Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    E
    I even tried deleting and creating a new certificate. Any suggestions?
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB
    @NRgia said in Suricata on Pfsense: Your suggestion is preferred, but from I understood from you, nobody is interested or have the knowledge. Again thank you, for updating this package over the years. I'm sure there is someone here on the forum using the package that has the knowledge to maintain it. Another option if IDS/IPS is critical is to use the Linux package on a separate virtual machine or hardware appliance. Inline IPS performance would actually be very good using a Linux box (or even a FreeBSD box) with two separate NICs and configure true netmap hardware-to-hardware mode. That is many times more performant than the hardware-to-host mode that is required when using netmap within pfSense. Of course using a separate box would mean no GUI, but that's how the vast majority of the world uses Suricata already (without a GUI).
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    572 Topics
    3k Posts
    keyserK
    @Antibiotic No it’s not possible with NtopNG as it is not a Netflow collector. You need nProbe for that which will “translate” recieved netflows into flows that NtopNG understands and can visualize (with very very little detail might I add as Netflows has no additonal information apart from sender/reciever and volume). The NtopNG package and the product in general is more geared towards visualising and recording traffic details from actual packet captures. This contains MUCH more metadata about the sessions than netflows (DNS names, protocol information and myriads of other things). But pffSense Plus has a builtin Netflow exporter if you have an external netflow collector on hand.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    V
    @Gertjan Thanks for your reply – that’s also my impression. The point is: I don’t really see any lists right now that are actually “maintained” in the sense of being actively cleaned up, checked for dead domains, categorized, etc. That’s why my main interest is more about the demand: Would curated lists really be a game changer for admins? Would they be more helpful than what’s available today, or are most people already using other alternatives? If so, which ones? And from your perspective, what would be your expectation towards “community lists”? (e.g. reliability, update frequency, categories, fewer false positives?)
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    501 Topics
    3k Posts
    A
    Hi, Please help to forward / report the bugs in ACME 1.0 package. Thanks.
  • Discussions about the FRR Dynamic Routing package on pfSense

    295 Topics
    1k Posts
    J
    Anyone else happen to notice that when configuring BFD, if you create a peer and select a profile - after save, re-edit the peer and the Profile is not represented. It appears as "None". You have to check the raw config to determine if the profile was actually assigned to the peer. This is on 2.8.1 (all packages up to date as of the date/time of this post). UPDATE: if re-edit and save (without re-configuring the profile none to what you want) - the save will strip the profile from the peer.
  • Discussions about the Tailscale package

    91 Topics
    611 Posts
    T
    Hi All, I use HAProxy to redirect to a range of https internal resources, this works really well at the moment through the WAN where I have source limits set up, and I can connect to the internal resources from limited external IP Addresses. Given I have tailscale I would like to basically be able to put custom dns entries in to point these hostnames to my pfsense tailscale IP4 address (100.89.148.118) but I am not having any luck getting this working. At the moment, I am just trying to connect to HAProxy using https://100.89.148.118 but it is getting blocked by the firewall. Sep 11 11:55:58 tailscale0 Default deny rule IPv4 (1000000103) 100.89.148.10:53148 100.89.148.118:443 TCP:S I have tried with and without NAT redirecting internally to 127.0.0.1, and I also have rules set up to allow any traffic to and from my tailnets (defined in an alias) but I still keep getting these connections from my other tailscale machines being blocked on the pfsense machine. Can someone give me some pointers on what I am missing because I can see the requests are coming through to the pfsense machine, and in theory the rules should allow it through but I cant see why they don't. I do have tailscale ACL in place, but clearly that is not an issue as the requests are making it through to the firewall. 0/0 B IPv4+6 TCP/UDP TailNets * TailNets * * none Allow across Tailnets 0/0 B IPv4+6 TCP/UDP * * * 443 (HTTPS) * none Allow Tailscale IP4 I also tried adding a EasyRule but because the tailscale0 interface doesn't exist in pfsense it throws an error and won't let me add that rule. Appreciate any help or tips, Cheers.
  • Discussions about WireGuard

    700 Topics
    4k Posts
    Bob.DigB
    @HFADmin If it is no Site2Site-VPN then you don't need any gateways in the first place... If that is true but you want to monitor the connection then you could create dummy-gateways just to ping the remote ip-addresses.
  • SpamD

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    ?
    Read the forum thread on the subject, several people have already discussed their setup.
  • LightSquid Issue

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    J
    @jan: Hi Guys, I've installed Squid and LightSquid respectively, I've also tried installing squidguard but don't have to luck to make it work, just used OpenDNS instead ;D  anyways back to the real issue, LightSquid seems to be acting quite odd. Although there are reports on the LightSquid Report page but when I looked at it the results are quite odd, e.g., for this day the total bytes is only 4MB. I have more than two hundred users and I can't believe they will only consume that much. Another thing is when I looked at the individual ip's report and compared them, all of them browsed the same three sites which is not true. I think Squid stopped for some reason that is why there the LightSquid report is odd and pfSense gui is still saying that it's running. Has anybody encountered this issue? How did you resolved it? Many thanks in advance. Jan Helo, jan, Be careful, as submicron - Global Moderator - Sr. Member, said on: http://forum.pfsense.org/index.php/topic,5729.msg54580.html#msg54580 "In fact, … installation of many packages, some of which are problematic." You can be triyng to install many packages (5 or more), and/or tryng to use a "problematic" package, or using it in conjuction with a "problematic" package. I sugest you, to try the same, but installing less packages. Regards.
  • Update Proxy

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    D
    @Rom: Hello, it is possible to automate update of blacklist on squidguard? In this version not relised.
  • Snort signatures update issue?

    Locked
    22
    0 Votes
    22 Posts
    13k Views
    B
    I have tried both fixes (curl and ini_set - seperatley) but finding that it takes forever to download the rules files no matter what I use. If I download the exact same URL that /usr/local/www/snort_download_rules.php is using at the same time but on a desktop that is on the LAN net behind pfSense, it downloads in a couple of minutes. (no caches involved) Multiple attempts on the pfSense box return the same results. Traffic shaper is turned off and pfSense is 1.2 prod. ls on the temp dir (eg /tmp/snortRulesJ0rIr3/) show it downloading, but very slow .. -rw-r–r--  1 root  wheel  167363 Jun 14 20:02 snortrules-snapshot-CURRENT.tar.gz -rw-r--r--  1 root  wheel  6637801 Jun 14 20:26 snortrules-snapshot-CURRENT.tar.gz Once done, the rules file is a complete file, but Snort downloading seems to hang and does not download the md5 hash. Is there any other additional hacking needs to be done to the snort_download_rules.php file to allow it to progress ? Does anybody have the above fixes to consistently work ? Thanks.
  • Proxy only for por 80

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    X
    hello jose, i'm not a portugeese.. :) since mhab tell me bout the link, i followed that and its solved my probs. yes, i'll follow ur suggestion :) thanks for that…
  • Snort crashed and won't restart correctly

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    J
    There's a problem with the snort package (or maybe the web configurator?). Sometimes it does not put the full startup command in the snort startup config (/usr/local/etc/rc.d/snort.sh). If you look in that config, it should point to the snort binary, but sometimes after you make a configuration change that entry gets removed. I've also noticed that the web configurator's service page often does not show the correct status for whether snort is running (or not). The only way to know for sure is to login via ssh and look at the "top" status, or type "ps auxw | grep snort" to see if the process is running. Also… some of the rulesets do not work at all (snort will not startup). Additionally, if you run too many rules, snort will not start. It takes a bit of work to get the snort package to work reliably on pfsense.
  • ASSP

    Locked
    5
    0 Votes
    5 Posts
    4k Views
    ?
    No one should be running pfSense 1.2-RCs anymore.  If this package only works in an RC and not the final release, then that's a problem.
  • Openbgpd - bgpd.sock missing

    Locked
    3
    0 Votes
    3 Posts
    6k Views
    D
    search is your friend… http://forum.pfsense.org/index.php/topic,6628.0.html
  • 1 WAN, 2 LAN, cache on WAN?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S
    at the moment i am using squid and lightsquid, as caching is one of the main reasons i chose pfsense over m0n0wall. if its not possible to cache a 2nd lan interface (by any method, trying to bind to WAN was just an experiment) its not a huge loss, but it would be useful
  • Squid starts many ' pinger ' processes

    Locked
    4
    0 Votes
    4 Posts
    20k Views
    ?
    The proper way to do this would be to notify the package maintainer to fix this.  If you go about fixing this yourself, be sure to pass the patch along to the maintainer as you are right, almost nobody running pfSense needs to use the pinger process.
  • I would love to get my hands on an ettercap package for pfsense

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    C
    Do this on a test system like a vmware version fo pfsense to test out prior to testing on your production box Doing this setup is at your own risk First off I recommend etherape instead of ettercap because the version on the site is ettercap gtk2 which requires X do a uname on your system determine the release version you have 6.2 Release in my case.(using pfsense 1.2 release ) then setup the environment variable to the appropriate version of freebsd. the env is as follows set PKG_PATH=ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ the do pkg_add -v ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ettercap-gtk2-0.7.3_5,1.tbz
  • Configuration of squidguard

    Locked
    13
    0 Votes
    13 Posts
    9k Views
    D
    Edit and store you ACL's.
  • IMspector and WLAN connections.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    J
    No, encryption is done at link layer, imspector dont even know what is happening at link layer, it works at a higher layer. But, prolly the redirection rule used by IMspector is issued only to packets comming from/to the LAN/WAN interfaces. does your WLAN is a WLAN board inside pfSense itself ? Or a AP attached to a switch on Lan port ? (Sorry for bad english)
  • FreeRadius

    Locked
    13
    0 Votes
    13 Posts
    6k Views
    M
    This is my first screenshot… [image: screen.jpg]
  • Block msn (messenger) using squid

    Locked
    6
    0 Votes
    6 Posts
    5k Views
    J
    @submicron: It's hardly simpler.  In fact, your method requires the installation of many packages, some of which are problematic.  This approach is much simpler, requiring a few squid ACLs.  Incidentally, there are a number of posts on the squid support mailing list talking about using squid to filter various IM clients.  They're all very detailed and helpful. Hello “submicron” “submicron”, as a Packages Moderator,  I think I only now have understand your point. The problem, is that I have been blind and stupid till now, and haven’t already seem a so simple ting. You told  “installation of many packages”, and this are the key words! Only now I understood the key word: 5 packages are “many” Pf sense does not support the installation of several (“many”) packages, and I was trying to do that. So, in conclusion, I should not try to install so many packages, and I should install fewer, might one or two in maximum. Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid. It would be nice that we could install a minimum set of packages that could transform PFSense in a true and decent firewall, doing some cache (Squid ) at the same time we had some evidences that the tings were working (Lightsquid ). I thought that I was not trying to install nothing special…. (like Dashboard, LCDproc, Zabbix, Spand nider (even) Snort)) Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid. Regards.
  • Squid crashes frequently need help !!!

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    M
    I have done that, but did not helped. But when i change back the Level 1 subdirectories from 32 back 16 it works…. Bug in in the package ?
  • Release of squid and squidguard Package

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    R
    thank's!!
  • Lightsquid package Test

    Locked
    70
    0 Votes
    70 Posts
    72k Views
    J
    @dvserg: Do yuo click 'full refresh' button on LS gui? Yes I did, I click both Refresh Now and Refresh full to no avail. I have another pfsense deployment yesterday and squid/lightsquid package works just fine, I can't seem to figure out this one though, perhaps a hard drive failure?
  • Confusion on package installation

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    D
    I wrote the quote in Perry's post, based in no small part on my experience as a developer elsewhere (but not in this project). Though I didn't make it clear, the mention about downloading and bootstrapping was thinking of the developer ISO in the context of giving early access to those who are conversant with the internals of pfSense. When you first run the developer ISO after installation, a bootstrap process grabs the latest version of the configured FreeBSD and pfSense CVS branches (or HEAD in the pfSense case; you can't use FreeBSD HEAD nor should you want to) and builds a normal ISO. Whilst you can check out pfSense 1.3, you'll find it almost impossible to build as I don't think there's a publicly available pfSense developer ISO based on FreeBSD 7.0. Upgrading the FreeBSD version in a developer installation is very much non-trivial. I am sure we will see snapshots and, later on, beta builds of 1.3 - but the code needs to be ready for those builds to be released. Giving early access when it isn't ready for public viewing causes the problems mentioned in my quote. Neither pfSense nor FreeBSD works on a timed release schedule - in a similar vein, there is currently no timescale for FreeBSD 7.1. As someone who is very familiar with FreeBSD, though not as familiar with the pfSense internals, I thought I'd try to explain some background that will hopefully help silvermage and others in a similar position. pfSense 1.2.1 is on its way, which is based on FreeBSD 6.3 rather than the 6.2 of pfSense 1.2-RELEASE. The pfSense team have stated that they hope to release 1.2.1 by the end of May 2008, which is the end of life date of FreeBSD 6.2-RELEASE (and the point at which there's no longer any FreeBSD security team support for it). There are a great deal of improvements in FreeBSD 6.3 - including better hardware support together with various enhancements and bug fixes that were suitable for backporting from the active development in the HEAD of FreeBSD CVS. FreeBSD refers to such backports as MFC - Merge From Current (FreeBSD CVS HEAD is referred to as FreeBSD CURRENT). Because FreeBSD 6.3-RELEASE was released so long after 6.2-RELEASE, the 6.3 FreeBSD packages are much more up to date than the 6.2 ones. In fact, the FreeBSD 6.3-RELEASE packages are the same versions as in 7.0-RELEASE because the release cycles of the two OS versions were aligned from a ports/packages point of view. (There were a handful of cases where there were security flaws found in packages between the two OS release dates, so a later version might just have shipped in 7.0-RELEASE in that case). This should help pfSense package developers, as work done on pfSense 1.2.1 should hopefully be easy to port to the FreeBSD 7 based pfSense 1.3. You talked about different Linux distributions (or 'flavours'). There's no such concept with the BSDs - each is a kernel and userland, unlike Linux where Linux is technically only the kernel and it's up to each distribution to come up with a userland. Each approach has strengths and weaknesses - I prefer the FreeBSD approach, but I can see how there are advantages in being able to have an OS distribution that's packaged to suit your intended application. Of course, there is code sharing between the BSDs and even from beyond the BSDs when licences are compatible. OpenBSD's OpenSSH, in its portable guise, is used in almost every free *NIX operating system, incluidng the other BSDs. OpenSolaris's ZFS has been ported to FreeBSD - though it's still an experimental feature in FreeBSD 7.0. There are also derivative distributions - from FreeBSD there's the FreeSBIE Live CD, m0n0wall and pfSense amongst others. There's usually no trickery needed to install software on FreeBSD. If a FreeBSD port is compatible with a particular major OS version, a binary package will be produced for that version. The port itself, in conjunction with the ports framework, deals with the differences between the OS versions. If the source material for a port is only available as a binary for a particular major OS version, it is usually possible to use that binary on a later major OS version using the compatibility features of the OS and the compatibility libraries, so a package is still possible - if so, this is transparent to the user. The port maintainers and ports committers do all this work for the end users - though FreeBSD PRs (problem reports) with feature requests, bug reports and especially patches are always welcome for any issue you have with a FreeBSD port or package. Some Linux binaries can be used on FreeBSD via FreeBSD's Linux emulation. There are some examples amongst the ports and packages of this - usually linux appears in the name of the port or package. As is often said on these forums, FreeBSD is not Linux. Linux shell scripters can get caught out on FreeBSD because bash is not the default shell, /bin/sh is not bash, and bash is not installed unless you install the bash port/package or install bash from source. Similarly, the default make program on FreeBSD is BSD make - if you need GNU make (gmake on FreeBSD), you need to install the gmake port/package or install from source. If you wish to do any pfSense development, it may pay to familiarise yourself with FreeBSD, its documentation and ports/packages system. A FreeBSD port is simply the recipe to create a binary package - though installing from ports often allows you to tune the port to your requirements. I've yet to get into pfSense package development, though I'm going to explore the possibility of an apcupsd package. apcupsd has better support for SNMP managed UPSes than nut - my server rack has such a UPS. I'm grateful for Perry's links - I knew about the devwiki, but the last one is new to me. I wonder if the right way to develop this is to experiment on the version of FreeBSD i386 corresponding to the pfSense version you're developing for, check your work at the shell of a pfSense developer ISO, then start to build the UI and other components required for a pfSense package. That's only a thought from me, however - it's not based on any experience.
  • I need support for APC SNMP in NUT

    Locked
    7
    0 Votes
    7 Posts
    5k Views
    D
    I am still looking into making an apcupsd package for pfSense. Unfortunately I'm very busy at the moment, including with a couple of other tasks in my software development pipeline that really need doing before this one. The FreeBSD side of this holds no fears - I'm used to administering FreeBSD machines, and I'm very familiar with the FreeBSD ports and packages system (I maintain several FreeBSD ports). However, I'm not very familiar with the pfSense package system yet - I need some time to familiarise myself with it. For now, my pfSense machine is running from a LiveCD with the configuration on a USB memory key. A power failure is unlikely to damage such a system, even though there's no way for it to interact with the UPS. At least deploying the new hardware put my production pfSense system on its permanent hardware platform and I could retire the horrid Cyrix 333MHz PC I threw together from junk box parts when the Ethernet switch in my old router failed in December. I want to move pfSense onto the new machine's hard disks so that I can install packages. That is blocking on two things - I need a UPS monitoring solution I'm happy with, also I need to decide if I'm going to install a RAID controller so that I can use two hard disks in RAID 1 for added robustness (as it stands, the machine has two identical hard disks but no RAID controller). I have the pfSense developer ISO running under VMware Workstation 6 on a Windows machine, so I have a platform to experiment on before deploying my eventual solution to my production firewall. I will update this thread if I have anything to share. If I do develop an apcupsd package, it will be contributed to the pfSense project.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.