1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    I
    @andrew_cb said in haproxy 0.63_2 weird behavior, edits not working: @iSagen @TheCyborgWeasel The issue is likely the same as in https://forum.netgate.com/topic/178348/haproxy-backend-port-changes-are-not-applied/ Try adding load-server-state-from-file none to the Advanced Settings > Backend pass thru section of each backend. Great! I will do this.

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB
    @NRgia said in Suricata on Pfsense: @bmeeks Thank you for what you did for Snort or Suricata. I'm not sure what you want me to do on Redmine, due to is a bug tracker. My question is for Product Management, which I will ask it here to be public: What is the plan for these 2 packages, Suricata and Snort? Thank you Yes, Redmine is for both bug reports and feature requests. Asking for the Suricata binary to be updated to the latest 7.0.11 version from upstream is a legitimate Redmine request. I would suggest simply asking for the binary version update instead of asking about future Netgate strategy (such as the support plans for the packages). Strategy discussions typically don't get very far because they deal with proprietary information or plans that a company may not want to publicly discuss. Redmine is where the Netgate developer team tracks all the code changes they make for pfSense. They will see Redmine reports much quicker than a forum post.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    dennypageD
    @Leon-Straathof Data retention settings are handled inside of ntopng. Documentation here. Pay attention to the RRD note. Also, if you've turned on some of the slice and dice time series information (is off by default), I'd suggest turning them back off. These balloon the storage requirements and are of little actual use.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    GertjanG
    @jeremyc311 said in pfBlockerNG-devel 3.2.8 service pfb_dnsbl don't start: I’m surprised to see in my logs only one blocked IP, which is related to my TrueNAS I'll decode this one : @jeremyc311 said in pfBlockerNG-devel 3.2.8 service pfb_dnsbl don't start: Aug 5 09:01:14,1770008712,bxe1,LAN,block,4,17,UDP,192.168.2.13,116.147.64.181,51765,51413,out,Unk,pfB_PRI1_v4,116.146.0.0/15,ET_Block_v4,Unknown,truenasr740,null,+ Traffic, coming into LAN, from a LAN device (192.168.2.13 = your TrueNAS) going to a Chinise ( 116.147.64.181 ) Brazilian ( 177.72.195.114 - = next line ) was blocked by the "pfB_PRI1_v4" list. That's probably good thing ? ( ! ). Up to you to discover why your NAS should initiate connections to these countries. A NAS can go outside for maintenance purposes, for example to look for updates of it's system. These could be located anywhere of course. The GeoIP IP created a rule for you. How and where do you use that this rule ?

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    495 Topics
    3k Posts
    J
    @MarvinFS said in updating to acme 1.0 breaks system beyond repair: need to restore from backup: it was cleanly installed not long ago after release of 2.8.0. installed or upgraded? @MarvinFS said in updating to acme 1.0 breaks system beyond repair: need to restore from backup: can't use netinstall as new installer doesn't want to connect to my pppoe during setup for unknown reason - so I can't use it, but it works just perfectly fine in GUI) more details here would be good. @MarvinFS said in updating to acme 1.0 breaks system beyond repair: need to restore from backup: I've had zenarmor manually installed and crowdsec. hope your foot is OK

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1

  • Discussions about the Tailscale package

    90 Topics
    595 Posts
    E
    Updated CE 2.7.2 to 1.86.2_1 Changelog pkg add -f https://pkg.freebsd.org/FreeBSD:14:amd64/latest/All/tailscale-1.86.2_1.pkg Freshports

  • Discussions about WireGuard

    693 Topics
    4k Posts
    lvrmscL
    Since my upgrade to 25.07-RELEASE (amd64) built on Tue Jul 22 22:24:00 CEST 2025 FreeBSD 15.0-CURRENT, on one end of my most important tunnel, the tunnel still works fine, but the pfSense GUI keeps reporting the service as stopped. I had to remove its monitoring from the Service Watchdog which was also trying to start it, without success. Yet the trafic flows correctly. I'm holding off upgrading my other boxes. Is there something I could do to help diagnose?
Log in to post
Load new posts
  • K

    Stunnel removed with 2.3 ?

    Locked
    14
    0 Votes
    14 Posts
    8k Views
    valnarV
    Hey guys.  Sorry to revive a thread but I figured the important people are all here. I was wondering if someone could help with the stunnel package?  Here's the problem we're having in the latest version. https://forum.pfsense.org/index.php?topic=142463 It doesn't seem to be running on a reboot, so it's probably just missing an entry somewhere to start it?  I assume it would be easy for a Linux/BSD guy to fix, but alas that's not me. Thank you!
  • B

    Available packages source/config 2.4.2

    1
    0 Votes
    1 Posts
    352 Views
    No one has replied
  • M

    Managed Switch Configuration with Avahi

    8
    0 Votes
    8 Posts
    2k Views
    M
    I am about to give up on the Avahi package. After uninstalling it and waiting for a day, I reinstalled the package and then my hardwired desktop on subnet A was able to discover and manage/cast to the Chromecast devices on subnet B.  Then a day later, with no changes, the desktop can no longer see the Chromecast devices. The only thing that would have changed is that unbound was restarted by pfBlockerNG DNSBL over night. I uninstalled the Avahi package and will try again one more time.
  • mudmanc4M

    Quagga update to 1.2.3 fyi

    5
    0 Votes
    5 Posts
    987 Views
    D
    FRR found and fixed the issues last year.  After discussion with our security experts when we ran across these issues we decided to not issue a CVE
  • S

    BIND 9.12 / bind-pfsense-9.11.2 RNDC port breaking Unbound

    4
    0 Votes
    4 Posts
    1k Views
    S
    @johnpoz: if your goal is to just strip out netflix AAAA you can do that much easier with a python script you can get running in unbound.. https://forum.pfsense.org/index.php?topic=134352.0 Netflix and HE.net tunnel fixed using Unbound python module That is… not what I would call "much easier", given how much hand-hacking is required.  The nice feature of the DNS method is that it's all standard packages, entirely controlled via the webconfigurator, using built-in features (Unbound's domain overrides and BIND's AAAA-stripping).  The only tweaking by hand that I've done is to work around what strikes me as a package misconfiguration, in that neither resolver can be told to listen on a different port for remote controls.  The fact that Unbound's configuration includes the defaults at the end rather than the beginning seems to me to be a bug, but I don't want to have that fight. And in fact, I bet that somebody really good at BIND configs could accomplish the same thing using only named, no script fiddling needed, and turning off Unbound entirely.  (I am not that person.  I've spent too much of my life being pissed off at BIND.) But it's good that there are multiple ways to solve Netflix and other organizations' stupidity!  The people who love getting their hands into scripts will prefer the method you linked.  I was that person when I was younger, but I don't want that kind of thing on my homelab anymore.  :-)  I do like that Unbound can use python that way now. @Napsterbater: Unrelated, safe to ignore. pfSense/kernel does not currently support TCP Fast Open, which is all that warning is telling you. Yeah, I just this morning found a discussion on a mailing list describing how ISC's configuration on this feature is really, really braindead.  It's apparently turned on/off by what the kernel on the build machine can do, and there's no way to control it other than editing the generated header file, e.g., post-config sed script.  Anything at runtime not matching what the build machine used ends up reported as "unexpected error". Come to think of it, stuff like this is why I stopped using BIND…  auuugh I drank heavily to purge the memories of those years now it's all coming back noooo
  • slkamathS

    PfSense 2.4.2-RELEASE-p1(amd64) Package Manager available package is unavailable

    4
    0 Votes
    4 Posts
    963 Views
    GertjanG
    @slkamath: I tried running the below command, after that package manager is not showing. echo 'dnsthingy:{url: "https://storage.googleapis.com/downloads.dnsthingy.com/pfsense/pkg/'uname -m'",enabled: yes}' > /usr/local/etc/pkg/repos/dnsthingy.conf I tried this before upgrade and tried after upgrade to 2.4.2-RELEASE-p1. No luck. SO i think problem with the command. You are poking files into /usr/local/etc/pkg/repos … Something coming from "googleapis.com" .... "dnsthingy"  :o At least I'm sure now something isn't working well.
  • E

    BIND: XMLRPC Sync Config

    1
    0 Votes
    1 Posts
    676 Views
    No one has replied
  • S

    BIND gives ‘serverfail’ looking up internal hosts for OpenVPN clients

    3
    0 Votes
    3 Posts
    544 Views
    johnpozJ
    @        IN NS  10.15.1.1. @        IN A  10.15.1.1 Sorry but pointing NS to IP address not valid… Nor is that a valid SOA.. Both of which would be a FQDN and then sure an A record for that name pointing to the IP..
  • K

    Dansguardian won't restart

    1
    0 Votes
    1 Posts
    390 Views
    No one has replied
  • T

    Can not access package list any longer

    5
    0 Votes
    5 Posts
    711 Views
    DerelictD
    Install 2.4.2_1 and restore your configuration.
  • A

    AutoConfigBackup Failing

    2
    0 Votes
    2 Posts
    910 Views
    jimpJ
    Contact the support team at https://customercare.netgate.com and someone can help you track that down. Unfortunately that one is a bit generic so it's hard to say. It looks like some kind of connectivity or DNS issue from the firewall itself. Though if you can install the package it should have good working connectivity to all of the pfSense servers. First, make sure that you can check for updates and that pfSense is fully up-to-date as well.
  • S

    Mail Reports not Sending

    4
    0 Votes
    4 Posts
    1k Views
    G
    Also try NOT attaching the system log. I have had problems with the system log containing stuff the parser does not like and the script fails. – Genghes
  • D

    FreeRADIUS 3.x package problem with MySQL (not started)

    6
    0 Votes
    6 Posts
    2k Views
    jimpJ
    This has been fixed now. I was finally able to reproduce the original issue.
  • N

    Installing a console screen saver

    5
    0 Votes
    5 Posts
    1k Views
    W
    I'd also like to know how to configure this on an amd64 setup. Is it a simple matter of copying over the relevant .ko files into /boot/kernel and configuring loader.conf? I don't need 'much' in the way of video features, just blank the screen after a timeout, and wake it when there's local keyboard activity.  Don't need resolution control, hardware acceleration or any of that.
  • G

    [Solved]WPAD settings for 2nd Interface

    3
    0 Votes
    3 Posts
    574 Views
    G
    thanks -flo- it worked.  :)
  • P

    Can we run Squid both as a proxy and as a reverse proxy ?

    1
    0 Votes
    1 Posts
    352 Views
    No one has replied
  • V

    FreeRadius secuirty…trying to understand?

    5
    0 Votes
    5 Posts
    772 Views
    johnpozJ
    Well there you go then.. He has everything he needs to run guest wifi and vlans..
  • A

    Failed to install new pkg

    2
    0 Votes
    2 Posts
    307 Views
    GertjanG
    Hi, What about upgrading your pfSense first ?
  • M

    Snort + barnyard2: full packet capture missing

    10
    0 Votes
    10 Posts
    1k Views
    bmeeksB
    @MichaelB: Upgraded to the latest Snort version. Now it seems like the full_syslog_full is working, but ONLY if you send it to a remote syslog server. So you can't send full events to a local syslog. I just modified my grok rules to be able to catch syslog events forwarded from the local system to a remote syslog (via status => system logs), but that format is different when you send them directly from snort to a remote syslog. I think it should work, I'll modify the grok rules later today. However, to improve consistency with other logs forwarded via the system, perhaps it is a good idea to also allow "local full syslog complete" . In other words, now I have: output log_syslog_full: sensor_name snort.WAN, server 192.168.2.2, protocol udp, port 514, operation_mode complete, payload_encoding hex, log_facility LOG_USER, log_priority LOG_INFO Which gives a different format on my remote syslog server then when using the following in combination with remote logging via the status => system logs setting: output log_syslog_full: sensor_name snort.WAN, operation_mode complete, payload_encoding hex, log_facility LOG_USER, log_priority LOG_INFO Kr, Michael I did in fact code it so that full packet capture only works to a remote syslog server.  It is not a good idea to fill up your local firewall system log with full packet captures, so I elected to not make that available. Bill
  • K

    Snort OpenAppID RULES Detectors

    7
    0 Votes
    7 Posts
    2k Views
    K
    Hi bmeeks I have checked my settings and I do not have the RamDisk setting on. As I am new to pfSense can you list the steps to check? So far I have uninstalled Snort and them installed again keeping my original settings. There may be something that I have checked that is interfering with the download. Not sure what it is through.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.