@ipv6kid:

I've created a video:
http://www.youtube.com/watch?v=uQ7OrxtiAes

Well done - little good documentation exists for pfSense.  Your video explains one small but vital aspect of pfsense/snort.

Yak

did you tried to uninstall it and reinstall?

also try to solve dependecies before reinstall

on console or ssh, type:

pkg_add -r http://files.pfsense.org/packages/8/All/perl-5.12.4.tbz

Thanks a million.

Umm. To monitor site i would need to go throu a proxy i assume. No other way?

Hadi57,

Follow the instructions of this post with 64 bits url.

http://forum.pfsense.org/index.php/topic,42824.msg223874.html#msg223874

Yes, this is possible.  You'll need to create two different ACLs, one for each group.  Read up on creating ACLs and you should be able to figure it out.

@Kamel:

A better/preferred solution (IMHO) would be to redirect to an internal page hosted on pfsense explaining why it was rejected just like squidguard. The issue with redirecting to 127.0.0.1 or not responding is they trick your PC into thinking it's going to get something if it goes there, so it will take a long time and then ultimately 'not respond'. This can also sometimes look like something is broken, so if you have a larger network you may get lots of "why isn't this website working" – as opposed to the user seeing and immediately understanding the reason it was blocked was due to alleged spyware and/or malware and it will remove all question. This will also aid in the troubleshooting process, as you would know immediately the reason this or that page is not functioning.

Just my 2 cents, I highly support the idea though. I wonder if there are "lists" one could subscribe to like with pfblocker. BTW, sites simply being blocked with no explanation why (and system resource hogging) is why I don't use pfblocker.

Another thing - if a machine is infected or could be infected if it was to visit site xyz.com say by an exploit kit exploiting a Java exploit and then dropping a unknown EXE (you will see how often things like these are recognised on virustotal.com :p) do you really care if a user sees a reason? Pfblocker perhaps I can see your point if you block a site which is in a country you have blocked (though users usually let you know pretty quick) but if you block a site on malwaredomains.com - which based on its latests updates has blocked Zeus, Blackhole Exploit Kit Domains, Russian Business Network Malvertisements, Botnets, Malicious Iframes, Mavertisements, malicious javascript and more. These are all bad - would you rather they were blocked outright and users don't get a message (they shouldn't need to connect to them unless they want some trojans on their machines so they are never going to bother you saying they couldn't connect to some work resource) or connect and receive the trojan? Blocking them by DNS blackhole reduces your workload drastically by helping to prevent infections and sending people to reimage machines due to some unrecognised trojan trying to steal data.

This is pretty much confirmed!

My ISP had me pointing at 5078 on their server…

Siproxd would show bound to port 5078 on the logs, so I don't believe this to be any issue with pfSense at all.

My ATA would not connect through Siproxd.

Once my Voip provider switched me to point at 5060 on their server things started working as they should.

It should not matter what port they connect to the ata on...

If your having trouble getting siproxd to work for you, work with your provider to have your ata point at "their server:5060" ...   and see if that doesn't fix it.

If your ISP is blocking port 5060, call them and bitch!

In squid, insert just

.domain.ip.dont.like.com with no *

You'd have to modify the status_nut.php file in /usr/local/www to take the array value $ups['battery.runtime'], convert it to hours/minutes/seconds format, then print it. I'm no PHP expert and I'm sure there are probably more elegant ways to do it but I just made the following changes:

1. Add a new function to the /* functions */ section at the top of the file that converts seconds to an array in hms format:

function secs2hms($secs) { if ($secs<0) return false; $m = (int)($secs / 60); $s = $secs % 60; $h = (int)($m / 60); $m = $m % 60; return array($h, "h ", $m, "m ", $s, "s "); }

2.  Find the following line near the end of the file:

tblrow('Runtime Remaining:', $ups['battery.runtime'], ' seconds');

…and change it to the following:

tblrow('Runtime Remaining:', implode(secs2hms($ups['battery.runtime'])));

The result looks something like this:

If anyone else has a better way to do this feel free to comment.

Cool thanks.

Try once with a browser other then internet explorer.

Check-out the xmlreader.inc it is very fast and can guarantee fixed memory consumption if used properly.
It is even faster than the parser used in pfSense and you can switch to it by a toggle.

It is not used on 2.0 because there were some issue that iirc are fixed now.

You might be able to not use sip proxy and just set an outbound NAT rule for the SIP and RTP traffic with static port = yes. If you maintain a registration you shouldn't need a rule on the WAN side. If the provider calls your IP without a registration they should provide the exact IPs that will be used and you can use that information to create more secure firewall rules. Otherwise you might be able to catch the bad traffic with SNORT, there are some SIP-related rules available.

maybe you don't put a pass rule in your squidguard.

try searching the forum for squid+squidguard config.
you can also refer to this: http://forum.pfsense.org/index.php/topic,40233.msg212828.html#msg212828

You should use /dev/cuaU0 for USB serial ports, not the tty device.

Listen on loopback and create a nat rule from carp to 127.0.0.1

Increase even more the value and check what this url is returning

also check pfblocker topic http://forum.pfsense.org/index.php/topic,42543.0.html

Sorry for wait reply. I was trying to do a fresh install on my box but it seems my squid is not working properly.
I will try again this weekend for another fresh install.
I'll post what I can get after it.