Subcategories

• Cache/Proxy

  Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

  3.8k
  Topics
  20.7k
  Posts

  V

  @sensewolf said in Can't protect certain path only with client certificate:

  -- The expected outcome is that in order to access the specific path, a client certificate is required. Surprisingly, however, the path becomes publicly accessible again without the client certificate --

  I don't understand why this doesn't work. The setup is basically the same as for my other accessible and protected domains with the only difference that in this case only a certain path should be protected.

  Did you put this rule to the top, so that it is probed and executed before the other one?

  For testing the ACLs just use a simple rule, which give a clear result like "http request deny".

  Why isn't this working? What am I missing?

  Maybe someone will see it if you post the whole configuration.

• IDS/IPS

  Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

  2.3k
  Topics
  15.9k
  Posts

  B

  @Dr-Monarch said in Suricata IDP/IDS on PFsense blocking all traffic:

  What ideally i am aiming for is all traffic is dropped until particular rule is analyzed and cleared so it can be allowed.

  That's not how Suricata works -- unless I am still not understanding what you want to do. You whitelist hosts (by IP address) not SIDs (rules). There is no construct I am aware of that mimics a "whitelist" SID (Signature ID). You can certainly enable or disable particular rules (SIDs), but that will apply to all hosts.

  With Legacy Mode Blocking, all rules do block when triggered. The only exception is IP addresses in the Pass List which are not blocked. These are by default local LAN hosts, gateways, DNS servers, and the WAN interface's single public IP address. Inline IPS Mode requires that you manually change rule actions to DROP for all rules which you wish to block traffic when triggered. You can do this via SID MGMT or manually using the provided icons on the ALERTS or RULES tabs.

  There is no concept of a Pass List with Inline IPS Mode because that mode does not block an IP address. It instead drops the particular offending packet (the one that triggered the rule). If you want to exclude a particular IP address from enforcement action, you can use a Suppress List or change the rule's action to PASS and edit the target IP addresses in the SID as necessary.

  What you can do is selectively change the action of a given SID manually. You can set the action of a given SID to ALERT, DROP, REJECT, or PASS.

• Traffic Monitoring

  Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

  567
  Topics
  2.8k
  Posts

  A

  I am looking for a package that can show hits on a forwarded port specifically, as well as inbound traffic that was passed on that port. It will be tunnelled traffic being redirected to an internal wireguard server.

• pfBlockerNG

  Discussions about the pfBlockerNG package

  2.6k
  Topics
  19.5k
  Posts

  T

  @m2av This would massively improve pfB's DNSBL functionality—the ability to utilize a feed as a whitelist.

• UPS Tools

  Discussions about Network UPS Tools and APCUPSD packages for pfSense

  92
  Topics
  2.4k
  Posts

  B

  Thanks, all! Upgrading to the latest pfSense Beta fixed it!

• ACME

  Discussions about the ACME / Let’s Encrypt package for pfSense

  490
  Topics
  2.8k
  Posts

  B

  @Gertjan said in ACME using dynv6:

  but I can't see the usefulness of publishing my "pfSense LAN-ipv6-address".

  You don't publish it, you use it, to update only the prefix part of a given dns-record.

  I for example changed to only use ULAs in my LANs. But also I have some "unused" VLANs set to "Track Interface" to get the daily changing prefixes to then use them with NPt for my ULA-LANs. I would benefit from what I have described before.
  If you, as an expert user, found a solution, that works for you, that is great. I still wait for pfSense to bring a better solution to this for the rest of us.

• FRR

  Discussions about the FRR Dynamic Routing package on pfSense

  290
  Topics
  1.2k
  Posts

  F

  Hi Team,

  This is driving me crazy!

  I typically set up FRR manually under PFS, but would like to move to GUI to make life easier for 'new folks'.

  Here's a snippet of my config:

  router ospf
  ospf router-id id.id.id.id
  area 0.0.0.0 shortcut default
  redistribute kernel
  !
  ip prefix-list XXX seq 1 deny 10.0.0.0/16 le 32
  ip prefix-list XXX seq 2 permit any

  route-map XXX permit 10
  match ip address prefix-list XXX
  !
  ip protocol ospf route-map XXX

  I cannot for the life of me figure out how to get the last line into the config via the GUI.

  I've read that setting ABR filters in FFR-OSPF->Areas might be the answer, but that doesn't seem to be it.

  Could someone please explain what I'm missing here?

  Thanks

  ChIP

• Tailscale

  Discussions about the Tailscale package

  85
  Topics
  543
  Posts

  D

  @jacobhall

  I was on the stock version (pfsense community 2.7.2) of tailslcale connecting to headscale.

  I upgraded tailscale client on pfsense to 1.82.5 while leaving headscale unchanged. I was able to reproduce the problem -- my android tailscale client cannot resolve dns when using the tailscale client on pfsense as an exit node. If I disable "Use tailscale DNS" on my android client, internet connectivity works.

  I am going to leave it broken for now, if anyone wants me to try different things. Thanks.

• WireGuard

  Discussions about WireGuard

  674
  Topics
  3.5k
  Posts

  E

  I think I know the answer as I already searched on the AmneziaWG website and found no explicit support for freeBDS. However, people are busy bees always doing something on GitHub. Is there a way to implement AmneziaWG on Pfsense?

  Just a small excerpt from the website.

  AmneziaWG maintains high performance while adding an extra layer of stealth, making it a superb choice for those seeking a fast and discreet VPN connection.

  Features of AmneziaWG include:

  Availability with AmneziaVPN on all platforms. Low energy consumption. Minimal configuration needed. Undetectable by DPI analysis systems, resistant to blocking. Operates over the UDP network protocol.