Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    D
    Retested on 24.11-RELEASE (amd64) all seems to work. So it seems right to file a bug for this issue.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    S
    So since there is no version 25.03. There is an official 25.07 now but only get a 7.08.2 what happen to the rest up to Suricata 7.0.10 or 7.0.12?
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K
    @pulsartiger The database name is vnstat.db and its location is under /var/db/vnstat. With "Backup Files/Dir" we are able to do backup or also with a cron.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    R
    So far no new entries which is suspect in itself despite using my work computer. Maybe it is now evading discovery?
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG
    @EChondo What's your pfSense version ? The instructions are shown here : [image: 1753262126227-1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png] A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate. @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy: I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess. No need to wait x days. You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.
  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1
  • Discussions about the Tailscale package

    90 Topics
    591 Posts
    TommyMooT
    @veddy254 Thank you, the -f flag fixed it!! $ tailscale version 1.84.2 go version: go1.24.5 Will in future, pay more attention, for no mismatch happens again! Tks
  • Discussions about WireGuard

    692 Topics
    4k Posts
    M
    This is still an issue as of 2.8.0 / 25.07, and it drives me crazy. Gateway failure works as expected, the wireguard tunnels will fail over to the backup gateway and continue on as normal, but will never recover once the failed gateway comes back online. While a reboot will (usually) fix it, I usually just go into my routing settings and mark the secondary gateway as down, forcing it to revert back to the primary... the users tend to dislike it when I reboot the firewall in the middle of the day
  • SquidGuard issue - blocked javascript hangs pages

    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Squid and Dansguardian not working

    23
    0 Votes
    23 Posts
    10k Views
    Q
    Ive managed to work through this thread, with input and learnings from a few others and finally have a working squid / dansguardian setup. Ive found a strange issue in that everything works great for the first ten minutes or so, then web surfing becomes slower before eventually stopping. If I shortcut the localhost chain (NAT 80 -> DG 8080 -> Squid 3128 -> Web) by setting my proxy direct to Squids 3128 port everything resumes as normal. If I restart Dansguardian things return to normal as well so it appears to be some kind of memory leak / cache / buffers filling up type issue. Any ideas? Ive killed squids caching along the route of debugging this matter and that didn't help.
  • Snort Pass List not auto created

    3
    0 Votes
    3 Posts
    1k Views
    bmeeksB
    @propel: I'm new to the Snort configurations, 1st time installing and using it. In snort, ' A Default Pass List ' was not automatically created. Do I actually need to create one then? Usually, in a home network setup, you do not need to create or set any specific Pass List.  The "defaults" that Snort will use if you do not create or set a list are generally sufficient.  It will not block your LAN IP block, or DNS servers, your default gateway nor your WAN IP address.  If you have multiple directly-connected networks (for example, DMZ, multiple LANs, VPNs, etc.), then they will be included as well.  You only need to create a Pass List when you have specific external hosts or networks you don't ever want blocked, or you have some internal hosts that are not on directly-attached networks that you don't want blocked. Bill
  • Https connection getting stuck in squid for random clients

    1
    0 Votes
    1 Posts
    744 Views
    No one has replied
  • Custom SquidGuard error [How-To]

    3
    0 Votes
    3 Posts
    5k Views
    P
    Nevermind, i'm dumb heh. got it working.
  • HAVP proxy blocking an application

    5
    0 Votes
    5 Posts
    1k Views
    A
    It's been a while since I've had to address this issue.  I can resurrect old threads :) Now the pfSense is on version 2.1.4 and I'm still getting the same outbound blocking when I have HAVP enabled. Ideas?
  • New HTTP+HTTPS Proxy / DNS Filter Package

    8
    0 Votes
    8 Posts
    3k Views
    A
    @networkinggeek please submit a support ticket and we'll get you straightened out. @Hollander we are working out some kinks but we intend to be in the main package repo. @rjcrowder & @Hollander We use a cloud based categorization service that has over 500 million urls categorized. We've made it so you can install the package and be filtering https traffic within 5 mins.
  • Snort uses up all memory (12GB) [SOLVED]

    34
    0 Votes
    34 Posts
    14k Views
    S
    Thanks :)
  • Strange SquidGuard problem.

    3
    0 Votes
    3 Posts
    1k Views
    C
    @golmaal: Maybe I haven't understood your problem correctly, but this may help: SquidGuard (and the firewall rules too) works on the basis of first-match. The filtering rules do not cascade. Let us say you have Group ACL X and Group ACL Y (in that order) and then Common ACL. When someone accesses the Internet, SquidGuard tries to first match it with Group ACL X. If the match is positive (i.e. if the IP or the user belongs to Group ACL X), the Group ACL X will apply to it irrespective of your Common ACL and other Group ACL. Once the match is positive, it won't filter it using any other Group ACL or Common ACL. If the first match fails, it will try to  match it to Group ACL Y; if it matches, Group ACL Y will apply to it. If there are no matches, Common ACL will apply. So you need something like this: Group ACL X: Block Porn, Block P2P, Allow All Group ACL Y: Allow All Common ACL: Block All I will try this as soon as I get time to use mess around with it again.. Thanks for the reply.  I will post what I find. DrClaw
  • Separate squid cache drive/partition?

    4
    0 Votes
    4 Posts
    1k Views
    A
    Ok. So, I realized that 40 MB is just a teensey bit small for this kind of thing. I purchased 2 CF-style microdrives with PCMCIA adapters. I'll find a use for the other on someday, but for now, I am using one of the Microdrives (each drive is 2 GB) for the cache.
  • NUT UPS with blazer_usb wont start

    2
    0 Votes
    2 Posts
    1k Views
    W
    Nobody?  :-\
  • Squid Proxy Maximum object size

    4
    0 Votes
    4 Posts
    11k Views
    T
    I don't believe this had a separate topic in the old forum, here is a summary of the steps. The cachemgr.cgi page is a symbolic link to the file in the PBI folder. And external cache manager as your local box in the squid config. You create a symbolic of "cachemgr.cgi" in the /usr/local/www folder. Link that to "/usr/pbi/squid-amd64/libexec/squid/cachemgr.cgi" (or i386 when you installed 32-bit pfsense) Then add your pfsense box ip as a external cache manager in the Proxy server -> local cache ->"External Cache-Managers" (it works for me) Then you should be able to browse to http://pfsense-ip/cachemgr.cgi (login info is the same as the pfsense gui) (or you could need to edit "/usr/pbi/squid-amd64/etc/squid/cachemgr.conf" and change localhost to your pfsense-ip) With https you may need to add the portnumber https://pfsense-ip:666/cachemgr.cgi (whatever port your pfsense https responds to)
  • Darkstat Settings Lost on Upgrade

    3
    0 Votes
    3 Posts
    1k Views
    arrmoA
    Makes sense, thanks!
  • Squid3 clean install: no internet access

    8
    0 Votes
    8 Posts
    2k Views
    KOMK
    No idea.  Everyone goes for squid3-dev because that's the one that supports transparent HTTPS intercept.
  • OpenVpn - Multiple instances

    4
    0 Votes
    4 Posts
    1k Views
    C
    I had enabled modem gui access from the firewall and had created an additional interface on WAN as per instructions given on https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewal …l hence there were two interfaces WAN & Modem Access which were having the same mac id, until ver 2.1 OPNVPN never created multiple instances but post 2.1.1-2.1.4 OPNVPN created multiple instances, then I removed the modem access and ( deleted modem access interface) and every thing worked fine.
  • SSL Offloading with squid3 + HAProxy

    7
    0 Votes
    7 Posts
    3k Views
    A
    Well, ok I see what you mean. Thank you very much !
  • Syslog-ng configuration

    9
    0 Votes
    9 Posts
    14k Views
    A
    thank you for your help  ;D
  • Squid authentication + Dansguardian (not NTLM)

    5
    0 Votes
    5 Posts
    2k Views
    R
    @ZGruk: You have to configure the proxy settings to point directly to dansguardian (port 8080) instead of port forwarding from 80 to 8080. Sorry for the thread resurrection. I'm not clear how to do this. Is the setting changed in squid? Or is it a firewall/NAT rule that I have to write. Any chance you (or anyone) can post more detailed steps. Thanks!
  • OpenVPN Export doesn't work on alix board with 2.1.4

    4
    0 Votes
    4 Posts
    995 Views
    S
    Write 2.1.4 on a new CF card and boot pfsense. Install the OpenVPN Export package and reboot, works fine with default config. Restore my backup and reboot, works fine. Maybe the CF card was bad or something in the update process goes really wrong.
  • Bypass proxy or allow domain on Squid [SSL]

    2
    0 Votes
    2 Posts
    2k Views
    D
    If I understand it correctly, you host your organization's email on Office 365? If so, do you have autodiscover.<your_domain>.com properly aliased (CANME) to autodiscover.outlook.com? Reason I am asking is that autodiscover.outlook.com does not respond on port 443 (and should not). In case it is configured correctly, you also have to be mindful of when to enter which credentials - some will ask you for your proxy credentials and some will ask for application (exchange) credentials. And another way to test this is to allow your test machine to connect directly - does it work or still prompts?</your_domain>
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.