadrillion

19

0
Votes

19
Posts

7.1k
Views

J

another optoin to avoid 0.0.0.0 &169.254.0.0 spam is to igmore the mac-addr's
from arpwatch>settings, click the +Add button at the bottom
add any mac you don't want alerts for
F

Suricata Permit QUIC

suricata quic • • focaccio

6

0
Votes

6
Posts

199
Views

B

That alert is coming from the built-in QUIC-events rules that ship with the Suricata binary.

The events rules are simply informational in nature and don't indicate any malware or other compromise. I suggest disabling that rule or else using the "suppress by SID" feature on the ALERTS tab to prevent the alert the resulting block of a host.

1 / 462