@kbohlken

If you install new packages on a production firewall it should not cause downtime. However, if you are updating packages on a production firewall, those services related to the packages will be unavailable for a short period. If you have SquidGuard working for example, and decide to update the package, the squid service will be restarted and squid will stop blocking pages for a short period, usually less than a few minutes.

I always have 2 firewalls in HA Sync, and when I do updates I will swap production firewalls and only work on the standby firewall. I also make it a habit to reboot the firewall after installing or updating a package as I've had issues updating squid/squidguard in the past.

@ar15usr
short answer : no
they are indipendent

@gertjan Hello

I build my infrastructure It is not large in hardware perspective, but I've started to to integration of many apps that will have to have to be on a separate domains. Until now the internal resolver did the job, but now ... I need actual dns server.

This is strange everywhere I open a discussion about BIND and DNS all I am getting is go somewhere else!!!!!! Never had a straight answer like this functions is for that that function is for that or if you want to do this just do this and this !!!! Never mind.

Typically, you should isolate such a program, set up a test bed network and 'play' with.

That's what I am doing right now I have a downstream network behind an other pfSense Firewall and that's where I am testing it. I also have a Ubuntu server behind this firewall with Virtualmin and BIND9 package installed with few test websites, but what I am trying to understand is some terminology and functions of BIND.

So...

I set in the Settings to listen on: all vlans, but there is an option on the bottom
"Forwarder Configuration" should I set this "Forwarder IPs" to my upstream resolver or, if this option is not enabled it will simply look what DNS Servers set on System/General Settings ????

and....

In "Views" I have created and called "localview" where

Recursion - Yes
match-clients - Any
but...
allow-recursion - currently set to ANY, but this will be used for local zones isn't more secure to be set to "localnets" then "any" no matter if that is my downstream or upstream pfsense

Thank you

You're right, I delete certbot and install a selfsignated certificate. That works correctly. The problem come from LE. As the server is empty, I will reinstall it.
Thank you for your help
Benoit

@karls0 Just to remember it:
After reloading filters, I get following in Status | System logs | General:
Unable to read included directory: /opt/etc/xinetd.d [file=/var/etc/xinetd.conf] [line=1]

When I tried "less" and typed in the whole path (without the Tab-key) I got the message "/opt/etc/xinetd.d/check_mk: No such file or directory" So there must be an invisible character in the path. Therefore I deleted the directory /opt/etc/xinetd.d and created it new. I copied the file "check_mk" back into it and now xinetd runs :-))

Sorry, I cannot mark my post as resolved - if anyone can, please do it.

No answer, quite disappointed.
I had time to lean on it lately and managed to do what I wanted.

Here's some catch if it helps anyone.

Create your certificate (I use the OVH API but it works with the other method):
createCertificate.PNG

You can create as many certificates as necessary (Pay attention to the limit imposed by the ACME packge, see link below)
Rate Limits
createCertificate2.PNG

In Haproxy, go to the frontend which manages the domain name linked to the certificates created previously (the one ending with "site" for me, it depends on your configuration).
frontend.PNG

In the "certificate" section, choose one of the certificates to create (any you need).
Check the 2 boxes "Add ACL for certificate ...."
frontend1.PNG

In the "additional certificates" section, add all the certificates you need.
frontend2.PNG

Check the 2 ACL boxes again
frontend3.PNG

Save and apply the configuration.
Domains are now in HTTPS.

@gertjan
I did the settings... All is fine.
pfsense still running.

Concerning BandwithD, it works also fine on my APU...
pfsense usage is for personal use, with less than 20 devices on my Network.

As you can see, CPU usage is low... (9%..30% depending on what I do).
Only temp. is a little bit elevated due to the fact there is no cooling system.

I also implemented zfs for better performances and reliability.

82c53026-e1ea-4f4a-959a-bcaee1428221-image.png

@bmeeks
Thank you!

@kmarston said in pimd - doesn't appear to work:

On each interface I have an allow rule with the Advanced allow IP options ticked.
To make PIMD work you need to enable binding on the internal interfaces you want to participate in routing IGMP
The other thing you then need to do is create a default BSR and RP - this is the key to making it all work!

Thank you! PIMD is now working for me, the SONOS speakers are on their own vlan, and the mobile and pc apps now all work flawlessly.

I have solved my problem, for reference and for anyone who runs into the same problem:

On the pfSense gateway 172.xx.xx.1 (the one in front of the InfluxDB server, which was working), add the following to the Telegraf configuration:

[[inputs.influxdb_listener]] service_address = ":8086"

This can be done at the bottom of the Telegraf configuration page. This activates Telegraf as a forwarder.

On each other pfSense machine, I find the VTI interface IP, ie 10.88.88.xx and set the influxDB server as http://10.88.88.xx:8086.
Now, the data is sent via Telegraf to the InfluxDB server, and arrives as it should.

There would probably be other solutions with proxies, but this seems simplest.

Have found man pages for PIMD,.. and managed to get into pfsense command line shell stuff.
man: pages here:- https://manpages.debian.org/testing/pimd/pimd.8.en.html

have now configured 'General Tab':-
pimdgeneral tab.png
and configured each interface as follows:-
interfaceoptions.png
So that I can control which interfaces are included with the scope of igmp broadcasts,.. via the 'interface Binding' options.
I have included all local LANs,.. but excluded the WAN,...
and under the BSR & RP Candidates I of have included the VLAN with the source of my dlna broadcasts. with nothing entered for RP Address.
Should this be the host source of the broadcasts??

And finally have added a rule to each local LAN network to pass advanced IP traffic to all other networks, But excluding the WAN.

Solved- when in doubt, reboot.

Final addendum: I made the changes suggested above, i.e., changed PIMD General tab to bind to none and on Interfaces tab enabled desired nets, and removed priorities from BSR Candidates and RP Candidates tabs. In addition, I disabled my firewall rules for the Sonos TCP and UDP ports.

The Sonos app still works, even after closing it in iOS and re-opening it. (Not sure I'd have the same result for a new installation of the Sonos app.)

I also disabled Avahi. So I seem to be relying only on PIMD.

@bingo600 I didn't notice another package for similar functionality. I switch to that.

Thanks,

@bmeeks

Thx!

Happy Holidays!

@canernecocaner said in How do I install packages manually ?:

@bmeeks

Thank you very much for your answer.
I understood the warnings and vulnerabilities.
But I use pfsense for the hotspot.(I'm recording local users' internet access)
There is another firewall in front of the pfsense, for security purposes.
The subject I still don't know is this;

Where,why can I download these packages (with additional shared libraries they are dependent on) from any windows computer and then transfer,install them to pfsense?

Thanks

You will need to locate a repository that keeps pre-compiled pkg format *.txz archives of the programs you want to install. That repository will also have to be the same FreeBSD version as your pfSense firewall. Currently the pfSense-2.4.5_p1 release is based on FreeBSD-11.3/STABLE. It may prove difficult to find an 11.3/STABLE public repository of compiled packages. You can use the built-in pfSense package repository as the pkg utility on the firewall is pre-configured to point there. However, that repository may not have all of the packages you want or need. That's because it is geared to supporting only what pfSense and its officially supported packages require.

Another option is create a FreeBSD-11.3/STABLE virtual machine, download and install the portsnap FreeBSD ports tree, and then compile the packages you need yourself into the required *.txz format for later transfer over to pfSense and then manual installation there. However, by the time you go to this much trouble you may as well just install the mysql DB server on that FreeBSD virtual machine (back to my original suggestion).

This is "hard" because it is not a good thing to do, and few if any folks try it. Otherwise there would be a ton of "how-to" links on the web and everyone would have all kinds of other software applications running on their firewalls.

I seriously doubt you will find an easy "click here, click there and presto it's done" way to do what you desire.

Instead of trying to install all this on a pfSense machine, why not use the bare metal hardware running pfSense to run a hypervisor like Proxmox, ESXi, Hyper-V, etc.? Then on the hypervisor you can create a pfSense virtual machine for the Captive Portal function, then create a separate FreeBSD-11.3/RELEASE virtual machine and install the mysql stuff there. Easy-peasy to do that without needing to transfer files around, compile packages yourself, or try to find a compatible public repository of pre-compiled packages.

@kiokoman Thanks, for cleariying

For a Firewall 8G is a LOT in 98% use cases. ;-)

-Rico

While looking for a solution to this, I saw that it is now possible to set the OTP Label by adding a Description in the Users Edit page:

21294a16-3167-474f-9564-339843f24e74-image.png

I'm using pfSense 2.4.5-RELEASE-p1 and freeradius3 0.15.7_20

Requested in Issue:
https://redmine.pfsense.org/issues/8878

Corresponding Pull Request:
https://github.com/pfsense/FreeBSD-ports/pull/779

Solution:
Services > Squid Proxy Server
SSL/MITM Mode: Splice All.

Splice All:
This configuration is suitable if you want to use the SquidGuard package for web filtering.
All destinations will be spliced. SquidGuard can do its job of denying or allowing destinations according its rules, as it does with HTTP.
You do not need to install the CA certificate configured below on clients.
Content filtering (such as Antivirus) will not be available for SSL sites.

@piba said in 2.4.5_1 PHP Error installing HAProxy:

unset($config['installedpackages']['haproxy']);
write_config("fix haproxy install, remove empty config");
print("config fixed?");

By Jove Sir, I think you got it.

I was able to install HaProxy.

@bauerfyr

to automate starting the service, create a wrapper file and place it in /usr/local/etc/rc.d, and you MUST have an extension of .sh, and it'll run. My file is "amazon-ssm-agent-wrapper.sh" and the contents are:

#!/bin/sh
DIR="$( cd "$( dirname "$0" )" && pwd )"
sh $DIR/amazon-ssm-agent onestart

For the LOGGING of ssm agent to cloudwatch (if you are interested) you have to take the wayback machine b/c the ssm agent 2.3.x is so ancient.

go to /usr/local/etc/amazon/ssm, create a new file (start fresh) called seelog.xml (you'll see templates there), sample below. I wanted to split into two separate logs files, but it doesn't look possible.

!--amazon-ssm-agent uses seelog logging -->
<!--Seelog has github wiki pages, which contain detailed how-tos references: https://github.com/cihub/seelog/wiki -->
<!--Seelog examples can be found here: https://github.com/cihub/seelog-examples -->
<!--References to mods: -->
<!--How to add cloudwatch: https://docs.aws.amazon.com/systems-manager/latest/userguide/monitoring-ssm-agent.html -->
<!--For "deep" examples: https://github.com/cihub/seelog/wiki/Example-config -->
<seelog type="adaptive" mininterval="2000000" maxinterval="100000000" critmsgcount="500" minlevel="info">
<outputs formatid="fmtinfo">
<console/>
<!-- <file path="/var/log/amazon/ssm/amazon-ssm-agent.log"/> -->
<rollingfile type="size" filename="/var/log/amazon/ssm/amazon-ssm-agent.log" maxsize="10000000" maxrolls="5"/>-
<filter levels="error,critical" formatid="fmterror">
<rollingfile type="size" filename="/var/log/amazon/ssm/errors.log" maxsize="10000000" maxrolls="5"/>-
<!-- LINE BELOW DOESN'T WORK YET - it gets overwritten by next "cloudwatch_receiver stmt."-->
<!-- <custom name="cloudwatch_receiver" data-log-group="ssm-agent-errors"/> -->
</filter>
<!-- ENTER THE CLOUDWATCH LOG GROUP NAME AFTER 'data-log-group' -->
<custom name="cloudwatch_receiver" formatid="fmtinfo" data-log-group="ssm-agent-log"/>
</outputs>
<formats>
<format id="fmterror" format="%Date %Time %LEVEL [%FuncShort @ %File.%Line] %Msg%n"/>
<format id="fmtdebug" format="%Date %Time %LEVEL [%FuncShort @ %File.%Line] %Msg%n"/>
<format id="fmtinfo" format="%Date %Time %LEVEL %Msg%n"/>
</formats>
</seelog>

@gertjan said in Bind - Setup pfSense as slave DNS server:

your DNS zone has to be fully IPv6 and IPv4

Don't agree with this.. While sure if you have IPv6 then yeah be nice to do that.. But it sure doesn't have to do anything IPv6..

And while I agree you should do dnssec - again not a requirement.. You do not have to setup dnssec - and people using dnssec will still resolve you. Unless you try setup dnssec and you mess it up.. Then yeah if your dnssec fails you won't resolve.

He is trying to show you that yes it gets complicated very quickly.. But when it comes down to setting up a slave. You tell your master what IP are you slaves, and you setup the zones on your slave and tell them the IP of the master.

But he makes a good point about your PTR.. Can you even set that either of your NSers IPs? That really should be set.. Is where you running pfsense even a static IP?

What are you going to do if someone attacks your dns? What are you going to do if someone tries to use your NSers for a amplification attack and you didn't secure for that? What your using for NS should not be recursive.. An authoritative NS should not do queries for other clients. They only should answer for the domains they are authoritative for..

@legtpa what kind of modifications?
maybe new WebGUI checkboxes needed?

You can create a feature request: https://docs.netgate.com/pfsense/en/latest/development/feature-requests.html