Subcategories

• Cache/Proxy

  Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

  3.7k
  Topics
  20.5k
  Posts

  M

  @JonathanLee I put my mod in custom mode and re-wrote the certificate. I'll try it a bit and I'll let you know again depending on the situation.

  2024/11/17 12:44:10| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0)
  2024/11/17 12:44:10| Processing: http_port 192.168.2.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
  2024/11/17 12:44:10| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.
  2024/11/17 12:44:10| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048'
  OpenSSL-saved error #1: 0x1e08010c
  2024/11/17 12:44:10| ERROR: Unsupported TLS option SINGLE_DH_USE
  2024/11/17 12:44:10| ERROR: Unsupported TLS option SINGLE_ECDH_USE
  2024/11/17 12:44:10| Processing: http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
  2024/11/17 12:44:10| Starting Authentication on port 127.0.0.1:3128
  2024/11/17 12:44:10| Disabling Authentication on port 127.0.0.1:3128 (interception enabled)
  2024/11/17 12:44:10| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.
  2024/11/17 12:44:10| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048'
  OpenSSL-saved error #1: 0x1e08010c
  2024/11/17 12:44:10| ERROR: Unsupported TLS option SINGLE_DH_USE
  2024/11/17 12:44:10| ERROR: Unsupported TLS option SINGLE_ECDH_USE
  2024/11/17 12:44:10| Processing: https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
  2024/11/17 12:44:10| Starting Authentication on port 127.0.0.1:3129
  2024/11/17 12:44:10| Disabling Authentication on port 127.0.0.1:3129 (interception enabled)
  2024/11/17 12:44:10| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.
  2024/11/17 12:44:10| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048'
  OpenSSL-saved error #1: 0x1e08010c
  2024/11/17 12:44:10| ERROR: Unsupported TLS option SINGLE_DH_USE
  2024/11/17 12:44:10| ERROR: Unsupported TLS option SINGLE_ECDH_USE
  2024/11/17 12:44:10| Processing: icp_port 0
  2024/11/17 12:44:10| Processing: digest_generation off
  2024/11/17 12:44:10| Processing: dns_v4_first on
  2024/11/17 12:44:10| ERROR: Directive 'dns_v4_first' is obsolete.
  2024/11/17 12:44:10| dns_v4_first : Remove this line. Squid no longer supports preferential treatment of DNS A records.
  2024/11/17 12:44:10| Processing: pid_filename /var/run/squid/squid.pid
  2024/11/17 12:44:10| Processing: cache_effective_user squid
  2024/11/17 12:44:10| Processing: cache_effective_group proxy
  2024/11/17 12:44:10| Processing: error_default_language en
  2024/11/17 12:44:10| Processing: icon_directory /usr/local/etc/squid/icons
  2024/11/17 12:44:10| Processing: visible_hostname localhost
  2024/11/17 12:44:10| Processing: cache_mgr admin@localhost
  2024/11/17 12:44:10| Processing: access_log /var/squid/logs/access.log
  2024/11/17 12:44:10| Processing: cache_log /var/squid/logs/cache.log
  2024/11/17 12:44:10| Processing: cache_store_log none
  2024/11/17 12:44:10| Processing: netdb_filename /var/squid/logs/netdb.state
  2024/11/17 12:44:10| Processing: pinger_enable on
  2024/11/17 12:44:10| Processing: pinger_program /usr/local/libexec/squid/pinger
  2024/11/17 12:44:10| Processing: sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
  2024/11/17 12:44:10| Processing: tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt
  2024/11/17 12:44:10| Processing: tls_outgoing_options capath=/usr/local/share/certs/
  2024/11/17 12:44:10| Processing: tls_outgoing_options options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
  2024/11/17 12:44:10| ERROR: Unsupported TLS option SINGLE_DH_USE
  2024/11/17 12:44:10| ERROR: Unsupported TLS option SINGLE_ECDH_USE
  2024/11/17 12:44:10| Processing: tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS
  2024/11/17 12:44:10| Processing: sslcrtd_children 5
  2024/11/17 12:44:10| Processing: logfile_rotate 5
  2024/11/17 12:44:10| Processing: debug_options rotate=5
  2024/11/17 12:44:10| Processing: shutdown_lifetime 3 seconds
  2024/11/17 12:44:10| Processing: acl localnet src 192.168.2.0/24
  2024/11/17 12:44:10| Processing: forwarded_for on
  2024/11/17 12:44:10| Processing: uri_whitespace strip
  2024/11/17 12:44:10| Processing: refresh_pattern -i windowsupdate.com/..(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
  2024/11/17 12:44:10| Processing: refresh_pattern -i microsoft.com/..(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
  2024/11/17 12:44:10| Processing: refresh_pattern -i windows.com/..(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
  2024/11/17 12:44:10| Processing: refresh_pattern -i microsoft.com.akadns.net/..(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
  2024/11/17 12:44:10| Processing: refresh_pattern -i deploy.akamaitechnologies.com/.*.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
  2024/11/17 12:44:10| Processing: cache_mem 512 MB
  2024/11/17 12:44:10| Processing: maximum_object_size_in_memory 1024 KB
  2024/11/17 12:44:10| Processing: memory_replacement_policy heap GDSF
  2024/11/17 12:44:10| Processing: cache_replacement_policy heap LFUDA
  2024/11/17 12:44:10| Processing: minimum_object_size 0 KB
  2024/11/17 12:44:10| Processing: maximum_object_size 4 MB
  2024/11/17 12:44:10| Processing: cache_dir ufs /var/squid/cache 100 16 256
  2024/11/17 12:44:10| Processing: offline_mode off
  2024/11/17 12:44:10| Processing: cache_swap_low 90
  2024/11/17 12:44:10| Processing: cache_swap_high 95
  2024/11/17 12:44:10| Processing: cache allow all
  2024/11/17 12:44:10| Processing: refresh_pattern ^ftp: 1440 20% 10080
  2024/11/17 12:44:10| Processing: refresh_pattern ^gopher: 1440 0% 1440
  2024/11/17 12:44:10| Processing: refresh_pattern -i (/cgi-bin/|?) 0 0% 0
  2024/11/17 12:44:10| Processing: refresh_pattern . 0 20% 4320
  2024/11/17 12:44:10| Processing: acl allsrc src all
  2024/11/17 12:44:10| Processing: acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 3128 3129 1025-65535
  2024/11/17 12:44:10| Processing: acl sslports port 443 563
  2024/11/17 12:44:10| Processing: acl purge method PURGE
  2024/11/17 12:44:10| Processing: acl connect method CONNECT
  2024/11/17 12:44:10| Processing: acl HTTP proto HTTP
  2024/11/17 12:44:10| Processing: acl HTTPS proto HTTPS
  2024/11/17 12:44:10| Processing: acl step1 at_step SslBump1
  2024/11/17 12:44:10| Processing: acl step2 at_step SslBump2
  2024/11/17 12:44:10| Processing: acl step3 at_step SslBump3
  2024/11/17 12:44:10| Processing: acl allowed_subnets src 192.168.2.1/24 192.168.2.0/24
  2024/11/17 12:44:10| WARNING: aclIpParseIpData: Netmask masks away part of the specified IP in '192.168.2.1/24'
  2024/11/17 12:44:10| WARNING: (B) '192.168.2.0/24' is a subnetwork of (A) '192.168.2.0/24'
  2024/11/17 12:44:10| WARNING: because of this '192.168.2.0/24' is ignored to keep splay tree searching predictable
  2024/11/17 12:44:10| WARNING: You should probably remove '192.168.2.0/24' from the ACL named 'allowed_subnets'
  2024/11/17 12:44:10| Processing: acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl"
  2024/11/17 12:44:10| Processing: http_access allow manager localhost
  2024/11/17 12:44:10| Processing: http_access deny manager
  2024/11/17 12:44:10| Processing: http_access allow purge localhost
  2024/11/17 12:44:10| Processing: http_access deny purge
  2024/11/17 12:44:10| Processing: http_access deny !safeports
  2024/11/17 12:44:10| Processing: http_access deny CONNECT !sslports
  2024/11/17 12:44:10| Processing: http_access allow localhost
  2024/11/17 12:44:10| Processing: request_body_max_size 0 KB
  2024/11/17 12:44:10| Processing: delay_pools 1
  2024/11/17 12:44:10| Processing: delay_class 1 2
  2024/11/17 12:44:10| Processing: delay_parameters 1 -1/-1 -1/-1
  2024/11/17 12:44:10| Processing: delay_initial_bucket_level 100
  2024/11/17 12:44:10| Processing: delay_access 1 allow allsrc
  2024/11/17 12:44:10| Processing: url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
  2024/11/17 12:44:10| Processing: url_rewrite_bypass off
  2024/11/17 12:44:10| Processing: url_rewrite_children 16 startup=8 idle=4 concurrency=0
  2024/11/17 12:44:10| Processing: http_access allow whitelist
  2024/11/17 12:44:10| Processing: acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com
  2024/11/17 12:44:10| Processing: request_header_access YouTube-Restrict deny all
  2024/11/17 12:44:10| Processing: request_header_add YouTube-Restrict none youtubedst
  2024/11/17 12:44:10| Processing: acl splice_it ssl::server_name .microsoft.com
  2024/11/17 12:44:10| Processing: acl splice_it ssl::server_name .windowsupdate.com
  2024/11/17 12:44:10| Processing: acl splice_it ssl::server_name .akamaitechnologies.com
  2024/11/17 12:44:10| Processing: acl splice_it ssl::server_name .akadns.net
  2024/11/17 12:44:10| Processing: acl splice_it ssl::server_name .cloudns.net
  2024/11/17 12:44:10| Processing: ssl_bump peek step1
  2024/11/17 12:44:10| Processing: acl hasRequest has request
  2024/11/17 12:44:10| Processing: access_log daemon:/var/log/squid/access.log hasRequest
  2024/11/17 12:44:10| Processing: http_access allow allowed_subnets
  2024/11/17 12:44:10| Processing: http_access allow localnet
  2024/11/17 12:44:10| Processing: http_access deny allsrc
  2024/11/17 12:44:10| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP
  2024/11/17 12:44:10| Requiring client certificates.
  2024/11/17 12:44:10| Loaded signing certificate: /CN=internal-ca/C=TR
  2024/11/17 12:44:10| Not requiring any client certificates
  2024/11/17 12:44:10| Loaded signing certificate: /CN=internal-ca/C=TR
  2024/11/17 12:44:10| Not requiring any client certificates
  2024/11/17 12:44:10| Loaded signing certificate: /CN=internal-ca/C=TR
  2024/11/17 12:44:10| Not requiring any client certificates

• IDS/IPS

  Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

  2.2k
  Topics
  15.5k
  Posts

  J

  Sorry I am late to this party. I had issues with STUN and the IPS blocking traffic. It was for my son’s Nintendo switch and Xbox for the chat feature. Once I suppressed the alarms the chat live voice feature worked perfectly. I also think that FaceTime requires you to suppress the STUN alarms. Long story short STUN is finally working on my system as of today.

• Traffic Monitoring

  Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

  553
  Topics
  2.7k
  Posts

  W

  Hi,

  I would like to monitor how much of my traffic is going over IPv6 vs. IPv4.
  I can't find and such numbers anywhere.
  Am I looking in the wrong place?
  Any hints on how I may do that?

  Thanks in advance

  /Ulrich

• pfBlockerNG

  Discussions about the pfBlockerNG package

  2.5k
  Topics
  19.0k
  Posts

  D

  How can I limit some of my WAN inbound rules to the US only? I have a range of public IP addresses configured into the Firewall for different inbound services.

  I also have multiple VLANs / Subnets it seems like PfBlockerNG is operating at the global system-wide level.

  I am trying to be as granular as possible for example:

  Client VLAN A services can only be inbounded by CA IP / Outbound to selected countries
  Client VLAN B services can only be inbounded by US IP / Outbound to selected countries

  Thank you,

• UPS Tools

  Discussions about Network UPS Tools and APCUPSD packages for pfSense

  86
  Topics
  2.3k
  Posts

  D

  @netboy Glad you got it sorted.

• ACME

  Discussions about the ACME / Let’s Encrypt package for pfSense

  474
  Topics
  2.7k
  Posts

  T

  For (nearly) the second time now the ACME package has filled up the disk on my pfSense. A recap of some history:

  On August 8, the ACME package updated the certificate On October 7, I came home in the afternoon to find the internet not working. Eventually determined the disk was full and deleted some zfs filesystems associated with old versions. This got things working but the webgui was totally borked. On October 11, I finally did a factory reset, and restored a configuration backup from August 8, after the certificate update

  Things were working fine until a couple of days ago when I started getting HSTS errors when trying to connect. My browser showed I was being served the August 8 certificate, which expired on November 6. The certificate seemed legit (as in, one that was issued to my pfSense) but for whatever reason a newer cert (that was present in the GUI) wasn't being used. I couldn't find any evidence of this August 8th cert in the GUI or configs, but that's not actually the point of the story.

  While trying to figure this out, I noticed that /cf was using a large amount of space. This was one of the things that eventually led to the previous install crashing:
  ce5f6f00-8e84-4c7e-a832-560c8c29ee07-image.png

  Poking around I found a config file every second in the backup directory:
  4715cf3b-c4cb-4739-b212-23875c10069b-image.png

  Looking at the timestamps on these config files you can see about when it started:
  610c4531-0070-42ac-835b-9191f897a80b-image.png

  The first config in that 1731701* bunch had this change, me forcing a certificate issuance in the hope that would fix something:
  6cf88b4e-f8e1-4406-824f-2df44f8d9106-image.png

  After that, there is an "identical" config every second looking like:
  40b5bb0c-a638-4b95-b404-689c4e351e9d-image.png

  time is /pfsense/revision/time, and lastrenewal is /pfsense/installedpackages/acme/certificates/item/lastrenewal. The comment on every one of thos configs is the same as above, "(system): Services: Acme: Storing signed certificate". I assume ACME is somehow in a loop where modifying the config is causing it to update the config.

  I ended up uninstalling ACME which stopped the problem, but once I re-installed ACME and forced another Issue/Renew, it started again. System Logs shows this loop:
  2380115f-0204-4f3f-9f2f-480f5b3ee984-image.png

  This is with pfSense-pkg-acme-0.8_1 on a Netgate 1100 running 24.03-RELEASE

• FRR

  Discussions about the FRR Dynamic Routing package on pfSense

  278
  Topics
  1.1k
  Posts

  B

  @frijolierthnthou Were you able to solve this issue? I've been dealing with this same exact problem from the past 2 weeks

• Tailscale

  Discussions about the Tailscale package

  74
  Topics
  417
  Posts

  D

  Screenshot_20241113_175104.jpg Good day everyone,
  Im getting this notification on my pfsense, can someone tell me what is it?

• WireGuard

  Discussions about WireGuard

  624
  Topics
  3.3k
  Posts

  W

  Same here. Does not seem to do any harm but it just feels not right, having so much errors on an interface and not knowing why...