1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    tinfoilmattT
    @johnpoz said in Please help to configure HAProxy to serve certifficate on internal LAN too: Yeah - what part do you not understand if you always resolve nextcloud.domain.tld so that it hits your haproxy on your pfsense wan IP are you not getting? You have 2 options - use a different domain internally and always go to nextcloud.publicdomain.tld, or use the same domain internally as external and run into the problem of what IP it resolves to.. Change your local domain to say home.arpa or .internal or atleast something different than the public domain your using to point to pfsense wan IP on the public internet. You are shooting yourself in the foot trying to use the same domain externally as internally. There are ways around it, but they complicate the setup. For example you might be able to use views in unbound as one way to work around the problem. You could use only host entries for all your resources. But then again you run into a problem of using the fqdn for this service, now always pointing to your wan IP.. And that is great when you want to access the service haproxy is doing - but if you want to access that resource on some other service that haproxy doesn't handle - like say simple file sharing.. You are going to have problems. Since you clearly do not understand how any of this works - the simple solution is change the local domain you are using so it is not the same as the public domain you want to use to get to your nextcloud. This tone is outrageous directed at somebody who acknowledged right off the rip that English is not their first language. How many languages do you speak, John? And safely assuming it's only one—English of course—take it from a fellow English native that you'd do well to say more with less words. You otherwise were directing OP in the right direction in my opinion.

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    DARAD
    Hello team, I have a Netgate 8200 running 24.11-RELEASE (amd64) with Suricata 7.0.8_5 package installed. Suricata doesn't seem to start. It loops to red once I press the Play button on the interface. It leaves no logs in the System logs, it leaves no logs in suricata.log at /var/log/suricata/suricata_ovpns933787/suricata.log I tried launching it manually: # /usr/local/bin/suricata -V or # /usr/local/bin/suricata -c /usr/local/etc/suricata/suricata_33787_ovpns9/suricata.yaml -i suricata_ovpns933787 and I get this output ld-elf.so.1: /usr/local/bin/suricata: Undefined symbol "__strlcpy_chk@FBSD_1.8" Thanks in advance, Dara

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    573 Topics
    3k Posts
    dennypageD
    @kabeda If memory serves, that old version of ntopng did not run as user ntopng, but as user nobody. There are lots of problems in that old version. Anyway, check the ownership and permissions of /var/db/ntopng and make sure it matches the user that ntopng runs as. You may need to set ownership of the entire hierarchy. Example: /usr/sbin/chown -R nobody:nobody /var/db/ntopng However, the better choice would be to upgrade to a more recent version.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    V
    Ah, I changed the action to deny both and now I also have a wan firewall rule, which I also had on OPNsense. With this wan rule I can see the blocks already coming now! Is it a bad idea to have the action set to deny both instead of inbound only?

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    102 Topics
    3k Posts
    dennypageD
    @fjmp24 said in Notification: UPS ups battery is low: If I remove ignorelb directive, my UPS shuts down after 16 seconds This means your UPS is signaling a low battery. Either your battery is bad, or your UPS is bad. Most likely battery, but you never know. I suggest reaching out to Eaton support.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    503 Topics
    3k Posts
    M
    I am using the DNS-Update method I have to use a DNS-Sleep of 5 minutes to let the letsencrypt txt dns record update propagate. During this 5 minutes the acme-webgui times out. when the acme-webgui times out the Action list is NOT executed. How can I solve this ? Would it maybe be an idea to let the acme.sh script execute the actions in the action list as a post-hook instead of the web-gui? Or maybe add an option to add post-hooks in the webUI ?

  • Discussions about the FRR Dynamic Routing package on pfSense

    296 Topics
    1k Posts
    C
    This one has been tricky still not sure what to try. Any ideas?

  • Discussions about the Tailscale package

    93 Topics
    654 Posts
    C
    @luckman212, Thanks for your suggestion. I will check what I have in /usr/local/pkg/tailscale/state, and also the RAM disk settings others have brought up. I could learn more about where Tailscale and pfSense store system files. If I find anything worth sharing, I will let you know.

  • Discussions about WireGuard

    715 Topics
    4k Posts
    H
    Same issue here, so it's not just you.
Log in to post
Load new posts
  • N

    Help: Add External Cache

    Locked
    1
    0 Votes
    1 Posts
    784 Views
    No one has replied
  • T

    Squid ssl-bump

    Locked
    4
    0 Votes
    4 Posts
    4k Views
    marcellocM
    @Nachtfalke: Further forum user marcelloc is working on a web GUI based ssl-bump feature but he needs some more time and donations. There is a thread on the forum I do not have at the moment. It's here http://forum.pfsense.org/index.php/topic,58368.0.html :)
  • P

    Best way to whitelist Imdb's website from Snort?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    bmeeksB
    @lpallard: Hi, I am having a hard time preventing www.imbd.com from being blocked by Snort. In Snort's blocked list I see: 72.21.203.211 (http_inspect) INVALID STATUS CODE IN HTTP RESPONSE - 04/06-00:54:05 72.21.215.52 (http_inspect) INVALID STATUS CODE IN HTTP RESPONSE - 04/05-02:31:37 I wonder if these errors are serious?  I believe not, and I'd like to prevent Snort from blocking www.imdb.com based on these alerts.  I dont want to add this type of alert  ((http_inspect) INVALID STATUS CODE IN HTTP RESPONSE) to a general whitelist because a malicious website could use it in the future.. SO how can I add an exception for imdb.com ??? The whitelist tab allows only the IP address.  Is it good enough? Thanks This is going to be tricky because I suspect a site like that probably has multiple IP addresses (like a server farm).  If they all resolve to a single IP, then you can create an Alias for the web site and then add that alias to a whitelist.  Do this under Firewall…Aliases.  Then go to the Whitelist tab in Snort and either add that alias to an existing whitelist, or create a new white list containing the alias.  If this is your first whitelist, be sure to leave the defaults in place where it automatically whitelists your WAN IP, gateways and DNS servers. My personal observations of HTTP_INSPECT is that it is entirely too "picky".  I know it is based on the RFC standards and such, but it just seems to complain about too many legitimate web sites.  I have a pretty long list of Suppression Rules for some of these HTTP_INSPECT errors. Bill
  • P

    Whitelist in SquidGuard not working

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    P
    Very good dvserg !  I thought it was "Allow" but "Whitelist" did it! Thanks!
  • C

    Lightsquid Graph 500 Server Error Resolution

    Locked
    10
    0 Votes
    10 Posts
    10k Views
    C
    Please note that the perl package location has changed. Use to update link: pkg_add -rvf ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8-stable/Latest/perl.tbz
  • L

    Samba4 package and extend services with pfsense

    Locked
    9
    0 Votes
    9 Posts
    24k Views
    C
    @Luiz: @churnd: I am very interested in this.  Do you have something I can test, or maybe some brief instructions.  The main thing I'm interested in is providing a Samba4 PDC for my home network. Good morning, who want to experiment with the functionality of Samba4 acting as a member of AD and making authentication transparent to the ad via ntlm, can deploy the package by the script below (via command execution -> Diagnostics: Execute command): fetch -o - -q http://www.mundounix.com.br/~gugabsd/pfsense/teste/samba-teste-amd64.sh | sh This will install Samba4 there and a lot of work … do not worry, after running it, will appear in the option menu Samba4 services and the option to authenticate via ntlm in squid. (to operate, install squid 2 first before running this script) For now, it is 100% functional act as MEMBER, other'm developing, mainly to serve as part of the AD server. ATTENTION BUT, FOR THE LOVE OF GOD!! DO NOT TURN IT IN PRODUCTION ENVIRONMENT, I'm releasing a mere interest and development of opnion guys ... If you need to put this into production yesterday, contact me via consultancy (www.mundounix.com.br) Thanks Thanks for this.  I hope your work keeps up.  I don't have a use for setting up a member yet as I need a PDC, so not running it yet.  Tried it out in a VM & it seemed to install OK.  Didn't get past that since I have no PDC to join.  Keep up the good work.  Thanks.
  • L

    Wpad, squid3 not working

    Locked
    23
    0 Votes
    23 Posts
    12k Views
    L
    pfSense -> DG -> Squid3 now working via DHCP/wpad and assorted rules (NAT rdr squid port to DG, LAN pass to lighttpd serving wpad, LAN pass any to DG, LAN block http and https), with a few issues to resolve. My main hurdle was thinking to make Squid listen on pfSense's box's IP and localhost (previously just pfSense's IP), and make DG's parent proxy IP localhost instead of pfSense box IP. My main issues with DG I'll ask about in the appropriate thread.
  • S

    Missing snort.sh

    Locked
    8
    0 Votes
    8 Posts
    3k Views
    G
    All I can say is: listen to Bill! ;) Glad you solved it.
  • D

    Squid in transparent mode do not forward packets through a bridged interface

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    A
    Yes it does work… with some tweaking... Here's what i did, create bridge between LAN and WAN, assign interface to Bridge, set ip to bridge interface set firewall to bridge interface to any any allow, set ip interface on LAN and WAN to none. Enable bridge to 1 on Advanced/System Tunables. Set default gateway on bridge interface. Set NAT to manual and erase all rules. Sometimes i do loose connectivity to the ip on the bridge interface, if that happens, go to console and reassign ip on the bridge again from there, that fixes the issue. Don't forget to set you default gateway again. Bridge part all set, now install squid and set it to transparent and set your ACL. Now on the stations using squid set the default gateway to be the ip of the bridge interface of PfSense. Now transparent proxy should work, look at the squid access.log and everything should go trough the proxy. In my case i wanted to make sure that if PfSense were to be down or crashed, the users still had a working gateway. So i defined my L3 switch to be the users default gateway, set up RIP on the L3 switch and on PfSense in a way that if PfSense is up and running the default gateway to the switch is PfSense's bridge interface, but in case it goes down or it's offline, the gateway of the switch changes to my router's interface. If you do this make sure that the default gateway on your PfSense bridge interface it's your internet Router and not the L3 switch, or else you will have a loop on the router redirects. Hope this helps, If anyone has a better solution please post.
  • bmeeksB

    New Snort pkg 2.5.5 – Read Before you Update to Understand Changed Defaults

    Locked
    23
    0 Votes
    23 Posts
    7k Views
    K
    Bill, I am going to keep my replies going forward in the topic you linked so everything is together. As you can see in that post there I am having to redo the tests for you.
  • K

    Sqstat realtime doesn't work

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    marcellocM
    fixed today, Just reinstall the package and test again.
  • F

    Building of UTM from snort + havp + Squid Guard + Squid – need help

    Locked
    6
    0 Votes
    6 Posts
    8k Views
    bmeeksB
    @firefox: How do I turn them in a state of logging mode ? For Snort, it's easy.  On the If Settings tab for your Snort interface, uncheck the box that says "Block Offenders".  The default is Unchecked unless you clicked it during configuration.  I don't know about the other packages.  They may not have a "logging only" mode.  Hopefully some other folks more knowledgable of those packages will chime in. Bill
  • N

    Is BandwidthD working on newest release getting an error on boot

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • S

    2.0.3 Release and SNORT/update

    Locked
    17
    0 Votes
    17 Posts
    5k Views
    bmeeksB
    @DigitalDeviant: Snort is not restarting. I figured it had something to do with: Apr 16 12:06:18    kernel: pid 10971 (snort), uid 0: exited on signal 4 OK, had to do a quick reload of my memory for UNIX signals.  Signal 4 seems to mean SIGILL which translates into "Illegal Instruction". There are two common ways to get this.  One is to have the wrong architecture code, and the other is some really bad corruption of a program.  I did find several references to early C++ compilers on FreeBSD producing faulty code when attempting to optimize for Pentium 4 (P4) CPUs, but I hardly think that applies here.  I'm more inclined to think some really incompatible library got sucked in, or the Snort binary or a library it uses got corrupted during installation. At this point I recommend removing Snort using the "X" icon on the Installed Packages tab, and then reinstalling from the Available Packages tab. Bill
  • G

    Do I really need Snort??

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    bmeeksB
    @greenpoise: Hi Bill, Thanks for your response.  After 48 days of struggles, I just went back to my simple router. I wanted to love Pfsense but it just didnt work. It was too unstable. Granted I had the 2.1 version because it is what worked for my hardware (which actually was not fancy at all). For some reason the 2.0 version didnt accept my Drives. But I will give you a brief on how I left it. I would not get any error messages. Internet Traffic would just stop moving. I removed packages and rebooted. I went to bare basics. But nothing. I could stop snort and it would come back up. Sooo. thats how i left things. I found Pfsense to be faster than Untangle..free as opposed to Untangle..but in a production environment, I couldnt achieve reliability, something well needed…Thanks again!!! I really think your chosen hardware may have been the core problem and not pfSense itself.  I've found it to be rock-solid stable.  The fact you mentioned you had to run 2.1 because of your hardware indicates to me you were on or slightly beyond the bleeding edge of new hardware that pfSense supports.  If that is correct, then stability problems would not be unexpected. I run pfSense on SuperMicro hardware.  In my case for home, it's just a simple Atom CPU with 4 GB of RAM and a SATAII hard drive.  My particular SuperMicro board has Realtek on-board NICs, but thankfully they are the older series with better support (albeit not outstanding throughput if I had a super high speed connection, but I don't). So before you totally close the book on pfSense, maybe give it try on firmly supported hardware.  There are several suggestions in the Hardware forum here. Bill
  • D

    Barnyard not starting after Snort rules update

    Locked
    18
    0 Votes
    18 Posts
    8k Views
    bmeeksB
    @digdug3: Some events were listed twice in both the System log and the MySQL database, but they are valid. Just ignore my previous message. Yes, I always use only the Snort Start/Stop button. FYI: Just updated to 2.0.3 and Snort is also installed flawlessly! Think you solved the Barnyard not starting issue. Thanks for all your effort! If you ever need help testing something let me know. My Barnyard2 restart problem also seems to be solved.  At least the last rules update went off fine. I hope that file copy error I found and fixed over the weekend solved the Barnyard2 problem. Bill
  • V

    Mod_security - no rules

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • S

    Snort on LAN interface

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • F

    How to configure HAVP and squid

    Locked
    9
    0 Votes
    9 Posts
    7k Views
    F
    First of all thanks for the help Secondly After the installation of snort or squidguard I did not add any site to the list of blocked Not in snort or squidguard The only thing I can think of is the snort rules But turning off the snort sites were not yet available So I turned off the squidguard and still not yet available I'm not much of it but I Once you install a package The package adds {I guess} system settings that might block access to the Internet That at some point I had no internet access So I used the Recovery on the Subject of the guide I found online I think this guide is aimed at people with more extensive knowledge I think that was missing quite a few steps This is not a problem to find a guide to Each of the packages But not all together :-\ Bummer Regarding the installation guide you prepared Could upload it here?
  • J

    Snort: Another solution to the rule enable/disable update reset problem

    Locked
    21
    0 Votes
    21 Posts
    12k Views
    bmeeksB
    @gogol: Thanks for the clarification. I still had the old directories from the previous (2.5.4) installation and I was looking there. That brought some confusion. I uninstalled snort again, removed old directories and installed it again. You are doing a good job! Yeah, one of the things I added in this latest update was to try and do a better job of "cleaning up" when uninstalling.  Of course for the initial update from 2.5.4, or any earlier version, to 2.5.5, you will potentially have to do some manual clean up.  After that Snort should be a little better cleaning up.  It will leave some directories in the old locations, but they should be empty of files. For 2.0.x pfSense users, the Snort files are still in /usr/local/etc/snort.  But for 2.1 pfSense users, everything now will be in /usr/pbi/snort-{arch}/etc/snort where {arch} is either i386 or amd64, depending on your platform. Bill
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.