1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    JonathanLeeJ
    @Gertjan yes I did I just felt like once I did this I really earned that shirt

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    JonathanLeeJ
    config tunnel_verdicts: 6in4 has anyone used this in passthrough config area in snort and got it to see ipv6 tunneled traffic

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    582 Topics
    3k Posts
    M
    It looks like this is being worked on in https://redmine.pfsense.org/issues/16790 and a fix may be in 26.03.1.

  • Discussions about the pfBlockerNG package

    3k Topics
    21k Posts
    JonathanLeeJ
    @patient0 I have never seen it before mine was only 5 entries that kept driving me crazy I am not against adds just the tracking ad profile ones. I found that list and was floored they own that many throwaway domains just wow !!

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    108 Topics
    3k Posts
    dennypageD
    @pulsartiger It's difficult to provide a definitive answer since I don't know the UPS model and what it considers an "event", but most Cyber Power units are supported by NUT and the NUT package provides logging and notifications. The simplest way to find out for sure is to hook it up and try it.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    523 Topics
    3k Posts
    N
    So, any update on when it will be solved?

  • Discussions about the FRR Dynamic Routing package on pfSense

    299 Topics
    1k Posts
    N
    @Schannes said in PfSense UI Not Updating frr.conf: I had the same problem. I was able to solve the problem, with clearing the "SAVED frr.conf" field under Services --> FRR --> Global Settings --> Raw Config. After clearing the field, it was possible again, to use the GUI to configure frr. I really want to stress that this is the ONLY feasible way to get frr config and web gui to work again. And while we are at it I would like to request an addition to the frr ospf menu's [image: 1774758674881-714f8830-f68c-4cd7-bfdd-aed167173a54-image.png] What is needed is to produce the line in bold interface tun_wg0 ip ospf network point-to-multipoint non-broadcast ip ospf area 0 This is supported by frr (tested in 25.11.1 and 26.03rc) and is required for ospf over wireguard tunnels on a single spoke , for hub and spoke setups. You also need to specify the neighbor by ip. The reason is that ospf wants multicast, (and works if you add 224.0.0.0/4) on the hub, BUT it will only work for the last spoke, since this is how wireguard operates. The setting above solves it, but since it is not on the menu, you need to change it by hand , which then gets the configuration out of sync, and one have to do chores described above to get it to synce, and THEN change the line to ip ospf network point-to-multipoint non-broadcast Hell breaks loose.!! ps. I would opt for bgp instead of ospf for wireguard tunnels, but this will be another thread!

  • Discussions about the Tailscale package

    100 Topics
    771 Posts
    E
    Updated CE 2.8.1 to 1.98.8 Freshports pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.98.8.pkg Changelog

  • Discussions about WireGuard

    747 Topics
    4k Posts
    luckman212L
    It would be nice to have a convenient keygen embedded on the peer creation page, but for now I just use this 1-liner: k=$(wg genkey) && printf 'priv: %s\npub: %s\n' $k $(wg pubkey <<<$k) Outputs a keypair e.g. priv: 0JxL9+LXZfSZKN4dn5YVWBGlvlEDzsQSX087y1E9gXM= pub: LqbT8VyQKQ5vg61OjxaMGKmGqb81dpIRG4sUYS26rQc=
Log in to post
Load new posts
  • keyserK

    Advantages of mDNS-Bridge vs UDPBroadcastRelay

    7
    0 Votes
    7 Posts
    2k Views
    keyserK
    @dennypage And thank you SO much to @dennypage for maintaining the package - and so selflessly spending time supporting it and us users. Especially when we ask stupid questions or are so selfcentered we find ourselves important enough to outright complain over volunteer work like this. All package maintainers should really have a HERO badge here on this forum.
  • E

    HAProxy - Files

    3
    4
    0 Votes
    3 Posts
    1k Views
    patient0P
    @AnthonySalamone preface: I don't use HA Proxy but did use the power of searching the internet. If you want to use pfSense with Authelia, which seems to use these exact three files, someone written a blog post about how to do it: https://kovasky.me/blogs/pfsense_haproxy_authelia/
  • A

    Prometheus Node Exporter gives log errors - fix or suppress in log

    7
    0 Votes
    7 Posts
    8k Views
    A
    @nws thanks for the consistent fix - I completely overlooked that for a while. And @credulous yes, it's still a mystery why the collectors seemingly trigger and gives errors, and also why they don't appear at the collector list. It seems the Prometheus Node Exporter package on FreeBSD has very low priority perhaps? Else you would imagine something like this could be fixed.
  • CreationGuyC

    HAProxy / ACME + external webhost?

    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • C

    FreeRadius or something else, for MFA without a PIN code?

    9
    0 Votes
    9 Posts
    4k Views
    N
    @Codefighter Thanks @Codefighter, you’ve nailed it. I totally agree that for home use, OTP can feel like overkill. But when it comes to small, medium, and large businesses, we’ve got a real responsibility to keep networks and systems secure. We can’t afford to be casual or underestimate the risks out there. Honestly, I’d much rather hear a few grumbles from employees about typing in an OTP every time they hop on the VPN than have to sit in a meeting with the board explaining why we didn’t do enough to prevent and mitigate a cyberattack.
  • D

    After backup restore freeradius fails to authenticate with Google Authenticator

    1
    0 Votes
    1 Posts
    352 Views
    No one has replied
  • L

    net-snmp on Netgate 7100 cluster - firmware 25.07.1-RELEASE

    3
    0 Votes
    3 Posts
    3k Views
    S
    see https://forum.netgate.com/topic/198800/solved-pkg-upgrade-not-found-required-by-pkg running on ssh this command fixed my problem. pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade for me the problem is solved.uuu
  • E

    iperf3 on 25.07.1-RELEASE

    5
    0 Votes
    5 Posts
    4k Views
    E
    you're right, I'm still confused about where to find it. The red flag remains, probably just a minor bug
  • K

    This topic is deleted!

    1
    0 Votes
    1 Posts
    505 Views
    No one has replied
  • jimpJ

    System Patches Package v2.2.23

    1
    7 Votes
    1 Posts
    3k Views
    No one has replied
  • H

    crowdsec

    36
    0 Votes
    36 Posts
    16k Views
    Z
    @keyser My "security engine" which is the server that receives all the logs and makes decisions, can be run on a separate server. That is my exact setup so I can run my own web/php front end. As per the the url block list, or EDL since I'm entrenched in Palo terminology, doesn't do the log analysis and crowdsec reporting. Different strokes for different folks I guess.
  • M

    Arpwatch - flip flop notifications not suppressed

    1
    3
    0 Votes
    1 Posts
    3k Views
    No one has replied
  • N

    LCDproc Looses Connection - Restarting service Fixes but goes down again shortly after

    11
    2
    0 Votes
    11 Posts
    9k Views
    fireodoF
    @jimp said in LCDproc Looses Connection - Restarting service Fixes but goes down again shortly after: and I can never reproduce it in the lab. Hi, if you go to Diagnostics -> States and kill all states you get the "running wild" and flooding syslog lcdproc-client. (Maybe also of interest: LcdProc) Regards, fireodo
  • E

    Zabbix 6.4.x required for pfsense 2.8.0-RELEASE

    4
    0 Votes
    4 Posts
    7k Views
    A
    @EngineerSB I went through the same challenge when upgrading our Zabbix server to 7.0. 5.0, 6.0, and 7.0 are LTS releases that get 5 years of support, whereas standard releases are only supported for 18 months. I've learned my lesson to only stick to major versions to avoid this issue. The easiest option that achieves a similar result is to only use the Zabbix 6.0 Agent, and change all items of type "Zabbix Agent" to type "Zabbix Agent (Active)". Also change the host to be monitored by Server instead of by Proxy. On the Agent, change the Active Server to be the Zabbix Server FQDN/IP (that the Proxy was pointing to) rather than the 127.0.0.1 localhost Proxy IP. This will achieve nearly the same behavior as using passive Zabbix Agent items via Proxy. The Zabbix Agent will communicate outbound directly to the Server and get the configuration, and the agent will garther data for all items of type Zabbix Agent (Active) and send the data to the server. Another option would be to copy the files from another firewall that still has the 6.4 packages installed.
  • M

    statgrab package

    1
    0 Votes
    1 Posts
    3k Views
    No one has replied
  • A

    Telegraf stopped working after update to 2.8.0

    1
    0 Votes
    1 Posts
    3k Views
    No one has replied
  • C

    Avahi trying to broadcast on public interface?

    8
    0 Votes
    8 Posts
    7k Views
    dennypageD
    @clearscreen said in Avahi trying to broadcast on public interface?: I was just looking at mdns-bridge source code, but only realized now you're the author Yes. I'm also the maintainer of the pfSense Avahi package, which is why I felt compelled to write mdns-bridge. I’m not very familiar with mDNS, but I’m thinking of trying to implement one-way reflection (blocking either queries or broadcasts in a single direction). My motivation is to limit fingerprinting of my home network while allowing trusted subnets to see devices on less trusted subnets. Before I dive in, is there any technical reason this wouldn’t be feasible? Just want to understand if there’s a fundamental limitation and I figured I might as well ask you first. With mdns-bridge, you do not block queries or responses, but choose what mDNS names are shared by each network segment. Avahi uses a similar approach, but is limited to what in mdns-bridge terms would be a Global Allow filter list only. mDNS-Bridge is designed to give you detailed control of what mDNS names each segment is allowed to export or import, but I recommend keeping things simple if possible. I recommend starting with a Global Allow filter list to limit the overall scope, and exploring from there as needed. One thing to keep in mind, as noted in the mDNS-Bridge README filters that include hostnames are best used only in deny filters.
  • RyanMR

    HA Proxy and 503 error on pfSense

    2
    0 Votes
    2 Posts
    6k Views
    V
    @RyanM said in HA Proxy and 503 error on pfSense: So let's say my domain is internaldomain.com Does domain resolve to your public IP in a public DNS? If it doesn't, you won't get a Let's Encrypt cert at all. Is HA Proxy good for what I am trying to do? So I have self-signed certs for several internal hosts/services. Yes. You can install self-signed certs on your backend servers and direct all traffic over HAproxy, even from internal. However, you must not enable "SSL checks" in the backend. The better way, however, would be to generate the internal certs with a CA on pfSense. Then you can confiugre HAproxy to trust the CA and accept the server certs. When getting error 503 "service not available", the backend either does not respond to heath checks or the service is not reachable, or something else in HAproxy is configured wrong. So first of all go to the stats page and check if the backend is shown up as "online". If not check the health check configuration.
  • A

    Looking for few pointers getting Suricata on PFSense to talk to my Security Onion box.

    5
    2
    0 Votes
    5 Posts
    7k Views
    bmeeksB
    @aaronouthier said in Looking for few pointers getting Suricata on PFSense to talk to my Security Onion box.: Ok, so I've been researching the topic. It seems SO has an integration for PFSense. However, the FreeBSD implementation of Syslog is not optimal for this purpose, as mentioned above. Although I am comfortable with CLI Linux, I am effectively a Newbie with regard to BSDs. My next question is: What would be the least invasive method as far as the PFSense Box to export just the Suricata logs? I believe I saw an option to log to a Unix Socket. Would that be helpful coupled with something like Netcat? I'm not necessarily looking for help with such a feat, just wondering if such would likely be fruitful, or am I just chasing the infamous wild goose? I recommend exporting the EVE JSON log as that will be the most comprehensive. To export to a UNIX socket, change the EVE OUTPUT TYPE setting to UNIX socket. You will need to manually create the socket and give it a name. It will be up to you then to "receive" the socket data stream and redirect it elsewhere (seems you want it remote for your case to Security Onion).
  • L

    Updated PIMD package (beta)

    1
    0 Votes
    1 Posts
    3k Views
    No one has replied
Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.