You sir, have my deepest respect.

I shall await your next release in the most humble way possible  ;D

if you add the two acl's with the same acl name, they will be combined. this should produce the wanted result.

Would look like this:
Result would be this for the acl name "MyAclCombined1", (didn't check if below config works..) :
acl        0_MyAclCombined1  hdr(host) -i vhost1.pfsense.local
acl        1_MyAclCombined1  path_beg -i /test/
use_backend      test_http if 0_MyAclCombined1 1_MyAclCombined1
If you want more advanced combinations of acl's however i think you will need to write them in one of the passthrough sections as 'text'.

Thanks jfl…..

pfSense Support is the bomb:

Uninstall all monitors, delete their data directories then reinstall:

Lightsquid: rm -rf /var/lightsquid/
Sarg: rm -rf /usr/local/sarg-reports/
Bandwidthd: rm -rf /usr/local/bandwidthd
Darkstat: Doesn't keep persistent data

To add to Bills comments-

I use Mikrotik switches to mirror my traffic. They are not that expensive.. under a hundred dollars. Depending on how much traffic you are seeing, it should handle quite a bit of traffic. The good thing about this switch is that you can mirror multiple ports on a single switch.

http://routerboard.com/RB260GS

pfSense will monitor all traffic that passes thru the router. But if you want to capture traffic on the Lan, you
need to put a monitoring interface at every point where you want to look at. So if you want to monitor a file server, you need to mirror/span/tap infront of that interface to see it.

You can add a nic to pfSense and send the packets to it and use Snort, or another option is using a program called "Security Onion".

http://blog.securityonion.net/

Hmm, add the pidgin.im and skype.com IP's to the block lists?
Maybe the webservers of those sites aren't strict on the full domain name, so the squidguard is strict and won't recognize the address exactly.

@Xtern:

Hello,

I'm new here. Very cool forum. My problem with Snort is that it shows me this:

Warning:
New settings will not take effect until interface restart.

I did the setup like the guide (sticky above) told me, but I can't get rid of this warning message. It's there after restarting the whole machine, when I restart Snort, when I disable and enable the daemon and so on. Any idea what I'm doing wrong?

Best,
Xtern

Fragged is right.  That's just a "reminder" sort of message to let you know that most changes to Snort interface parameters require a restart of Snort on the interface in order for the new settings to become active.

Bill

I fixed my problem by installing HAVP.  Not ideal, but at least it's working now.

@markn62:

@wagonza:

@markn62 was this problem fixed for you? or is it still an issue?

Not much has changed.  Seems that the package operates very much like it did since the question above was asked.  The only change I noticed was a few more "do not's"  that are important to adhere too for the package to work properly.  I guess it is what it is.

I can't reproduce any of your current issues at all with the package even using all your custom options. Something else must be going on or you have something else as an additional problem. Try saving your whole pfsense configuration and loading that config onto a VM ands testing to give us information to go on. Or even for yourself. The devs are replacing dnsmasq with unbound afterall. If you copy your unbound.conf on your seperate box to your pfsense and only restart the service does it work?

Hi.

Zabbix Proxy and Agent were updated today to 2.2.2.

Could you reinstall proxy package?

Regards.

Thanks for the patch.

Also, both packages were updated today (proxy and agent) to 2.2.2.

Hi,

If your using haproxy-devel package, and you give the acl's the same name they will be combined into 1 condition. I think that will accomplish what you want.?

Result would be this for the acl name "MyAclCombined1", (didn't check if below config works..) :
acl        0_MyAclCombined1  hdr(host) -i vhost1.pfsense.local
acl        1_MyAclCombined1  path_beg -i /test/
use_backend      test_http if 0_MyAclCombined1 1_MyAclCombined1

If you want more advanced combinations of acl's however i think you will need to write them in one of the passthrough sections as 'text'.

Greets
PiBa-NL

@Tikimotel:

Custom options

forwarded_for transparent

That line did it! Thanks alot!

I am using transparent mode hence could never get the loopback to work. Never tried it in standard mode as I have too many devices in the network and not all are configurable.. like TVs, Blu-Ray Players.. etc.

The little script in my first post needs to be updated to change the path to the user directory. As is, the Fetch (downloads) are going into

/etc/cron directory.

Please add

#!/bin/sh

cd /home/USERDIRECTORY (Or where ever you would like the downloads to go to. And also where pfBlocker will lookup.