1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    H
    We installed haproxy on Netgate 8200 device 25.07.1-RELEASE (amd64) installed acme certificates and get certificate from letsencrypt, everything ok. checked ssl offload in frontend and selected the acme generated certificate under SSL Offloading. result after Apply Changes: Errors found while starting haproxy [NOTICE] (72045) : haproxy version is 2.9.14-7c591d5 [NOTICE] (72045) : path to executable is /usr/local/sbin/haproxy [ALERT] (72045) : config : Couldn't open the ca-file '/var/etc/haproxy_test/clientca_WAN_117.pem' (No such file or directory). [ALERT] (72045) : config : parsing [/var/etc/haproxy_test/haproxy.cfg:15] : 'bind x.x.x.x:443' in section 'frontend' : 'ca-file' : unable to load /var/etc/haproxy_test/clientca_WAN_117.pem [ALERT] (72045) : config : Error(s) found in configuration file : /var/etc/haproxy_test/haproxy.cfg [ALERT] (72045) : config : Fatal errors found in configuration. also package _devel has the same issue. on other boxes where haproxy was configured on 24.11 - upgraded to 25.07.1 its working. BUG ?? so what can we do now -bolded text we need this function. thank you all in advance

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    B
    @Greyhat I think it's useful to work with what we've got and figure something out for the (i hope) edge cases later. So for the JSON I figured you can actually use an existing suricata integration by co-opting their pipelines.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    573 Topics
    3k Posts
    dennypageD
    @kabeda If memory serves, that old version of ntopng did not run as user ntopng, but as user nobody. There are lots of problems in that old version. Anyway, check the ownership and permissions of /var/db/ntopng and make sure it matches the user that ntopng runs as. You may need to set ownership of the entire hierarchy. Example: /usr/sbin/chown -R nobody:nobody /var/db/ntopng However, the better choice would be to upgrade to a more recent version.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    tinfoilmattT
    @dma_pf Debt collector, or debt relief service?

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    102 Topics
    3k Posts
    dennypageD
    @netboy said in Docker container for nut server?: I am NOT installing docker in pfsense - offcourse this is a big security risk - I agree !!! My apologies. I interpreted your earlier question I think i need to explain what i am asking for. I am fully aware if your netgate router is attached to an UPS you can configure netgate. Let us say you 5 UPS's in your home and you want nut server to read all the UPS's and show me a dasboard about the status of all the UPS's ? - Is there a ready made docker container for client server nut with dashboard functionality? as a request to have something running on pfSense, which is why I responded I believe most people would say that the type of thing you are asking for isn't something you want to run on your firewall. I recommend using a general purpose operating system behind the firewall instead. Mutual misunderstanding I guess. If you want to explore general NUT monitoring, and not something particular to pfSense, I would recommend the NUT Users list as a better place to seek information.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    503 Topics
    3k Posts
    M
    I am using the DNS-Update method I have to use a DNS-Sleep of 5 minutes to let the letsencrypt txt dns record update propagate. During this 5 minutes the acme-webgui times out. when the acme-webgui times out the Action list is NOT executed. How can I solve this ? Would it maybe be an idea to let the acme.sh script execute the actions in the action list as a post-hook instead of the web-gui? Or maybe add an option to add post-hooks in the webUI ?

  • Discussions about the FRR Dynamic Routing package on pfSense

    296 Topics
    1k Posts
    C
    This one has been tricky still not sure what to try. Any ideas?

  • Discussions about the Tailscale package

    92 Topics
    638 Posts
    L
    @Vad-B Interesting indeed! I just tried to fill the Pre-authentication Key with file:/dev/null. I get an crash in pfsense after some time, but when I login again is saved. For me this for after service restarts at least this solves it, including the issue with the routes not being advertised even set in the WebUI. Havent done an full restart of pfsense (yet)

  • Discussions about WireGuard

    712 Topics
    4k Posts
    D
    I feel like I’ve followed every guide there was. I was able to get nordvpn via wireguard on my pfsense but for the life of me I can’t get my own wireguard server working. I can’t even get a handshake. I have all the firewall rules mentioned, the gateway, interfaces. Etc. I got no clue what to do at this point. Can anyone please help? I’ll provide any information required I just don’t even know where to start I’ve tried every YouTube video possible and guide it’s strange. I was able to get nordvpn working but I can’t get my own.
Log in to post
Load new posts
  • N

    Quagga ospfd not starting/stopping on CARP switchover

    3
    0 Votes
    3 Posts
    1k Views
    N
    Very lame  ;D Dunno how I've missed that one… Will do it right away! It says a change is required, but it doesn't say how the change should look like: [image: Untitled.png] [image: Untitled.png_thumb]
  • G

    LDAP Authentication in Packages and in pfSense

    2
    0 Votes
    2 Posts
    802 Views
    G
    No, the settings under System -> User manager is for authentication to the web gui. Packages such as Dansguardian require seperate configuration.
  • L

    Snort + HAVP ….. The following server is down :-(

    3
    0 Votes
    3 Posts
    1k Views
    bmeeksB
    There is a bug in the Snort binary with regards to SSL detection.  That might be what is happening here if the URL is https://.  You can Google some references to the bug by looking for "client HELO after server HELO".  This bug will hopefully be fixed in a later Snort binary release.  For now I recommend suppressing this particular alert. As BBcan17 mentioned, peruse the threads here in the Packages forum for advice on how to tune Snort by suppressing common false positives. Bill
  • BBcan177B

    Suricata and System Logs

    4
    0 Votes
    4 Posts
    5k Views
    bmeeksB
    @BBcan17: @bmeeks: Have performed a "save" operation after disabling the writing to the system log and also tried restarting Suricata?  Look in the suricata.yaml file for the interface and see if syslog output is showing as enabled. Hi Bill, Sorry for sounding the alarm. I was looking at the General Settings tab for System logs which was not enabled. I have now disabled the system logs for Wan and Lan interfaces.  :o I don't recall the logs going to the System.log with the previous Suricata Package. I didn't play with the Suricata settings for awhile now. Here is what is in the yaml file for "syslog" grep -A4 -n "syslog" /usr/pbi/suricata-amd64/etc/suricata/suricata_30898_bce0/suricata.yaml 73:  - syslog: 74-      enabled: no 75-      identity: suricata 76-      facility: auth 77-      level: Info – 225:  - syslog: 226-      enabled: yes 227-      facility: auth 228-      format: "[%i] <%d> – " 229- I can't remember exactly when I enabled that, but it's been there at least since one of the earlier BETA releases.  Suricata has two distinct and different logging paths.  One is for alerts.  Those can go to syslog or not.  The other is for Suricata operations-related stuff like startup, shutdown, etc.  That always goes to the suricata.log file on pfSense, but can optionally go to the system log (syslog) as well if enabled.  That's why there are two different parts of the suricata.yaml file that reference syslog. Bill
  • cyber7C

    SquidGuard - Allow download of EXE only from ONE site?

    4
    0 Votes
    4 Posts
    1k Views
    D
    @cyber7: Thank you dvserg :) Could you tell me, if I have "other" exe files on the site, how I allow global access to the site's exe files? kind regards cyber7 Only Exe? May be allow this site as domain without copy-paste each EXE URL's? Or, of course, you can use Expressions: (..safe.com/files/..exe)
  • P

    Tinydns_down.php - error messages in system log

    27
    0 Votes
    27 Posts
    6k Views
    I
    @wlm2048: See if you have "/var/db/pkgpinghosts", and if so, delete the lines in it that say anything about tinydns, and then delete the "/tmp/tmpHOSTS" file. The latter will be recreated. Thank you, You made my day/week!
  • P

    Unable to retrieve package info from https://packages.pfsense.org.

    3
    0 Votes
    3 Posts
    1k Views
    P
    Are you using IPv6? Absolutely not!
  • D

    Squid + SquidGuard + SSL

    3
    0 Votes
    3 Posts
    1k Views
    D
    Works wonders. Thanks!!
  • M

    Freeradius: the simple noob questions :-)

    13
    0 Votes
    13 Posts
    6k Views
    N
    Hi, I think you can export and import certificates and the CA from SYSTEM –> Cert Manager. Exporting Cert and Key and importing on the other pfsense machine. Or just make a backup of the running pfsense config and import this backup into the other pfsense. Perhaps you have the possibility to just import certificates and not all the other config. Unfortunately I cannot help you any further since I do not have any access to a pfsense machine anymore. My new company does not use pfsense .... :(
  • X

    Widescreen patch problem

    2
    0 Votes
    2 Posts
    898 Views
    KOMK
    LOL check out https://forum.pfsense.org/index.php?topic=77032.0 TL;DR will be there in 2.2.
  • A

    Snort Priority Blocking

    4
    0 Votes
    4 Posts
    2k Views
    A
    Thanks for your assistance bmeeks!
  • C

    Snort unblocks IPs when it shouldn't

    29
    0 Votes
    29 Posts
    8k Views
    BBcan177B
    Hi Mike, If you tune the rules, you shouldn't get too many False Positives (as you said, "probably one every two weeks or so"). With that said, I run Snort with the "Never Clear" setting, and just remove the ones as they come. I like this approach better because if you leave the Blocks alone, you will see a lot of repeat offenders and it will Block faster as its already in the Snort2c table. Snort is not a true-inline IPS so removing IPs will let some packets thru if they weren't already blocked. So tuning Snort is the best approach to managing a good IPS system. What kind of Dynamic IPs are you seeing? I submitted a post to add more Search Lookups to the DNS lookup page which can make it easier to diagnose IP addresses.. See below.. https://forum.pfsense.org/index.php?topic=73406.msg404649#msg404649
  • A

    Problem with Barnyard2

    5
    0 Votes
    5 Posts
    3k Views
    bmeeksB
    @Atlantisman: I am on 2.1.3 i386, it looks like barnyard2 was having a problem with the SCADA rules and at least one other rule set. I took everything back to only VRT rules and barnyard started right up. Thanks. I can investigate the SCADA rules.  Those particular messages in your log post were just warnings, though.  They would not prevent a startup.  It was that fatal error trying to read one of the Emerging Threats Web Server rules that killed it.  The ET rules have had a few errors creep into them lately, and Snort (and now apparently Barnyard2 as well) can choke and refuse to start up if a rule with an error is encountered. Bill
  • S

    Sarg reports broken

    2
    0 Votes
    2 Posts
    666 Views
    S
    found the issue. When the pkg gets re-installed via the system upgrade the conf file does not get restored. You have to go to the web ui of sarg in pfsense and click save and the conf file gets recreated. Heads up team! :)
  • K

    Proxy with Dansguardian & HAVP trouble with Netflix on Android

    3
    0 Votes
    3 Posts
    2k Views
    C
    @KyferEz: I recently used a guilde to setup Squid3, Dansguardian, and HAVP. It's working well, except I am having trouble with it blocking Netflix on Android. I ran into an issue with Netflix not working on Android during one of my many, many iterations of trying to get a stable pfsense+squid+dansguardian config. It may be the same issue that you're having. I think it was related to the flawed dansguardian package that was available via the pfsense webconfigurator. I think it was Marcello's build of the dansguardian binary that fixed it (among other problems). I've gone around and around with pfsense+squid+dansguardian, though so my memory could be faulty on the exact cause/solution, however. At any rate, the setup that seems to give me the best stability so far is: pfsense (I'm currently at 2.1.2, FWIW) Squid3-dev (I'm at 3.3.10 pkg 2.2.2) Dansguardian (I used 2.12.0.3_2 pkg v.0.1.8 and then updated the dansguardian binary with Marcellos' build) These threads have some info: https://forum.pfsense.org/index.php?topic=58442.0 https://forum.pfsense.org/index.php?topic=43786.0 This is my version of the fix, which seems to be somewhat different from some of the others' versions. Note, this is for 64-bit, NOT 32-bit systems: killall dansguardian rm -rf /usr/local/etc/dansguardian ln -s /usr/pbi/dansguardian-amd64/etc/dansguardian /usr/local/etc/dansguardian cd /usr/pbi/dansguardian-amd64/sbin fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/dansguardian /usr/local/etc/rc.d/dansguardian.sh start Read the above threads for more context and for the variation that others have been using, though. Hopefully, this will get you moving again. Unfortunately, I'm unable to give you any more details right now and won't be monitoring the forums for at least several days. I think the fix for you is probably going to be replacing the dansguardian binary with Marcello's version, though. Good luck!
  • X

    Error message on installation and removal of squidguard-squid3

    1
    0 Votes
    1 Posts
    822 Views
    No one has replied
  • A

    FreeRADIUS startup problem

    1
    0 Votes
    1 Posts
    847 Views
    No one has replied
  • B

    SOLVED: Force Google Safesearch

    1
    0 Votes
    1 Posts
    843 Views
    No one has replied
  • bmeeksB

    Suricata 1.4.6 pkg v1.0.1 Update – Release Notes

    30
    0 Votes
    30 Posts
    6k Views
    bmeeksB
    @gscasny: Nice on the 2.0.. Do you know if it's compiled with JSON (libjansson) support? My first private test of 2.0 was not, but I think I can include it in the production release. Bill
  • P

    Disabled snort, now settings are blown away

    11
    0 Votes
    11 Posts
    2k Views
    bmeeksB
    @BBcan17: Thanks Bill we all appreciate the work you do in Maintaining these packages so well ! I just tested in a VM with multiple engines (HTTP_INSPECT for my test).  All the previous settings are now retained when Snort is disabled on an interface.  When you enable it again, the old settings are still there. Note this behavior is different for a DELETE operation.  If you delete a Snort interface on the INTERFACES tab, then all Snort settings belonging to that deleted interface are permanently removed.  It does prompt for a confirmation before deleting the interface, though. Bill
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.