Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    A
    Docker image for squid 7.3 and above https://hub.docker.com/r/fredbcode/squid If pfsense does not push the update.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    DARAD
    Hello team, I have a Netgate 8200 running 24.11-RELEASE (amd64) with Suricata 7.0.8_5 package installed. Suricata doesn't seem to start. It loops to red once I press the Play button on the interface. It leaves no logs in the System logs, it leaves no logs in suricata.log at /var/log/suricata/suricata_ovpns933787/suricata.log I tried launching it manually: # /usr/local/bin/suricata -V or # /usr/local/bin/suricata -c /usr/local/etc/suricata/suricata_33787_ovpns9/suricata.yaml -i suricata_ovpns933787 and I get this output ld-elf.so.1: /usr/local/bin/suricata: Undefined symbol "__strlcpy_chk@FBSD_1.8" Thanks in advance, Dara
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    573 Topics
    3k Posts
    dennypageD
    @kabeda If memory serves, that old version of ntopng did not run as user ntopng, but as user nobody. There are lots of problems in that old version. Anyway, check the ownership and permissions of /var/db/ntopng and make sure it matches the user that ntopng runs as. You may need to set ownership of the entire hierarchy. Example: /usr/sbin/chown -R nobody:nobody /var/db/ntopng However, the better choice would be to upgrade to a more recent version.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    tinfoilmattT
    @vicking said in No blocks on IP: Is it a bad idea to have the action set to deny both instead of inbound only? Question is squarely for admin. Per the infoblock which explains, in part, the "Deny Inbound", "Deny Outbound", and "Deny Both" actions: 'Deny' Rules: 'Deny' rules create high priority 'block' or 'reject' rules on the stated interfaces. They don't change the 'pass' rules on other interfaces. Typical uses of 'Deny' rules are: Deny Both - blocks all traffic in both directions, if the source or destination IP is in the block list Deny Inbound/Deny Outbound - blocks all traffic in one direction unless it is part of a session started by traffic sent in the other direction. Does not affect traffic in the other direction. One way 'Deny' rules can be used to selectively block unsolicited incoming (new session) packets in one direction, while still allowing deliberate outgoing sessions to be created in the other direction. In other words: When set to "Deny Inbound", incoming connection requests from WAN hosts are blocked and therefore no state will be created. However a LAN host can still establish state to an otherwise listed IP. If set to "Deny Outbound", outgoing connection requests from LAN hosts are blocked and therefore no state will be created. However an incoming connection request from an otherwise listed IP to an 'open' WAN port can still establish state. If set to "Deny Both", both incoming connection requests and outbound connections requests are blocked and therefore no state will be created regardless of connection direction.
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    102 Topics
    3k Posts
    C
    @dennypage Nicely done sir!
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    503 Topics
    3k Posts
    M
    I am using the DNS-Update method I have to use a DNS-Sleep of 5 minutes to let the letsencrypt txt dns record update propagate. During this 5 minutes the acme-webgui times out. when the acme-webgui times out the Action list is NOT executed. How can I solve this ? Would it maybe be an idea to let the acme.sh script execute the actions in the action list as a post-hook instead of the web-gui? Or maybe add an option to add post-hooks in the webUI ?
  • Discussions about the FRR Dynamic Routing package on pfSense

    296 Topics
    1k Posts
    C
    This one has been tricky still not sure what to try. Any ideas?
  • Discussions about the Tailscale package

    93 Topics
    654 Posts
    C
    @luckman212, Thanks for your suggestion. I will check what I have in /usr/local/pkg/tailscale/state, and also the RAM disk settings others have brought up. I could learn more about where Tailscale and pfSense store system files. If I find anything worth sharing, I will let you know.
  • Discussions about WireGuard

    715 Topics
    4k Posts
    patient0P
    @andresbraga if you still have the firewall rules as you posted, then I don't know why from the laptop you can't ping the pfSense Wireguard address 10.10.6.1 nor the pfSense gateway 10.10.1.1 What is the routing table of the laptop. And I would run a packet capture on pfSense and check what you see if you run the ping to 10.10.1.1 or 10.10.6.1.
  • How to configure the auto detect squid proxy?

    Locked
    7
    0 Votes
    7 Posts
    7k Views
    S
    my wpad file looks like that as i don't want proxy for local and vpn servers maybe this can help you function FindProxyForURL(url, host) { // If IP address is internal or hostname resolves to internal IP, send direct.        var resolved_ip = dnsResolve(host);        if (isInNet(resolved_ip, "10.0.0.0", "255.0.0.0") ||                isInNet(resolved_ip, "172.16.0.0",  "255.240.0.0") ||                isInNet(resolved_ip, "192.168.0.0", "255.255.0.0") ||                isInNet(resolved_ip, "127.0.0.0", "255.0.0.0"))                return "DIRECT";        return "PROXY proxy.domain.lan:3128; DIRECT"; } maybe you could also check the webserver logs to see if your hosts grab the wpad file
  • Snort - How to Supress priority "3" events

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    M
    Well, I am faced with the same problem. Therefore I dont dare to activate the blocking feature in pfsense snort. The only thing you can do is to go through ALL the rules an activate only those which are relevant to your network (i.e. disable rules for INFO, POLICY, and so on). If there are still alerts you have to add them to the suppress list and unblock affected hosts.
  • LCDproc problem. HD44780 in LPT

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • (imspector-dev) Logging Facebook Chats to meet New Gov't Compliance regs?

    Locked
    11
    0 Votes
    11 Posts
    5k Views
    N
    @Metu69salemi: I think, that those use some kind of man-in-the-middle attack by using their own ssl-certificate. But not sure at all Yep. They MITM the traffic, which requires a trusted CA cert to be installed on the machines you want to capture data from.
  • Two Minor GUI related bugs in Squidguard.1.3_1 pkg v.1.9.1

    Locked
    1
    0 Votes
    1 Posts
    937 Views
    No one has replied
  • SqudGuard - Individual logging option not working

    Locked
    1
    0 Votes
    1 Posts
    899 Views
    No one has replied
  • Help mail report

    Locked
    4
    0 Votes
    4 Posts
    1k Views
    R
    hello ptt, I did but doesnt work.. :( I dont know where is the wrong… thanksss [image: alert.png] [image: alert.png_thumb]
  • [SOLVED] Snort not starting after removal of Nmap

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • SIP preprocessor configuration (snort 2.9.2.3 pkg v. 2.5.1)

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Update to stunnel 4.54

    Locked
    1
    0 Votes
    1 Posts
    819 Views
    No one has replied
  • Help Installation Sarg

    Locked
    4
    0 Votes
    4 Posts
    1k Views
    R
    hello to everybody! i found solution…just reboot pfsense  :) thanks to everybody and in particular to marcellc
  • Squid install gone wrong?

    Locked
    11
    0 Votes
    11 Posts
    3k Views
    ?
    @extide: honestly you are probably best off doing a fresh install and re-loading your config. I got my box into a state once where the filesystem got messed up and even a factory reset did not fix it. In that situation the best move is probably just to do a clean install from ISO, and then apply your config. i actually ended up doing a fresh install before a reply was made.  i had the .iso i used inside the case of the computer and pfsense installed in 10 minutes (maybe less, i stepped away after the prompts).  i wanted to do a restore to see how well the backup config files worked and they worked well….worked as designed. i was a little disappointed that i didn't uncheck the box to save rrd graph info, but that wasnt a huge deal. however, i am still glad i got the info from marcelloc incase a package install doesnt go as planned, in the future.
  • - help - proxy filter -

    Locked
    5
    0 Votes
    5 Posts
    2k Views
    R
    Thanks marcelloc, but i did what u suggestion and I had same problem so after I checked better, I disabled (NOT TO ALLOW IP ADDRESS IN URL) and now I can watch video.  :) byee
  • Is pfsense meant to help with installing snort?

    Locked
    4
    0 Votes
    4 Posts
    1k Views
    M
    @cmb: Installing Snort from the packages adds the package via pkg_add, or PBI if 2.1, and has a GUI to set it up and manage. Thanks for your response. From a human-factors standpoint, it would be better to use a more explicit button on that page and move it into the leftmost column under the name of the package. The link attached to the name is a "garden path" trap:  it sets up expectations that it doesn't fulfill.  Since the person on that page might not have set up any rules at that point, the cryptic, monochromatic "+" button over on the right side is hard to even notice, never mind interpret, especially next to the eye-attracting column in white reversed out of what looks like #CC0000 red. Imagine how different the effect would be even just changing that description to black-on-white and reversing the button out of red instead. Generally speaking, it's a bad idea to use color where it can mislead.  There's no reason for the "description" column to be emphasised (the same righthand column is reversed out of red on other pages, too, with the same lack of meaning).  Color should only be used where it can't be misinterpreted (e.g., the menu bar, the page title) or where it focuses attention on something significant.  Because of how many people can't perceive color at the usual level of accuracy, the choice of a specific color should never be used to encode meaning (not that that's being done here). It would also be better to have the left column alphabetised.  Right now it's almost alphabetised, which sets up another incorrect expectation. Even the choice of greyscale on the packages page is hard to interpret.  The darker grey in the not-selected tab is "stronger" than the lighter grey, and therefore appears to be selected.  The standard for selected vs not-selected is to lower the contrast on the not-selected tab.  So both tabs should have the same background, but the text on the unselected tab should have a lower contrast with the background, in this case the grey of the es.
  • Snort 2.9.2.3 pkg v. 2.5.1 - 'ssl_state' error - unable to start

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    T
    I have exactly the same problem - did you find a solution to this?
  • LCDProc and IPSec

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    G
    Keep in mind LCDproc is almost a year old, and the support was made by an user, not from internal/dev personal.
  • Freeswitch and X100P PCI Card

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    L
    http://www.hurdman.net/mirror/voip-info/tiki-index8ca4e3b6ac72bf72669a823dd6f99495.html?page=FreeBSD+zaptel x100 card is more trouble than it's worth especially if you want caller id etc far better with a tdm400 which will go straight away, is reliable and supports caller id etc
  • Notes added to 'things than can be synced' /pfsync?

    Locked
    1
    0 Votes
    1 Posts
    805 Views
    No one has replied
  • HOW TO: pfSense as a transparent IPS

    Locked
    1
    0 Votes
    1 Posts
    5k Views
    No one has replied
  • Squidguard redirect info question

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    N
    This could help you: https://github.com/bsdperimeter/pfsense-packages/blob/master/config/squidGuard/sgerror.php This part displayes an IE error page: # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # IE displayed self-page, if them size > 1024 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ function get_error_page($er_code_id, $err_msg='') {         global $err_code;         global $cl;         global $g;         global $config;         $str = Array();         header("HTTP/1.1 " . $err_code[$er_code_id]);         $str[] = '';         $str[] = ''; if ($config['installedpackages']['squidguarddefault']['config'][0]['deniedmessage']) { $str[] = " ### {$config['installedpackages']['squidguarddefault']['config'][0]['deniedmessage']}: {$err_code[$er_code_id]} "; } else { $str[] = " ### Request denied by {$g['product_name']} proxy: {$err_code[$er_code_id]} "; }         if ($err_msg) $str[] = " **Reason:** $err_msg";         $str[] = ' * * * ';         if ($cl['a']) $str[] = " **Client address:** {$cl['a']} ";         if ($cl['n']) $str[] = " **Client name:** {$cl['n']} ";         if ($cl['i']) $str[] = " **Client user:** {$cl['i']} ";         if ($cl['s']) $str[] = " **Client group:** {$cl['s']} ";         if ($cl['t']) $str[] = " **Target group:** {$cl['t']} ";         if ($cl['u']) $str[] = " **URL:** {$cl['u']} ";         $str[] = ' * * * ';         $str[] = "";         $str[] = "";         return implode("\n", $str); } You can replce the part above with your page. Install squidguard, modify this file (sgerror.php) and re-save and re-apply squidguard. Redirect mode for me is: int error page (enter error message) Redirect is for me "Your are not allowed to watch the following URL" I am using squid in transparent mode - but it is working with int error page - even if the description says it's not possible. My custom page looks like the attached. [image: SquidGuard.jpg] [image: SquidGuard.jpg_thumb]
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.