1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    JonathanLeeJ
    Squid can be configured externally, I would love a how to guide on how to do this correctly.

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    DARAD
    Hello team, I have a Netgate 8200 running 24.11-RELEASE (amd64) with Suricata 7.0.8_5 package installed. Suricata doesn't seem to start. It loops to red once I press the Play button on the interface. It leaves no logs in the System logs, it leaves no logs in suricata.log at /var/log/suricata/suricata_ovpns933787/suricata.log I tried launching it manually: # /usr/local/bin/suricata -V or # /usr/local/bin/suricata -c /usr/local/etc/suricata/suricata_33787_ovpns9/suricata.yaml -i suricata_ovpns933787 and I get this output ld-elf.so.1: /usr/local/bin/suricata: Undefined symbol "__strlcpy_chk@FBSD_1.8" Thanks in advance, Dara

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    573 Topics
    3k Posts
    dennypageD
    @kabeda If memory serves, that old version of ntopng did not run as user ntopng, but as user nobody. There are lots of problems in that old version. Anyway, check the ownership and permissions of /var/db/ntopng and make sure it matches the user that ntopng runs as. You may need to set ownership of the entire hierarchy. Example: /usr/sbin/chown -R nobody:nobody /var/db/ntopng However, the better choice would be to upgrade to a more recent version.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    D
    @BBcan177 Thank you for the kind reminder; I am so accustomed to ensuring Save Settings is checked that I didn't follow your instructions properly (thanks @tinfoilmatt for uploading and highlighting the screen shot). I've properly followed the instructions and the update did not report and db problems. Thank you again! drac

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    102 Topics
    3k Posts
    C
    @dennypage Nicely done sir!

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    503 Topics
    3k Posts
    GPz1100G
    @agitelzon I have no issue connecting to LE servers from pf shell. The issue is cloudflare security setting is configured as a whitelist for api zone record changes. The whitelist includes my ipv4 address only, as a /32. As I mentioned, I could add the ipv6 prefix as a /64. Given that pf is configured to prefer ipv4, I thought that would carry over to acme as well.

  • Discussions about the FRR Dynamic Routing package on pfSense

    296 Topics
    1k Posts
    C
    This one has been tricky still not sure what to try. Any ideas?

  • Discussions about the Tailscale package

    93 Topics
    662 Posts
    C
    @lbm_ I found a solution yesterday but yours is simpler and makes sense; While troubleshooting I had dicovered that with the Package and Freshports-update both installed, pfSense was running two services that were clashing on reboot. I can post my solution if anyone’s interested, but the simplest solution is always best. Netgate 6100, pfSense+ 25.07.1 FreeBSD15, Tailscale Package + Tailscale updated to 1.90.6_1.

  • Discussions about WireGuard

    716 Topics
    4k Posts
    chpalmerC
    @tinfoilmatt Thanks! I have done that and it worked when forcing just her TV out the Centurylink.. My problem is my local box here. Im missing something because I can not get it to pass traffic from the WAN to the Wireguard tunnel. Ive got some time today so will chip away on my lab setup to see if I can finally accomplish it here first.
Log in to post
Load new posts
  • Q

    Squidguard - centralized config

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    Q
    Thanks for the response…I agree, I have thought of the parent/child proxy set up - but you are right, bandwidth usage would be very inefficient, so I don't really want to go that right...if there is no way to centralize the config, then we will just keep modifying them all :) Thanks! Q
  • A

    Squidguard Web filter list Error

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    jimpJ
    There won't be enough room in /var on an ALIX to handle that. The blacklists should probably be downloaded to /root instead so it can work on nanobsd. Though with the amount of data and processing that goes into setting up the blacklists, be aware that it will cause a lot of writes on your CF, potentially shortening its life.
  • L

    Update NMAP MAC Prefexes List

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    jimpJ
    The mac-to-vendor code is in 2.0 proper now, but I don't know if we'll include that list on the box by default. We use the version of that file that comes with the nmap package, which is generally the latest one seen in FreeBSD's ports tree. As I mentioned in another thread, you can always pull in the most recent version without nmap like so: mkdir -p /usr/local/share/nmap/; fetch -o /usr/local/share/nmap/nmap-mac-prefixes http://nmap.org/svn/nmap-mac-prefixes
  • A

    Removing freeradius breaks system

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    jimpJ
    That filter.inc line is a test to see if UPnP's options are set to be enabled. Not sure exactly what FreeRADIUS may have done that would have made that fail though. I have installed and uninstalled FreeRADIUS a few times in the past and didn't have issues. You can edit a config.xml backup, it's just plain text XML, find the section with the <package>…</package> tags for FreeRadius and remove them, and then restore the backup.
  • R

    Squidguard fails install

    Locked
    12
    0 Votes
    12 Posts
    6k Views
    jimpJ
    Search the forums, others have done that. I wouldn't want to do that, but to each their own…
  • R

    Squid cache

    Locked
    8
    0 Votes
    8 Posts
    5k Views
    R
    Okay, thank you for helping Nachtfalke, the settings seem to have worked
  • C

    Transmeta crusoe longrun power manage module for FB8.1

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    K
    maybe someone can help me to install the longrun plugin.
  • S

    Squid Package Tuning

    Locked
    29
    0 Votes
    29 Posts
    18k Views
    N
    Hi, in the past we talked about caching Kaspersky updates: I tried this: refresh_pattern -i .*kaspersky\.com/.*\.(.*) 1440 100% 1440 reload-into-ims override-expire override-lastmode; refresh_pattern -i .*kaspersky-labs\.com/.*\.(.*) 1440 100% 1440 reload-into-ims override-expire override-lastmode; I think this is working just fine for the "Kaspersky Offline Updater Tool" http://support.kaspersky.com/updater?level=2 Need more testing if it works with the "normal" updater function of the client software. Perhaps someone else will find some time for this. Further I found out, that if we use range_offset_limit -1 squid is still downloading files even if the user has left a website or canceld some download. To avoid this, I am using this: quick_abort_min 0 KB; quick_abort_max 0 KB; quick_abort_pct 100; For windows updates I am using this without any errors in syslog and with success: refresh_pattern -i .*microsoft\.com/.*\.(cab|exe|msi|msp) 129600 100% 129600 reload-into-ims; refresh_pattern -i .*windowsupdate\.com/.*\.(cab|exe|msi|msp) 129600 100% 129600 reload-into-ims; To avoid, that a user is getting still a "Error 404" if a website wasn't available for a short time and then ist up again because of the high time for negative dns I am using this: negative_ttl 5 second; negative_dns_ttl 5 second; I am using this all in squid "Custom options". It would be really nice if someone else could test and verify this or post some other usefull squid options. For me it was hard to find these parameters and so I wnat to share them and get some feedback.
  • N

    SQUID range_offset_limit - understanding problem

    Locked
    2
    0 Votes
    2 Posts
    5k Views
    N
    Hi, I found out, that the first part is nonsense. one times "range_offset_limit -1" is enough. Further I found out, how to cache kaspersky updates: refresh_pattern -i .*kaspersky\.com/.*\.(.*) 1440 100% 1440 reload-into-ims override-expire override-lastmode; refresh_pattern -i .*kaspersky-labs\.com/.*\.(.*) 1440 100% 1440 reload-into-ims override-expire override-lastmode; For me this works - I think.
  • _

    Havp doesn't start after reboot (pf 2.0 amd64, Feb 24)

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    A
    Hi you guys , this is my firts post. so a im a new user with pfsense. I am already have havp working with my proxy cache. the issue I have is that when the systems reboots clamd takes a lot for start up. Meanwhile i can not get to internet , i can not get web pages in my browser. After about 8-10 minutes the system start to work normaly and clamd seem to be started. The page setup shows the clamd  down after about 8-10 mins. of restarted. Any ideas what is happening ? I already have configured the havp as parent proxy for squid.
  • J

    Nagios/nrpe for pfsense 2.0?

    Locked
    8
    0 Votes
    8 Posts
    13k Views
    jimpJ
    NRPE2 should now be installable and functional for SSL-enabled communication on pfSense 2.0.
  • G

    Client -> Squid ->SquidGuard -> Havp/Antivirus -> Privoxy -> Internet

    Locked
    4
    0 Votes
    4 Posts
    9k Views
    _
    Its really easy: Install squid, at general settings set "proxy port" to 3125. Squid is set as transparent proxy. Install squidguard and configure it. Now install havp and configure it as "parent for squid", "proxy port" set to 3125. Thats the short story, should work. Try first only squid - squidguard to get that working, then after success install/configure havp. with privoxy i can't help. sorry
  • M

    HAVP says stopped on 2.0 RC1

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    M
    Happy to comply - which exact logs do you want?
  • G

    Problem in installing squid!!!

    Locked
    13
    0 Votes
    13 Posts
    10k Views
    jimpJ
    There is no viable way to install a package manually. It may be possible but the procedure is very prone to user error and you'd likely break something in the process. Alternately, you can setup your own local package repository on a computer you have access to and then serve the package files from there: http://doc.pfsense.org/index.php/Creating_Your_Own_Package_Repository
  • I

    Squid Guard Rules

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • D

    Pkg_add not installed

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    stephenw10S
    Does the ups require a driver or is it a usb-serial adapter? What does it show up in the logs as if you hotplug it? Steve
  • A

    Snort Portscan Detection - Blocking VoIP

    Locked
    7
    0 Votes
    7 Posts
    4k Views
    C
    Yes you have to disable the port scan rule it's triggering, which is the UDP port scan rule IIRC. RTP in volume looks like a UDP port scan. Some manual hacking of the rule to make it less prone to those false positives may suffice. That's more a question for Sourcefire, we don't have any involvement with the rules.
  • N

    Squid problem

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    N
    just try to reinstall the squid package if it is not uinder "SERVICES -> PROXY SERVER"
  • M

    HAVP 0.91_1 Disable Heuristics.Broken.Executable ??

    Locked
    5
    0 Votes
    5 Posts
    13k Views
    M
    Thanks working well =D
  • J

    AV scanner wont scan FTP, HTTPS, or email?

    Locked
    9
    0 Votes
    9 Posts
    5k Views
    C
    @NightHawk007: Just remember the lag that this antivirus causes is not worth using it .I used another utm software and there was zero lag and scanned everything going through it with no problems . Every gateway AV causes lag, and weirdness with downloads from the internal clients' perspective as the proxy itself downloads it first and scans it, then sends it to the client.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.