Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB

    I saw where the Netgate kernel developer updated the Suricata package in the pfSense 25.07 development branch to work with the new kernel PPPoE driver. But so far as I know that updated package has not been migrated to 2.8 CE.

    Here is the commit into the DEVEL branch: https://github.com/pfsense/FreeBSD-ports/commit/68a06b3a33c690042b61fb4ccfe96f3138e83b72.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    A

    @wbmstr2000 : Thanks! I will investigate it, greetings

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    99 Topics
    2k Posts
    K

    @elvisimprsntr thanks for your suggestion. I will give it a try.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    johnpozJ

    @MacUsers

    https://help.zerossl.com/hc/en-us/articles/360060119933-Certificate-Revocation

    edit: oh you prob out of luck

    You can revoke any certificate issued via the ZeroSSL portal. Currently, certificates issued via ACME can not be revoked from inside the portal - please follow the instructions of your ACME client for revoking those certificates.

    the gui in pfsense does not have the ability to revoke - you prob have to move the certs to something you have certbot installed to and revoke that way.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    88 Topics
    573 Posts
    luckman212L

    For 25.07 RC, this worked for me (run sh first)

    [25.07-RC][root@r1.lan]/root: sh # export IGNORE_OSVERSION=yes # pkg add https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.84.2.pkg # service tailscaled restart # tailscale up # tailscale version 1.84.2 go version: go1.24.4 # tailscaled -version 1.84.2 go version: go1.24.4
  • Discussions about WireGuard

    689 Topics
    4k Posts
    P

    @patient0 Thanks for further suggestions. The tunnel is definitely up and so I don't think this is a CGNAT issue after all. WAN firewall rule is in place for UDP on port 51823 (otherwise the tunnel wouldn't work, right?). I can ping from client 1 -> client 2 and visa versa and also ping all points in between like you suggest. I just can't open an HTTPS connection from pfSenseB from Client 1 using a browser. But I can do this the other way round i.e. from Client 2 to pfSenseA

    I will try and do some packet capture to see if that reveals anything.

  • Packages 24.11 Issue

    5
    0 Votes
    5 Posts
    469 Views
    M

    @jimp said in Packages 24.11 Issue:

    Plus 24.11 should be good now, the others are still rebuilding and will be fixed shortly.

    Confirmed, thanks Jimp, 24.11 fixed already.

  • Vhosts

    1
    0 Votes
    1 Posts
    133 Views
    No one has replied
  • Freeradius with PIN+OTP plus group membership in AD

    1
    0 Votes
    1 Posts
    139 Views
    No one has replied
  • PIMD Invalid Interfaces?

    3
    1 Votes
    3 Posts
    304 Views
    J

    I've been able to confirm...

    If the interface does not show in the PIMD Virtual Interface Table on the Status Tab, it gives the "Invalid phyint address" error in the logs. Sooo....

    It appears that there is some limit that is preventing PIMD from seeing all the interfaces. The closest information I found is related to Linux and the limit is defined in the kernel...

    I'm guessing even though I've been able to reverse my settings and avoid the errors in the logs, that any interfaces not shown in the Table are just ignored and are not participating in IGMP :-(

  • Squid Proxy Server Automatically Disables

    1
    0 Votes
    1 Posts
    138 Views
    No one has replied
  • Arpwatch reports bogons frequently

    19
    0 Votes
    19 Posts
    9k Views
    J

    another optoin to avoid 0.0.0.0 &169.254.0.0 spam is to igmore the mac-addr's
    from arpwatch>settings, click the +Add button at the bottom
    add any mac you don't want alerts for

  • Suricata Permit QUIC

    6
    0 Votes
    6 Posts
    603 Views
    bmeeksB

    That alert is coming from the built-in QUIC-events rules that ship with the Suricata binary.

    The events rules are simply informational in nature and don't indicate any malware or other compromise. I suggest disabling that rule or else using the "suppress by SID" feature on the ALERTS tab to prevent the alert the resulting block of a host.

  • Not able to find hash file of an old iso images

    3
    0 Votes
    3 Posts
    216 Views
    R

    Hi Patch,

    Thank you for your help.

  • FreeRadius or something else, for MFA without a PIN code?

    1
    0 Votes
    1 Posts
    168 Views
    No one has replied
  • Crowdsec testing

    1
    0 Votes
    1 Posts
    589 Views
    No one has replied
  • Snort Interface - The Green Arrow!

    1
    0 Votes
    1 Posts
    176 Views
    No one has replied
  • SIProxd Quick Howto

    2
    1 Votes
    2 Posts
    344 Views
    chpalmerC

    Just a side note.. I have not always set the "proxy" in my client devices and it still would work.. but sometimes the client device would bypass the proxy and cause me issues.

  • HAProxy - Files

    1
    0 Votes
    1 Posts
    207 Views
    No one has replied
  • HAProxy with ACME setup problems

    1
    0 Votes
    1 Posts
    263 Views
    No one has replied
  • Rules for UDP Broadcast Relay?

    3
    0 Votes
    3 Posts
    818 Views
    P

    @jasch
    Thanks.
    I finally got around to try again. But to no avail. I allow everything through (any/any/any/any -you get the drift). It seems like both ends, music streamer on LAN and smartphone on OPT1, succeeds in passing multicast traffic to the multicast addresses. But the phone is still not aware of the streamer's existence unless I put them on the same subnet.
    I think I have to give up. I am too much fumbling in the dark.

  • Clear state on fallback

    2
    0 Votes
    2 Posts
    272 Views
    kiokomanK

    @jwilli5646
    AFAIK this is normal behavior, old states remain on the backup until they expire, new one will be created on the primary WAN, if you search the forum there was someone who invented some script to automate this If my memory's correct

  • net-snmpd service not starting

    1
    0 Votes
    1 Posts
    204 Views
    No one has replied
  • pfBlockerNG Count and Packets Query - Seems like little being captured

    24
    0 Votes
    24 Posts
    2k Views
    LPD7L

    @Uglybrian Appreciate that feedback. Why would cpu usage be at 23% if at idle thats where I am getting confused. Cpu usage has for the most part been half this number or lower and system activity is not showing it working on anything to justify the 23%. I may be looking at this wrong but to my mind cpu usage would be a representation of how much the cpu is being put to work on a task/function. I am assuming idle is the correct state given the command column contents and everything else in the system activity is or was at 0.00%.

  • freeradius3 seemed to use old certificate expiration date

    6
    0 Votes
    6 Posts
    734 Views
    johnpozJ

    @pfpv from what I remember the android was the biggest pain.. And someone at the time there was a thread going about on it couldn't get his android to add the ca at all.. But our versions were different.

    With ios, I do recall having to do something with the password on the cert or pk12 because it didn't like just blank so used openssl to add a password.. I think you can do it now in the gui.

    Windows I had to manually change the mode of the connection to enterprise I believe.

    Oh and think there was something about having to set legacy in the openssl cmd to get accepted as well.. But what I can tell you for sure is once their added it doesn't ask you to retrust them on every connection, etc.

    Haven't played with it long time, sorry.. But my iphone is using it - and its gone through multiple upgrades to the IOS and still working, etc.

  • Freeradius3: No more automatic service restart upon config change?

    6
    0 Votes
    6 Posts
    632 Views
    P

    @Gertjan said in Freeradius3: No more automatic service restart upon config change?:

    But : where do you see them ? The command line ?

    I see these messages in the system log in the pfSense GUI.

    @Gertjan said in Freeradius3: No more automatic service restart upon config change?:

    are normal messages.
    When settings are changed in the pfSense GUI for Freeradius, the process gets restarted.

    I also thought they were normal and expected but the title of this thread is "no more automatic service restart upon config change". Somehow this is not happening to the OP.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.