1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB

    I saw where the Netgate kernel developer updated the Suricata package in the pfSense 25.07 development branch to work with the new kernel PPPoE driver. But so far as I know that updated package has not been migrated to 2.8 CE.

    Here is the commit into the DEVEL branch: https://github.com/pfsense/FreeBSD-ports/commit/68a06b3a33c690042b61fb4ccfe96f3138e83b72.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    GertjanG

    @AlexK-0 said in Can't receive GeoIP databases updates anymore, banned:

    Days ago, I received from MaxMind an email, notifying me that my country has been banned to receive GeoLite City database updates.

    You've found a reason to use a VPN.

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    99 Topics
    2k Posts
    K

    @elvisimprsntr thanks for your suggestion. I will give it a try.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    johnpozJ

    @MacUsers

    https://help.zerossl.com/hc/en-us/articles/360060119933-Certificate-Revocation

    edit: oh you prob out of luck

    You can revoke any certificate issued via the ZeroSSL portal. Currently, certificates issued via ACME can not be revoked from inside the portal - please follow the instructions of your ACME client for revoking those certificates.

    the gui in pfsense does not have the ability to revoke - you prob have to move the certs to something you have certbot installed to and revoke that way.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    88 Topics
    573 Posts
    luckman212L

    For 25.07 RC, this worked for me (run sh first)

    [25.07-RC][root@r1.lan]/root: sh # export IGNORE_OSVERSION=yes # pkg add https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.84.2.pkg # service tailscaled restart # tailscale up # tailscale version 1.84.2 go version: go1.24.4 # tailscaled -version 1.84.2 go version: go1.24.4

  • Discussions about WireGuard

    689 Topics
    4k Posts
    P

    @patient0 Thanks for further suggestions. The tunnel is definitely up and so I don't think this is a CGNAT issue after all. WAN firewall rule is in place for UDP on port 51823 (otherwise the tunnel wouldn't work, right?). I can ping from client 1 -> client 2 and visa versa and also ping all points in between like you suggest. I just can't open an HTTPS connection from pfSenseB from Client 1 using a browser. But I can do this the other way round i.e. from Client 2 to pfSenseA

    I will try and do some packet capture to see if that reveals anything.

Log in to post
Load new posts
  • JonathanLeeJ

    Shalla URLblacklist for Squidguard service has been stopped.

    5
    1 Votes
    5 Posts
    3k Views
    JonathanLeeJ

    @darnoldvcs where was this file stored no the pfSense filesystem?

  • C

    No updates with adguard home

    4
    0 Votes
    4 Posts
    2k Views
    ?

    @camagur, and the mistake? which ?

  • JonathanLeeJ

    SOLVED: NTP Issues anyone? Set a NAT rule and send all NTP traffic to the firewall.

    13
    0 Votes
    13 Posts
    3k Views
    U

    @jonathanlee
    Thank you for the insight and pointing out my miss configuration. I didn’t see it till you said something. Where I had loop back 127.0.0.1 I should’ve had IOTWiFi addresses.
    I used the net gate recipes for redirecting DNS and applied it to NTP.
    Have a good weekend

  • T

    NTOPNG Questions on setup/understanding ntop, etc.

    1
    0 Votes
    1 Posts
    948 Views
    No one has replied
  • JonathanLeeJ

    pfSense honey pot VM package? 🍯

    1
    1 Votes
    1 Posts
    856 Views
    No one has replied
  • A

    I made a WireGuard package for pfSense

    178
    18 Votes
    178 Posts
    118k Views
    J

    how can i manually remove this wireguard go version on my 2.4.5 system.I want to update my firewall and use the latest wireguard package..

  • Y

    openvpn-client-export -> Sent to email

    6
    0 Votes
    6 Posts
    1k Views
    B

    The security issues here would be somewhat less of a problem if OpenVPN didn't store the client certificate's private key in plain text in the config file 🙄 🙄 🙄

    A possible modification to the OP's suggestion based on some responses here: an option to email the client config file as an encrypted, passworded zip file. After that it is on the VPN admin to ensure that the encrypted zip file's password is communicated by an alternative communications method.

  • B

    Suricata logging configuration

    1
    0 Votes
    1 Posts
    971 Views
    No one has replied
  • T

    Captive Portal takes 1 hr to start

    5
    0 Votes
    5 Posts
    951 Views
    GertjanG

    @toyinal said in Captive Portal takes 1 hr to start:

    Unfortunately reinstalling will be the last resort since it’s the production system

    Re installing ?
    You're using pfSense - not some "Windows 10" PC ;)
    All settings are in one file, the file you backup every day (do you ?).
    If the system fails - as hardware does all the time, you can get back online in minutes.
    Because : you import one file, and all is back to normal.

    This makes settings testing with default settings so easy.
    It also validates your backup and urgency plan.

    @toyinal said in Captive Portal takes 1 hr to start:

    but less number of Ethernet ports

    What happens when you disable all non needed ports ?

    Without having any details, so I just presume, it's a hardware issue.
    I know it can boot normally, as you and I use the same software.
    The difference is : hardware drivers for the NIC's involved and settings.

  • S

    Wireguard package do I dare?

    3
    0 Votes
    3 Posts
    882 Views
    S

    @rob_kae The answers one gets at this forum is just the best!
    Thank you!

    If you want a VPN provider with native wireguard support no look no further than to ovpn.com. :)

  • S

    [SOLVED]ntopng: "you're not supposed to be here" missing lua module: active_monitoring.am_utils

    4
    6 Votes
    4 Posts
    4k Views
    R

    Solved the issue for me. I had to restart the ntopng service.
    Thank you.

  • R

    Ditching Untangle after several years, need help!

    Moved
    1
    0 Votes
    1 Posts
    474 Views
    No one has replied
  • SpaceyS

    Where are the locations for the pfblockerng.conf in edit file? I want to just copy and paste my previous lists and settings since manually restoring the package causes issues, tried multiple backups as well just for package

    1
    0 Votes
    1 Posts
    767 Views
    No one has replied
  • D

    EZIO-G500

    1
    0 Votes
    1 Posts
    543 Views
    No one has replied
  • R

    FreeRadius - 16 characters init-secrets maximum length

    1
    0 Votes
    1 Posts
    415 Views
    No one has replied
  • J

    SSL_ERROR_INTERNAL_ERROR_ALERT

    2
    0 Votes
    2 Posts
    1k Views
    GertjanG

    @jc1976 said in SSL_ERROR_INTERNAL_ERROR_ALERT:

    I saw some mention changing "Global Logging/Blocking Mode" from dnsbl webserver/vip to either no logging or no global mode, but none of that worked.

    Chose one of the "Null Block" option, I advise the (logging) one so you have the stats.

    "DNSBL server" is nice on paper, but only works (well) for non https requests, that is : old fashioned http requests. The thing is : these don't exist any more.

    Example : You have blacklisted "www.verisign.com" and you try to visit it.
    Your browser connects to the IP it got back from pfSense, and the web server at that IP has to send a certificate that says "Hi, I'm the certificate verisign.com".
    But that didn't happen.
    The IP your browser obtained was :

    939c8a03-dc36-488b-9fef-4c812acc2219-image.png

    and this we server send a auto signed, non trusted cert that says : "(I'm not verisign)".

    Your browser then 'should) tells you : something went terribly wrong. And it will NOT ( of course not) show you the page.

    Browser love to show messages like
    SSL_ERROR_INTERNAL_ERROR_ALERT
    because something (some one) tries to break SSL. That's bad.

    You should disregard the usage of the DNSBL web server proposed by pfBlockerNG, as it was a good idea in the past, it's unusable these days.

  • D

    Freeradius Let's Encrypt DST Root CA X3

    8
    1 Votes
    8 Posts
    1k Views
    D

    @gertjan On newer Android versions it is required to have a valid SSL Cert for the Radius service, therefore we use the LE Cert.

    Yes, if I manually remove the "DST Root CA X3" from the Freeradius server cert, everything works.

  • S

    Wireguard net DNS doesn't work

    1
    0 Votes
    1 Posts
    555 Views
    No one has replied
  • H

    Wireguard Gateway Status

    1
    0 Votes
    1 Posts
    547 Views
    No one has replied
  • M

    Arpwatch - checking haproxy

    5
    0 Votes
    5 Posts
    1k Views
    M

    @johnpoz

    I tried that too and it failed for some reason. Haven't had time to diagnose. I figured I'd wait until a newer release that hopefully would have fixed some bugs =)

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.