Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    cyb3rtr0nianC

    @bmeeks So after upgrading to the newest PfSense 2.8.0 everything is now working like a charm!

    Suricata no longer seems to strip off tags like it did before! Which means I can now use my network segmented by VLANs and still use the benefits of Suricata Inline IPS! Very niiize!

    I checked in the Alerts section and it is indeed generating the correct alerts from the different VLAN sections, I put Inline IPS on the parent interface of all the VLANs.

    I assume this is because the FreeBSD version is also updated with the new PfSense 2.8.0 version?

    Because before, as soon as I selected Inline IPS mode, my entire VLAN tagging would break and nothing was reachable until I switched back to Legacy mode.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    N

    @SteveITS ...got it, I should have looked in the docs... I do too use Quad9 and have DNSSEC disabled, so I guess my question is pointless..

    Thank you for all the help.

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    99 Topics
    2k Posts
    K

    @elvisimprsntr thanks for your suggestion. I will give it a try.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG

    @EChondo

    What's your pfSense version ?
    The instructions are shown here :

    1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png

    A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate.

    @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy:

    I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess.

    No need to wait x days.
    You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    89 Topics
    574 Posts
    A

    Hello,
    I am unable to get the Tailscale package to work. The page at VPN > Tailscale > Authentication is stuck. It displays the error "Tailscale is not online," but also shows a "Logout and Clean" button, with no option to log in.
    link text

    This state persists even after performing the following troubleshooting steps:

    Rebooting the pfSense router.

    Completely uninstalling and reinstalling the Tailscale package multiple times.

    Clearing browser cache and using a private browser window.

    Toggling the main "Enable Tailscale" checkbox in the settings.

    Checking the logs, which show the service gets a "terminate" signal and shuts down cleanly; it does not crash.

    Manually trying to delete the state file with rm /var/db/tailscale/tailscaled.state, which failed because the file does not exist.

    It appears that the package's configuration is corrupted in a way that persists even after reinstallation. Can anyone advise on how to perform a complete manual cleanup of all Tailscale files and settings?

  • Discussions about WireGuard

    690 Topics
    4k Posts
    J

    I've read through some other posts about this, but they either didn't say whether the proposed solution worked or they were very convoluted and difficult to understand. Here is our scenario: We have 6 locations--Las Cruces (LC), Sunland Park (SP), El Paso (EP), Abilene (ABI), Fort Worth (FW), and Plano (PL). LC and ABI have software that is accessed by the other 4 locations via VPN. There are WireGuard VPNs set up between LC and those 4 locations (SP, EP, FW, PL), and ABI and those 4 locations (SP, EP, FW, PL). There is also a WireGuard VPN connection between LC and ABI. LC and ABI have 2 internet connections. SP, EP, FW, and PL each have one internet connection.

    If the primary internet connection goes down at either LC or ABI and failover occurs to the secondary internet connection, is there a way to set up the WireGuard VPN connections so that they also failover without purchasing some 3rd party application?

    Thanks.

  • Update NMAP MAC Prefexes List

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    jimpJ

    The mac-to-vendor code is in 2.0 proper now, but I don't know if we'll include that list on the box by default.

    We use the version of that file that comes with the nmap package, which is generally the latest one seen in FreeBSD's ports tree.

    As I mentioned in another thread, you can always pull in the most recent version without nmap like so:

    mkdir -p /usr/local/share/nmap/; fetch -o /usr/local/share/nmap/nmap-mac-prefixes http://nmap.org/svn/nmap-mac-prefixes
  • Removing freeradius breaks system

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    jimpJ

    That filter.inc line is a test to see if UPnP's options are set to be enabled.

    Not sure exactly what FreeRADIUS may have done that would have made that fail though.

    I have installed and uninstalled FreeRADIUS a few times in the past and didn't have issues.

    You can edit a config.xml backup, it's just plain text XML, find the section with the <package>…</package> tags for FreeRadius and remove them, and then restore the backup.

  • Squidguard fails install

    Locked
    12
    0 Votes
    12 Posts
    6k Views
    jimpJ

    Search the forums, others have done that.

    I wouldn't want to do that, but to each their own…

  • Squid cache

    Locked
    8
    0 Votes
    8 Posts
    5k Views
    R

    Okay, thank you for helping Nachtfalke, the settings seem to have worked

  • Transmeta crusoe longrun power manage module for FB8.1

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    K

    maybe someone can help me to install the longrun plugin.

  • Squid Package Tuning

    Locked
    29
    0 Votes
    29 Posts
    17k Views
    N

    Hi,

    in the past we talked about caching Kaspersky updates:
    I tried this:

    refresh_pattern -i .*kaspersky\.com/.*\.(.*) 1440 100% 1440 reload-into-ims override-expire override-lastmode; refresh_pattern -i .*kaspersky-labs\.com/.*\.(.*) 1440 100% 1440 reload-into-ims override-expire override-lastmode;

    I think this is working just fine for the "Kaspersky Offline Updater Tool"
    http://support.kaspersky.com/updater?level=2

    Need more testing if it works with the "normal" updater function of the client software.
    Perhaps someone else will find some time for this.

    Further I found out, that if we use

    range_offset_limit -1

    squid is still downloading files even if the user has left a website or canceld some download.
    To avoid this, I am using this:

    quick_abort_min 0 KB; quick_abort_max 0 KB; quick_abort_pct 100;

    For windows updates I am using this without any errors in syslog and with success:

    refresh_pattern -i .*microsoft\.com/.*\.(cab|exe|msi|msp) 129600 100% 129600 reload-into-ims; refresh_pattern -i .*windowsupdate\.com/.*\.(cab|exe|msi|msp) 129600 100% 129600 reload-into-ims;

    To avoid, that a user is getting still a "Error 404" if a website wasn't available for a short time and then ist up again because of the high time for negative dns I am using this:

    negative_ttl 5 second; negative_dns_ttl 5 second;

    I am using this all in squid "Custom options".
    It would be really nice if someone else could test and verify this or post some other usefull squid options.
    For me it was hard to find these parameters and so I wnat to share them and get some feedback.

  • SQUID range_offset_limit - understanding problem

    Locked
    2
    0 Votes
    2 Posts
    5k Views
    N

    Hi,

    I found out, that the first part is nonsense.
    one times "range_offset_limit -1" is enough.

    Further I found out, how to cache kaspersky updates:

    refresh_pattern -i .*kaspersky\.com/.*\.(.*) 1440 100% 1440 reload-into-ims override-expire override-lastmode; refresh_pattern -i .*kaspersky-labs\.com/.*\.(.*) 1440 100% 1440 reload-into-ims override-expire override-lastmode;

    For me this works - I think.

  • Havp doesn't start after reboot (pf 2.0 amd64, Feb 24)

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    A

    Hi you guys , this is my firts post. so a im a new user with pfsense.

    I am already have havp working with my proxy cache. the issue I have is that when the systems reboots clamd takes a lot for start up. Meanwhile i can not get to internet , i can not get web pages in my browser.

    After about 8-10 minutes the system start to work normaly and clamd seem to be started.

    The page setup shows the clamd  down after about 8-10 mins. of restarted.

    Any ideas what is happening ? I already have configured the havp as parent proxy for squid.

  • Nagios/nrpe for pfsense 2.0?

    Locked
    8
    0 Votes
    8 Posts
    13k Views
    jimpJ

    NRPE2 should now be installable and functional for SSL-enabled communication on pfSense 2.0.

  • Client -> Squid ->SquidGuard -> Havp/Antivirus -> Privoxy -> Internet

    Locked
    4
    0 Votes
    4 Posts
    9k Views
    _

    Its really easy:

    Install squid, at general settings set "proxy port" to 3125. Squid is set as transparent proxy.
    Install squidguard and configure it.
    Now install havp and configure it as "parent for squid", "proxy port" set to 3125.

    Thats the short story, should work.

    Try first only squid - squidguard to get that working, then after success install/configure havp.

    with privoxy i can't help. sorry

  • HAVP says stopped on 2.0 RC1

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    M

    Happy to comply - which exact logs do you want?

  • Problem in installing squid!!!

    Locked
    13
    0 Votes
    13 Posts
    10k Views
    jimpJ

    There is no viable way to install a package manually. It may be possible but the procedure is very prone to user error and you'd likely break something in the process.

    Alternately, you can setup your own local package repository on a computer you have access to and then serve the package files from there:

    http://doc.pfsense.org/index.php/Creating_Your_Own_Package_Repository

  • Squid Guard Rules

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Pkg_add not installed

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    stephenw10S

    Does the ups require a driver or is it a usb-serial adapter?

    What does it show up in the logs as if you hotplug it?

    Steve

  • Snort Portscan Detection - Blocking VoIP

    Locked
    7
    0 Votes
    7 Posts
    4k Views
    C

    Yes you have to disable the port scan rule it's triggering, which is the UDP port scan rule IIRC. RTP in volume looks like a UDP port scan. Some manual hacking of the rule to make it less prone to those false positives may suffice. That's more a question for Sourcefire, we don't have any involvement with the rules.

  • Squid problem

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    N

    just try to reinstall the squid package if it is not uinder "SERVICES -> PROXY SERVER"

  • HAVP 0.91_1 Disable Heuristics.Broken.Executable ??

    Locked
    5
    0 Votes
    5 Posts
    13k Views
    M

    Thanks working well =D

  • AV scanner wont scan FTP, HTTPS, or email?

    Locked
    9
    0 Votes
    9 Posts
    5k Views
    C

    @NightHawk007:

    Just remember the lag that this antivirus causes is not worth using it .I used another utm software and there was zero lag and scanned everything going through it with no problems .

    Every gateway AV causes lag, and weirdness with downloads from the internal clients' perspective as the proxy itself downloads it first and scans it, then sends it to the client.

  • Vmware-tools Installed correctly?

    Locked
    10
    0 Votes
    10 Posts
    8k Views
    D

    Well that is odd.  I just config'ed a 32-bit vmware appliance and installed the tools.  Voila, they are running.  Hmmm.  Well, I'm only going to be giving the VM 1GB or so, so 64-bit is not necessary…

  • Freeswitch on 2.0RC1

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.