Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB

    I saw where the Netgate kernel developer updated the Suricata package in the pfSense 25.07 development branch to work with the new kernel PPPoE driver. But so far as I know that updated package has not been migrated to 2.8 CE.

    Here is the commit into the DEVEL branch: https://github.com/pfsense/FreeBSD-ports/commit/68a06b3a33c690042b61fb4ccfe96f3138e83b72.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    A

    @wbmstr2000 : Thanks! I will investigate it, greetings

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    99 Topics
    2k Posts
    K

    @elvisimprsntr thanks for your suggestion. I will give it a try.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    johnpozJ

    @MacUsers

    https://help.zerossl.com/hc/en-us/articles/360060119933-Certificate-Revocation

    edit: oh you prob out of luck

    You can revoke any certificate issued via the ZeroSSL portal. Currently, certificates issued via ACME can not be revoked from inside the portal - please follow the instructions of your ACME client for revoking those certificates.

    the gui in pfsense does not have the ability to revoke - you prob have to move the certs to something you have certbot installed to and revoke that way.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    88 Topics
    573 Posts
    luckman212L

    For 25.07 RC, this worked for me (run sh first)

    [25.07-RC][root@r1.lan]/root: sh # export IGNORE_OSVERSION=yes # pkg add https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.84.2.pkg # service tailscaled restart # tailscale up # tailscale version 1.84.2 go version: go1.24.4 # tailscaled -version 1.84.2 go version: go1.24.4
  • Discussions about WireGuard

    689 Topics
    4k Posts
    P

    @patient0 Thanks for further suggestions. The tunnel is definitely up and so I don't think this is a CGNAT issue after all. WAN firewall rule is in place for UDP on port 51823 (otherwise the tunnel wouldn't work, right?). I can ping from client 1 -> client 2 and visa versa and also ping all points in between like you suggest. I just can't open an HTTPS connection from pfSenseB from Client 1 using a browser. But I can do this the other way round i.e. from Client 2 to pfSenseA

    I will try and do some packet capture to see if that reveals anything.

  • Squid install problem

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S

    http://forum.pfsense.org/index.php?topic=1352.0

  • Updated packages

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S

    The installed package tab will show new versions.

  • Package installation

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    B

    OK, so that's the case thnx!
    I'll try BETA 4 :)

  • Unable to communicate to pfSense.com

    Locked
    3
    0 Votes
    3 Posts
    7k Views
    N

    I found out why it wasn't working.
    The "Allow DNS server list to be overridden by DHCP/PPP on WAN" option was enabled in the "System: General Setup" menu.

  • Freeradius

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    S

    FreeRADIUS is marked as broken.  Surely you dont' expect something marked as broken to work!?

  • Pfflowd non correctly counts

    Locked
    12
    0 Votes
    12 Posts
    7k Views
    B

    @freeseacher:

    @billm:

    It's likely that pfflowd is only counting stuff that matches state.  Retransmits that got dropped for whatever reason likely don't add to the flow numbers it retains.

    pfflowd gets it's data from pfsync - I don't believe it maintains a table of inflight flows, I'm pretty sure it gets it's data from the state teardown messages.  So, the data comes directly from the PF state entry which means only data that pf forwarded itself.

    –Bill

    rules for pf was
    pass any in keep-state
    pass any out keep-state

    is there someting to miss ?

    Yes, my point ;)

    Not all packets in a given TCP flow will be considered "in state".  Consider out of window packets, out of sequence window packets (stuff that's been ack'd and had data past it acked, but was retransmitted all the same).  "normal" TCP communications do have packets that will get blocked.  I'm reasonably confident that those packets will not cound against the PF byte count for that flow.  The easiest way to determine that is to see if the PF byte count more closely matches that of the file(s) that were transferred.  If it's under, then there's a bug somewhere, if it's over, but over by less than the other accounting types (ng_netflow is going to get all packets regardless of whether pf blocks it) then it's not a bug per se, you just have to understand what/where you're monitoring.

    –Bill

  • Error when installing STUNNEL

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    L

    thanks a lot Sullrich, it's OK now  ;)

  • Antivirus for PFsense

    Locked
    2
    0 Votes
    2 Posts
    7k Views
    S

    Fernando is working on it but there is no ETA.

  • ClamAV

    Locked
    8
    0 Votes
    8 Posts
    8k Views
    R

    Hi,

    I have made a clamav package, it's not complete as yet and I have not added any web gui for starting or stopping or for other options in config files. As of now you can just test it from command line by running clamscan. The actual use for clamscan is for havp. As of now havp has experimental FreeBSD support and I am working on packaging it for FreeBSD. In the mean time pl test the clamav package. This is my first stab at packaging some thing for pfSense, so there will be lot's of things that can be improved.

    raj

    I am posting the clamav section from pkg_config.xml and the package configuration files.

              <package><name>clamav</name>           <website>http://www.clamav.net/</website>           <descr>Opensource anti virus</descr>           <category>Services</category>           <config_file>http://agni.linuxense.com/packages/config/clamav.xml</config_file>           <depends_on_package_base_url>http://ftp13.freebsd.org/pub/FreeBSD/ports/i386/packages-6.0-release/All</depends_on_package_base_url>           <depends_on_package>clamav-0.87.tbz</depends_on_package>           <version>0.1</version>           <status>BETA</status>           <maintainer>raj@linuxense.com</maintainer>           <configurationfile>clamav.xml</configurationfile>           <logging><facilityname>clamav</facilityname>                 <logfilename>clamav.log</logfilename></logging></package>

    config.xml

    <packagegui><name>clamav</name>         <version>0.1</version>         <title>ClamAV: Settings</title>         <include_file>/usr/local/pkg/clamav.inc</include_file>         <service><name>clamav</name>                 <rcfile>/usr/local/etc/rc.d/clamav.sh</rcfile></service>         <additional_files_needed><prefix>/usr/local/pkg/</prefix>             <chmod>0755</chmod>             http://agni.linuxense.com/packages/config/clamav.inc</additional_files_needed>         <custom_php_install_command>clamav_install_command();</custom_php_install_command>         <custom_php_deinstall_command>clamav_deinstall_command();</custom_php_deinstall_command>         <custom_delete_php_command>sync_package_clamav();</custom_delete_php_command>         <custom_php_resync_config_command>sync_package_clamav();</custom_php_resync_config_command>         <custom_add_php_command>sync_package_clamav();</custom_add_php_command></packagegui>

    clamav.inc

    function sync_package_clamav() {         conf_mount_rw();         config_lock();         global $config;         $start = "/usr/local/sbin/clamd &\n";         $stop  = "/usr/bin/killall clamd\n" .         "sleep 2";         write_rcfile(array(                           "file" => "clamav.sh",                           "start" => $start,                           "stop" =>  $stop                           )                     );         conf_mount_ro();         config_unlock();         mwexec("killall -HUP cron");         mwexec("/usr/local/etc/rc.d/clamav.sh stop");         mwexec("/usr/local/etc/rc.d/clamav.sh start"); } function clamav_install_command() {         global $config, $g;         mwexec ("mkdir -p /var/db/clamav");         mwexec ("/usr/local/bin/freshclam");         sync_package_clamav(); } function clamav_deinstall_command() {         global $config, $g;         conf_mount_rw();         unlink_if_exists("/usr/local/etc/rc.d/clamav.sh");         unlink_if_exists("/var/db/clamav/daily.cvd");         unlink_if_exists("/var/db/clamav/main.cvd");         unlink_if_exists("/var/db/clamav");         conf_mount_ro(); } ?>
  • Command Line package installation

    Locked
    4
    0 Votes
    4 Posts
    6k Views
    D

    and this command line wiil not work?

    php pkg_mgr_install.php?id=packagename

  • SpamD - add to whitelist working ?

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    S

    Yep, thats about it in a nutshell.

  • Spamd - Add spam trap E-mail address: + nextMTA

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    S

    @Aderium:

    Add spam trap E-mail address:

    if I add a spamtrap email called spamtrap@mydomain.com do I also need to create such user in my email server ?

    No, basically if a email address is the to: address then SpamD knowns to add this servers IP to the trapped database and then further connections from that mail server will be trapped in a great tarpit which looks like a 110 baud modem communication, wasting the cpu cycles of the mail server in question.  It's neat.

    @Aderium:

    nextMTA

    my internal ip address for mailserver is 10.1.10.10  is this the IP I would add to nextMTA ?

    Yep.

  • SpamD outlook button

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    H

    Install http://pfsense.com/~sullrich/SpamDOutlookAlpha/SpamD.msi . It will add the outlook plugin. You also need to have SpamD package installed at your pfSense of course.

  • Might I suggest breaking out the packages to their own directories

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    B

    @ronnieredd:

    Excuse me? Why am I making you click dozens of forums? Did I do something wrong? If so, I'm sorry. Please do elaborate.

    13 packages plus the existing dozen or so forums makes for dozens of forums.  I'm old enough to remember and use BBS's, yet I still prefer email - I can sort and filter my inbox based on what I choose to read.  Which means more time spent on email worth replying to.  More forums split the attention the developers (who are still the primary support - although a few souls have certainly stepped up and chipped in on the support from) leaving us with less time to write code.  Until a package becomes enough of a nuisance filling the existing packages forum, it's really not worth splitting it out.

    –Bill

    PS. wut sullrich and hoba said

  • Variables for spamd

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    S

    %A expands to the IP in the blacklist.

    Since each blacklist is added individually then you know what database url to insert for each response.

    I couldn't locate any other variables in http://www.openbsd.org/cgi-bin/man.cgi?query=spamd.conf&sektion=5 but if you come across any others, please let me know.

  • Squid - Disable Access Log Patch

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    B

    @msamblanet:

    Thanks - patch form

    Sorry for all the questions for a fairly trivial patch - hopefully as my current work project calms down I can offer something of more substance…

    Commited.  Thanks

    –Bill

  • Securing Package CGIs?

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    B

    @msamblanet:

    OK - thanks - I have a better sense where things are going now…as you have seen in my other email, I took the first pass option of forcing users to enable the cachemgr so you have to choose to accept the risk...

    If I ever find enough free time I am qualified to write the module you propose - but time is always the trick...my hat is off to you - I don't know how you (and many other good OpenSource authors) find the time to do this...

    An option I was toying with overnight was how one could make a PHP wrapper so that the cgi was kept outside the web directory and content was in an iframe or similar with the PHP wrapper handlng security - would even allow us to keep the pfsense menus on the screen :)  ...unfort my PHP is pretty weak (I'm just an old Asm/C/C++ dev turned Java in the current day/age) - so I don't know how hard doing the CGI calls from PHP would be...can't imagine it's too bad but caveat coder

    Hmmm…that's actually not a half bad idea.  I dunno about an iframe, but we could probably allow auth.inc to do it's job and use passthru() or something to run a cgi.  I'll have to think about that a bit.

    --Bill

  • Install other packages

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    D

    Ok, thks
    Success to you in work

  • Ntop errors

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    J

    Ntop has all sorts of problems.  No one is currently looking after the package as far as I know so they probably won't get fixed.  But I think something better is getting added to 1.1 anyway, maybe maybe not.

  • Problem at Status>Services

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    L

    Thanks, fixed.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.