pfSense Packages

Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

Subcategories

Cache/Proxy

Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

3425
Topics

18917
Posts

M

Ok i figured it out but its a tad confusing in the GUI.
There is this section under ACL. According to the Note adding your IP here should exempt users from being authenticated BUT this does not work.
c4b263ae-5bd5-49df-bdb4-fa8869cd84bf-image.png

Instead under the authentication tab there is a section that DOES work ane remove the ability for the IPs listed here to be authenticated.
Its confusing and the documentation is not clear on this point at all.

d88083a8-f132-4b32-af17-75f037263355-image.png
IDS/IPS

Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

2005
Topics

13652
Posts

B

The only way to accomplish that would be to rewrite all the rules and reverse the direction logic. That's a lot of work.
Traffic Monitoring

Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

510
Topics

2502
Posts

J

I am running 23.05 with the above mentioned ntopng package.

I have WAN / LAN IGC nics running at 1Gb and some Wireguard interfaces.

This is running on an 8 core i5-8365U with 16GB ram. AES-NI CPU and IPsec-MB are enabled for Wireguard.

ntopng is always configured to monitor LAN only and perform no DNS lookups in the settings.

After starting ntopng it takes less than 10 minutes for unbound to become slower and slower eventually DNS response times take seconds. Restarting unbound solves it for another few minutes. Eventually I stop ntopng, restart unbound and everything instantly goes back to normal with average recursion into 45-65ms mark for DNS over TLS.

I use grafana and the query rate doesn't really change from 2-5 queries per second, just the latency creeps in.

92a0bd53-402f-4c83-a3c9-a5ea8974b9ee-image.png

I have tried a number of things and nothing seems to work.

Disable hardware checksum offload on/off
DNS over TLS to Cloudflare (ipv4/ipv6)
DNS over TLS to Google (ipv4/ipv6)
Default unbound resolving to roots

Removed all packages except PFBlockerNG.

Confirmed igc5 (LAN) was not running in promisc mode before installation of ntopng - in case I was conflicting with other packages.

Are there are any system commands or actions I can take to start troubleshooting this further? This would be appreciated. Any of the unbound stats being sent to Grafana don't really show anything special apart from the increased recursion times.

I used to run ntopng just fine on 22.05, 23.01 is where I had DNS over TLS issues and removed ntopng as part of that troubleshooting exercise. Now on 23.05 and keen to get ntopng back on.

Note ntopng and other tasks run fine, just DNS appears to be affected. iperf tests on the LAN give me close to line speed.
pfBlockerNG

Discussions about the pfBlockerNG package

2195
Topics

16824
Posts

G

@RandyWIlliams1

The best advise is already mentioned above !
The real issue is probably mentioned in the fine print, shown when you subscribed : they (paramount) give you content that you want ... but they give more then that : content that you don't want.
They said : you also paid for this non-wanted content (actually : you want it, as you accepted the fine print), and we (paramount) pay engineers that take care of the 'you will see what we send you, no matter what' (yep, you pay them to make your life ... let's say : less easy ?!)
So : the stop paying them - or upgrade from 'Plus' to 'Gold'.

If I was working for paramount, and they asked me - with a nice pay rise as a reward : make a system that blast adds all over our customers screen, I would make something like this :
Have the add pages loaded with some javascript build in.
When the browser finished showing this page, the javascript signals back with some sort of token.
This token frees up the 'right' to see some more content.
Now, when you block this add, .... you block everything.
(I'm just inventing this of course).

True, pfBlockerng can do a lot for you.
But it's not a activate-it-and-forget-it tool. You have to check it, and worse : understand what it does, why it does what it does, and what it can't do.

Sometimes the simplest solution is also the good solution ;)

edit : whitelisting the IP of the device you are using paramount is also 'a solution'.
ACME

Discussions about the ACME / Let’s Encrypt package for pfSense

386
Topics

2202
Posts

K

Problem continues after upgrading to Pfsense 23.05 and ACME 0.7.3_2, I haven't had any response in the Redmine thread either :(
Crash report begins. Anonymous machine information: amd64 14.0-CURRENT FreeBSD 14.0-CURRENT #1 plus-RELENG_23_05-n256102-7cd3d043045: Mon May 22 06:35:01 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-Plus-snapshots-23_05-main/obj/amd64/LkEyii3W/var/jenkins/workspace/pfSense-Plus-snapshots-23_05-main/sources/FreeBS Crash report details: PHP Errors: [03-Jun-2023 14:28:36 Europe/Madrid] PHP Fatal error: Uncaught TypeError: Cannot access offset of type string on string in /usr/local/www/acme/acme_certificates.php:261 Stack trace: #0 {main} thrown in /usr/local/www/acme/acme_certificates.php on line 261 No FreeBSD crash data found.
FRR

Discussions about the FRR Dynamic Routing package on pfSense

233
Topics

942
Posts

Y

I have to use Restart PHP-FPM often to enter pfsense web.
Tailscale

Discussions about the Tailscale package

34
Topics

164
Posts

A

Hello,
I would also like to try to use pfsense to connect systems behind it and itself to an exitnode for internet access.

Is this possible somehow?
I only found this post but assigning the interface broke my pfsense, since on every reboot it will reassign the interfaces now, since it does not find tailscale0 when booting.

Assigning the IF is exactly what NOT to do according to: https://youtu.be/Fg_jIPVcioY?t=1182

Where can I create a Feature Request for this, since it would be crucial for us to use tailscale on pfSense?
WireGuard

Discussions about WireGuard

439
Topics

2573
Posts

L

@Bob-Dig ok I will go this way, maybe my fault but still not clear what traffic should not go through the VPN....local I suppose. I have taken this guide as the failover to wan scenario is a good approach to me. IVPN is reliable but not guaranteed it could not drop for some reason and the setup guide on their web site is apparently oriented to just a kill switch scenario.
Thank you

J

ntopng not displaying properly on firefox

• • jsbsmd

3

0
Votes

3
Posts

436
Views

B

@jsbsmd

Seems to work fine on FF linux Mint

07784cef-4a8f-4098-a9f0-86003f39a945-image.png

9e22f710-27cb-44d7-a513-cda8552f1c58-image.png
O

Multiple UPS with Apcupsd and/or NUT

• • occamsrazor

4

0
Votes

4
Posts

519
Views

O

Sorry for the delayed reply, the answers are appreciated. Sounds like it is a no-go and that's OK. It wasn't a big deal but would have been nice to have it on pfSense but I'll see what other devices I have that I could install NUT on.
N

openvpn client import can't import tls-crypt info

• • Nan0tEch

1

0
Votes

1
Posts

381
Views

No one has replied
B

OpenVPN/Freeradius issue

• • bluerains

1

0
Votes

1
Posts

361
Views

No one has replied
M

Suricata does not start the interface

• • mssca

6

0
Votes

6
Posts

572
Views

B

@fox95 said in Suricata does not start the interface:

but what does work, is deleting the interface each time you want to make a change to the value because if you don't whatever new value you enter makes no difference. this was the original posters best advice.

You should not have to delete the interface. I suspect what is actually happening is the stale PID file is preventing Suricata from starting with the new stream memcap value.

Each time Suricata tries to start, the daemon creates a PID file in /var/run/ on pfSense. But due to the stream memcap error, the startup of the daemon is aborted and it fails to clean up after itself (leaving the now "stale" PID file). Simply go delete that file and it should start fine (once you get it happy with the stream memcap value).

Notice the original error the OP posted about:
24/11/2019 -- 12:08:14 - <Error> -- [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file '/var/run/suricata_bce11963.pid' exists but appears stale. Make sure Suricata is not running and then remove /var/run/suricata_bce11963.pid. Aborting!
It is complaining about the leftover PID file. Simply deleting that referenced file will let it start. The reason deleting the interface appears to work is that each time an interface is created, a new UUID is also created. So that 11963 number that is part of the file name will change when a new interface is created, and therefore the daemon will not detect an "existing" file matching the new UUID.
S

Unable to get available and installed packages through web UI (pfSense+ 22.05 AMD64)

• • sniff122

4

0
Votes

4
Posts

604
Views

S

and then its just suddenly worked, typical technology. Thanks for the info!
F

Package "System_Patches" - needed for Updates/Upgrade in virtual environment?

• • FGlaser

2

0
Votes

2
Posts

647
Views

P

Yes, system patches is for seldom issued bug fixes between releases. But it doesn't cost you anything to install, and will be there should you need it.
T

PHP Error openvpn-client-export sice update to pfSense 2.7

• • Techniker_ctr

3

0
Votes

3
Posts

571
Views

T

@bmeeks

Thanks, I opend a corresponding Ticket

https://redmine.pfsense.org/issues/13570
J

This topic is deleted!

• • jameshleo

1

0
Votes

1
Posts

4
Views

No one has replied
J

This topic is deleted!

• • jonemarsh12

1

0
Votes

1
Posts

11
Views

No one has replied
N

log alert

• • Norvik IT

10

0
Votes

10
Posts

704
Views

G

@norvik-it

Ah, ok, nice example of taking care of a sick person with a shotgun.

I use pfBlockerng-devel with dnsbl myself. It's web server doesn't "stop" like that every minute.
The PID is here (according to the info found in the pfBlockerng-devel lighty webserver config file here /var/unbound/pfb_dnsbl_lighty.conf ) : /var/run/dnsbl.pid

The process number is in that file : does it really stops every minute ?

All the others : SquidGuard, ntopng iperf ClamAV ICAP are part of the 'do not belong on a firewall anyway (my opinion).

I've installed this 'Service Watchdog' package and added a task :

d9a1111e-b619-4028-9580-7a90f6642019-image.png

Unselecting the notification box will stop sending you mails.
The issue is now a bit solved.

Next step : check if the service is really stopped.
And if so, why / by who / what reasons ?!

Example :
[22.05-RELEASE][admin@pfSense.xxxxx.net]/root: cat /var/run/dnsbl.pid 4622 [22.05-RELEASE][admin@pfSense.xxxxx.net]/root: ps ax | grep '4622' 4622 - S 0:00.02 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.conf 35843 1 S+ 0:00.00 grep 4622
So the process running.

If all these process are really killed on your system every minute, I can advise you to do one thing :
Remove / disable all these packages.

Or, as stated above, find the reason why they are dying on your pfSense, or are getting killed.
Remove the issue for each of them.

Example : if free RAM gets low, the system will kill processes, this is known as the OOM (Out Of Memory) event. Restarting them in that case is a really bad idea.
L

Alias Match vs Native

• • lohphat

1

0
Votes

1
Posts

410
Views

No one has replied
P

openvpn-client-export - naming openvpn client config

• • PPCM

2

0
Votes

2
Posts

619
Views

V

@ppcm
The export bundle is an self-extracting 7-zip. You can simply open it with the 7-zip FM and rename the .ovpn file.
C

freeradius3 google authenticatior is not working

• • chandrasekhar

1

0
Votes

1
Posts

407
Views

No one has replied
S

ApcUPSD Config

• • Studmuffin1134

2

0
Votes

2
Posts

628
Views

V

@studmuffin1134
Check out the apcupsd manual.

My UPS is connected via USB to pfSense, even it has a network card inside. This works flawlessly.
D

UDP Broadcast Relay

• • djonk

15

2
Votes

15
Posts

2773
Views

M

@gzesku 1.0 is only for dev builds.
N

Auto Config Backup Error

• • n0vajay05

4

1
Votes

4
Posts

661
Views

G

I too have just started seeing this error.
T

Squidguard + Whitelist + regex

• • titus91360

2

0
Votes

2
Posts

2050
Views

C

Hello, I'm answering an old question and asking for a different solution:
The only way to use wildcards in SquidGuard is to use regex ? Isn't there a simpler way ? I ended up using regex like this
(\S*office365\.com)(\/\S*)?|(\S*office\.com)(\/\S*)?
N

System_Patches Package & Recommended Patch

• • newUser2pfSense

9

0
Votes

9
Posts

1062
Views

N

@bingo600 My biggest apprehension was applying a patch to an already patched system and what that could mean or for that matter do to my system.
D

This topic is deleted!

• • dcuadrados

1

0
Votes

1
Posts

7
Views

No one has replied
M

NUT upssched

• • mike81

14

0
Votes

14
Posts

1334
Views

M

I managed to get my config working :)
I thought that I share it here so maybe someone will find it useful.

My UPS Settings:

Services UPS Settings-final-c.png
/usr/local/etc/nut/upssched.conf -rw-r--r-- 1 root wheel 630 Sep 11 21:29 upssched.conf CMDSCRIPT /usr/local/bin/upssched-cmd # Command pipe and lock-file PIPEFN /var/db/nut/upssched.pipe LOCKFN /var/db/nut/upssched.lock # Send alerts immediately on change in line power AT ONBATT * EXECUTE onbatt AT ONLINE * EXECUTE onpower # Send alerts immediately if low battery limit is reached AT LOWBATT * EXECUTE onlowbatt # (Optional) Silence the beeper after 2 minutes AT ONBATT * START-TIMER mute_beeper 120 AT ONLINE * CANCEL-TIMER mute_beeper # Shutdown after 5 minutes on battery (5 * 60 = 300) AT ONBATT * START-TIMER onbatt_shutdown 300 # Cancel timer if power's restored AT ONLINE * CANCEL-TIMER onbatt_shutdown /usr/local/bin/upssched-cmd -r-xr-xr-x 1 root wheel 1411 Sep 11 21:29 upssched-cmd #!/bin/sh # START: User-specific settings # UPS_USERNAME="local-admin" UPS_PASSWORD="some-pass" UPS_LINK="CP1300_UPS@localhost" # END # START: Battery info # STATUS=$( upsc $UPS_LINK ups.status ) CHARGE=$( upsc $UPS_LINK battery.charge ) CHMSG="[$STATUS]:$CHARGE%" # END logger -i -t upssched-cmd Calling upssched-cmd $1 case $1 in onbatt) # make sure beeper is enabled upscmd -u ${UPS_USERNAME} -p ${UPS_PASSWORD} ${UPS_LINK} beeper.enable # alert message="$UPS_LINK, $CHMSG - Power outage, on battery" ;; onlowbatt) message="$UPS_LINK, $CHMSG - Power battery low - shutdown now!" ;; onpower) message="$UPS_LINK, $CHMSG - Power restored" ;; mute_beeper) message="(2) minute limit exceeded, muting beeper" upscmd -u ${UPS_USERNAME} -p ${UPS_PASSWORD} ${UPS_LINK} beeper.mute ;; onbatt_shutdown) message="$UPS_LINK, $CHMSG - Triggering shutdown after (5) minutes on battery" /usr/local/sbin/upsmon -c fsd ;; replace_batt) message="Quick self-test indicates battery requires replacement" ;; *) message="Unrecognized command: $1" /usr/bin/logger -i -t upssched-cmd $message exit 1 ;; esac /usr/bin/logger -i -t upssched-cmd $message /usr/local/pkg/nut/nut_email.php $message exit 0
The reason why my original config didn't work (upssched not starting) was caused by wrong AT declarations.

I had to change them from
AT notifytype UPS-name EXECUTE command
to
AT notifytype * EXECUTE command

I'm not sure why I can't use specific UPS name (CP1300_UPS@localhost in my case) as it is recommended approach but otherwise upssched doesn't work.

Regarding the offdelay and ondelay parameters in Extra Arguments to driver field.

Initially I set them to offdelay=120 and ondelay=180 but it wasn't working as expected.
After 120 seconds UPS was turning off but 60 seconds later (180 - 120) it was turning back on again while still being on battery power.

I had to set ondelay=0 to prevent UPS from turning on until line power was restored.
G

two openvpn instances via tcp haproxy

• • gwabber

1

0
Votes

1
Posts

470
Views

No one has replied
C

Prevent packages uninstall & reinstall after restoring a config?

• • carlm

5

0
Votes

5
Posts

3046
Views

S

Still works. 6 years later. 😉

If you're running ZFS though you need different commands to remount /conf:

https://docs.netgate.com/pfsense/en/latest/troubleshooting/single-user-mode.html#single-user-mode-zfs

Steve
E

Application layer package recommendation?

• • enesas

1

0
Votes

1
Posts

466
Views

No one has replied
J

pfsense didn't show packets to install

• • JuniorSa_TI

2

0
Votes

2
Posts

711
Views

G

@juniorsa_ti

The GUI has to be able to connect to the packet server of Netgate to download the list with available packages.
The thing is, it can't.

Most obvious reason : no WAN ('Internet') connection.
Or a broken DNS set up.

The same info is also present on the Dashboard :

c4165dbd-f641-49d9-b1d2-1eb3265270d0-image.png

It's says my system is up to date, and the last check was made .... a couple of minuts ago.
This means that my pfSense can reach Netgate's server to do the check.

See these pages Troubleshooting for more info.
M

Syslog-ng forwarding via TCP not working?

• • mojimba

1

0
Votes

1
Posts

505
Views

No one has replied
C

Custom error html in haproxy - not allowing entries

• • chrisjx

2

0
Votes

2
Posts

789
Views

C

OK. Never mind... user confusion.

I decided I wanted to add some html content. I thought the process would to go to the backend definition and expand the error files section and add my html to a record called 503.

But what we actually have to do is go, first, to the Files tab in the HAProxy screen, add the HTML in a record... then go back and add a reference to the file in the error files section.

I put in some simple html and it rejected that. Apparently it needed some pre-html references. I could not find a good reference about what was needed but I found an example, modified it and this worked:
HTTP/1.0 503 Service Unavailable Cache-Control: no-cache Connection: close Content-Type: text/html <html> <head> <title>Site Down for Maintenance</title> </head> <body style="font-family:Arial,Helvetica,sans-serif;"> <div style="margin: 10 auto; width: 960px;"> <h2>Site Maintenance</h2> </div> <p>The site is down for maintenance. If the condition persists for more than a few hours, please notify the site administrator.</p> <p>Error 503</p> </body> </html>
As you were...
N

BIND DNS, IPv6, DHCPv6-PD and ACL configuration

• • NightlyShark

1

0
Votes

1
Posts

537
Views

No one has replied
F

FreeRADIUS

• • fathead

3

0
Votes

3
Posts

908
Views

F

eap_tls: (TLS) Alert read:fatal:internal error
Debug: (5) eap_tls: (TLS) Server : Need to read more data: error
ERROR: (5) eap_tls: (TLS) Failed reading from OpenSSL: /var/jenkins/workspace/pfSense-img-build/BUILD_NODE/amd64-ce/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/sources/FreeBSD-src-RELENG_2_6_0/crypto/openssl/ssl/record/rec_layer_s3.c[1544]:error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
Debug: (5) eap_tls: (TLS) In Handshake Phase
Debug: (5) eap_tls: (TLS) Application data.
ERROR: (5) eap_tls: (TLS) Cannot continue, as the peer is misbehaving.
ERROR: (5) eap_tls: [eaptls process] = fail
ERROR: (5) eap: Failed continuing EAP TLS (13) session. EAP sub-module failed

Error: /usr/local/etc/raddb/mods-enabled/eap[3]: Failed to link to module 'rlm_tls-config': Cannot open "/usr/local/lib/freeradius-3.0.25/rlm_tls-config.so"

how to wpa2&3 tls384?

File does not exist? rlm_tls-config.so
C

HAProxy broke after update to pfs 22.05

• • chrisjx

2

0
Votes

2
Posts

1162
Views

C

OK. I discovered that the errorfile 503

errorfile 503 /var/etc/haproxy_test/errorfile_myhome.net_503_MAINTENANCE

was the problem. It had a custom html section that obviously had a problem with something in haproxt or 22.05.

I deleted the entry and we're back.
S

Install Wireguard and OpenVPN?

• • spyder0552

3

0
Votes

3
Posts

835
Views

J

@spyder0552 said in Install Wireguard and OpenVPN?:

Super simple one for you all.
Is it possible to install and run Wireguard on a device that already has OpenVPN all setup and running?

I really want to try Wireguard, however, I don't have the resources to setup a standalone test device so I need to use my production router...and I dont want to break anything.

I assume it is just fine...but wanted to ask the group.

Thanks Everyone!!

It's fine. One has nothing to do with the other.
I have both running on more than one pfSense.
Just make sure you don't use the same IP's between the two.
F

Speedtest http issue

• • fireodo

1

0
Votes

1
Posts

576
Views

No one has replied
J

Package list not working

• • jorgyate

4

0
Votes

4
Posts

917
Views

V

@jorgyate
The recent is only one which is supported. If you're on CE that is 2.6.0.
E

How can I change the config file haproxy.cfg manually ? Please Help me

• • EL 0

1

0
Votes

1
Posts

530
Views

No one has replied
E

How to me configuration haproxy for redis cluster with autentification?

• • EL 0

1

0
Votes

1
Posts

593
Views

No one has replied
A

Softflowd не отправляет данные в Nfsen

• • airoman

1

0
Votes

1
Posts

644
Views

No one has replied
L

Squid Proxy Server Crashing System

• • LPD7

1

0
Votes

1
Posts

558
Views

No one has replied
F

Edit NUT config files?

• • furom

6

0
Votes

6
Posts

954
Views

D

@furom Most welcome
J

Squidguard and loopback questions

• • JonathanLee

1

0
Votes

1
Posts

584
Views

No one has replied
E

This topic is deleted!

• • Easy docs

1

0
Votes

1
Posts

4
Views

No one has replied

5 / 227

This topic is deleted!

This topic is deleted!

This topic is deleted!

This topic is deleted!