Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    tinfoilmattT
    @johnpoz said in Please help to configure HAProxy to serve certifficate on internal LAN too: Yeah - what part do you not understand if you always resolve nextcloud.domain.tld so that it hits your haproxy on your pfsense wan IP are you not getting? You have 2 options - use a different domain internally and always go to nextcloud.publicdomain.tld, or use the same domain internally as external and run into the problem of what IP it resolves to.. Change your local domain to say home.arpa or .internal or atleast something different than the public domain your using to point to pfsense wan IP on the public internet. You are shooting yourself in the foot trying to use the same domain externally as internally. There are ways around it, but they complicate the setup. For example you might be able to use views in unbound as one way to work around the problem. You could use only host entries for all your resources. But then again you run into a problem of using the fqdn for this service, now always pointing to your wan IP.. And that is great when you want to access the service haproxy is doing - but if you want to access that resource on some other service that haproxy doesn't handle - like say simple file sharing.. You are going to have problems. Since you clearly do not understand how any of this works - the simple solution is change the local domain you are using so it is not the same as the public domain you want to use to get to your nextcloud. This tone is outrageous directed at somebody who acknowledged right off the rip that English is not their first language. How many languages do you speak, John? And safely assuming it's only one—English of course—take it from a fellow English native that you'd do well to say more with less words. You otherwise were directing OP in the right direction in my opinion.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    DARAD
    Hello team, I have a Netgate 8200 running 24.11-RELEASE (amd64) with Suricata 7.0.8_5 package installed. Suricata doesn't seem to start. It loops to red once I press the Play button on the interface. It leaves no logs in the System logs, it leaves no logs in suricata.log at /var/log/suricata/suricata_ovpns933787/suricata.log I tried launching it manually: # /usr/local/bin/suricata -V or # /usr/local/bin/suricata -c /usr/local/etc/suricata/suricata_33787_ovpns9/suricata.yaml -i suricata_ovpns933787 and I get this output ld-elf.so.1: /usr/local/bin/suricata: Undefined symbol "__strlcpy_chk@FBSD_1.8" Thanks in advance, Dara
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    573 Topics
    3k Posts
    dennypageD
    @kabeda If memory serves, that old version of ntopng did not run as user ntopng, but as user nobody. There are lots of problems in that old version. Anyway, check the ownership and permissions of /var/db/ntopng and make sure it matches the user that ntopng runs as. You may need to set ownership of the entire hierarchy. Example: /usr/sbin/chown -R nobody:nobody /var/db/ntopng However, the better choice would be to upgrade to a more recent version.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    tinfoilmattT
    @netboy said in is something wrong with pfBlockerNG?: After my post, I "changed" DNSBL -> DNSBL mode from "unbound python mode" to "unbound mode" and so far i have no issues. Terrible idea. Moving backwards in development history there.
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    102 Topics
    3k Posts
    dennypageD
    @fjmp24 said in Notification: UPS ups battery is low: If I remove ignorelb directive, my UPS shuts down after 16 seconds This means your UPS is signaling a low battery. Either your battery is bad, or your UPS is bad. Most likely battery, but you never know. I suggest reaching out to Eaton support.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    503 Topics
    3k Posts
    M
    I am using the DNS-Update method I have to use a DNS-Sleep of 5 minutes to let the letsencrypt txt dns record update propagate. During this 5 minutes the acme-webgui times out. when the acme-webgui times out the Action list is NOT executed. How can I solve this ? Would it maybe be an idea to let the acme.sh script execute the actions in the action list as a post-hook instead of the web-gui? Or maybe add an option to add post-hooks in the webUI ?
  • Discussions about the FRR Dynamic Routing package on pfSense

    296 Topics
    1k Posts
    C
    This one has been tricky still not sure what to try. Any ideas?
  • Discussions about the Tailscale package

    93 Topics
    652 Posts
    M
    @elvisimprsntr Great in theory, not in practice. I'm the same, but there are unforseen events. Power outages, crashes, etc. And yes, I'm running a UPS.
  • Discussions about WireGuard

    715 Topics
    4k Posts
    S
    @LaUs3r Yeah, I added those IPs, but after restarting pfSense, the WireGuard status says “handshake failed.” Also, when I do nslookup us-bos.prod.surfshark.com, I get two different sets of IPs. For example: • The first time I get 43.225.189.108 and 43.225.189.118 • The next time I get 149.40.50.216 and 149.40.50.290 So I was wondering can I add both sets of IPs, and put a “0” at the end of each, and use /24 for both IPs? I reached out to Surfshark support, and they sent me their official pfSense WireGuard setup guide see the guide here in the guide they mention 10.14.0.2 for static routes
  • Snort crashed and won't restart correctly

    Locked
    7
    0 Votes
    7 Posts
    3k Views
    J
    There's a problem with the snort package (or maybe the web configurator?). Sometimes it does not put the full startup command in the snort startup config (/usr/local/etc/rc.d/snort.sh). If you look in that config, it should point to the snort binary, but sometimes after you make a configuration change that entry gets removed. I've also noticed that the web configurator's service page often does not show the correct status for whether snort is running (or not). The only way to know for sure is to login via ssh and look at the "top" status, or type "ps auxw | grep snort" to see if the process is running. Also… some of the rulesets do not work at all (snort will not startup). Additionally, if you run too many rules, snort will not start. It takes a bit of work to get the snort package to work reliably on pfsense.
  • ASSP

    Locked
    5
    0 Votes
    5 Posts
    4k Views
    ?
    No one should be running pfSense 1.2-RCs anymore.  If this package only works in an RC and not the final release, then that's a problem.
  • Openbgpd - bgpd.sock missing

    Locked
    3
    0 Votes
    3 Posts
    6k Views
    D
    search is your friend… http://forum.pfsense.org/index.php/topic,6628.0.html
  • 1 WAN, 2 LAN, cache on WAN?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    S
    at the moment i am using squid and lightsquid, as caching is one of the main reasons i chose pfsense over m0n0wall. if its not possible to cache a 2nd lan interface (by any method, trying to bind to WAN was just an experiment) its not a huge loss, but it would be useful
  • Squid starts many ' pinger ' processes

    Locked
    4
    0 Votes
    4 Posts
    20k Views
    ?
    The proper way to do this would be to notify the package maintainer to fix this.  If you go about fixing this yourself, be sure to pass the patch along to the maintainer as you are right, almost nobody running pfSense needs to use the pinger process.
  • I would love to get my hands on an ettercap package for pfsense

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    C
    Do this on a test system like a vmware version fo pfsense to test out prior to testing on your production box Doing this setup is at your own risk First off I recommend etherape instead of ettercap because the version on the site is ettercap gtk2 which requires X do a uname on your system determine the release version you have 6.2 Release in my case.(using pfsense 1.2 release ) then setup the environment variable to the appropriate version of freebsd. the env is as follows set PKG_PATH=ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ the do pkg_add -v ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/ettercap-gtk2-0.7.3_5,1.tbz
  • Configuration of squidguard

    Locked
    13
    0 Votes
    13 Posts
    9k Views
    D
    Edit and store you ACL's.
  • IMspector and WLAN connections.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    J
    No, encryption is done at link layer, imspector dont even know what is happening at link layer, it works at a higher layer. But, prolly the redirection rule used by IMspector is issued only to packets comming from/to the LAN/WAN interfaces. does your WLAN is a WLAN board inside pfSense itself ? Or a AP attached to a switch on Lan port ? (Sorry for bad english)
  • FreeRadius

    Locked
    13
    0 Votes
    13 Posts
    6k Views
    M
    This is my first screenshot… [image: screen.jpg]
  • Block msn (messenger) using squid

    Locked
    6
    0 Votes
    6 Posts
    5k Views
    J
    @submicron: It's hardly simpler.  In fact, your method requires the installation of many packages, some of which are problematic.  This approach is much simpler, requiring a few squid ACLs.  Incidentally, there are a number of posts on the squid support mailing list talking about using squid to filter various IM clients.  They're all very detailed and helpful. Hello “submicron” “submicron”, as a Packages Moderator,  I think I only now have understand your point. The problem, is that I have been blind and stupid till now, and haven’t already seem a so simple ting. You told  “installation of many packages”, and this are the key words! Only now I understood the key word: 5 packages are “many” Pf sense does not support the installation of several (“many”) packages, and I was trying to do that. So, in conclusion, I should not try to install so many packages, and I should install fewer, might one or two in maximum. Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid. It would be nice that we could install a minimum set of packages that could transform PFSense in a true and decent firewall, doing some cache (Squid ) at the same time we had some evidences that the tings were working (Lightsquid ). I thought that I was not trying to install nothing special…. (like Dashboard, LCDproc, Zabbix, Spand nider (even) Snort)) Anyway, PFSense is still a good firewall and Thank you for information. I have been blind and stupid. Regards.
  • Squid crashes frequently need help !!!

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    M
    I have done that, but did not helped. But when i change back the Level 1 subdirectories from 32 back 16 it works…. Bug in in the package ?
  • Release of squid and squidguard Package

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    R
    thank's!!
  • Lightsquid package Test

    Locked
    70
    0 Votes
    70 Posts
    72k Views
    J
    @dvserg: Do yuo click 'full refresh' button on LS gui? Yes I did, I click both Refresh Now and Refresh full to no avail. I have another pfsense deployment yesterday and squid/lightsquid package works just fine, I can't seem to figure out this one though, perhaps a hard drive failure?
  • Confusion on package installation

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    D
    I wrote the quote in Perry's post, based in no small part on my experience as a developer elsewhere (but not in this project). Though I didn't make it clear, the mention about downloading and bootstrapping was thinking of the developer ISO in the context of giving early access to those who are conversant with the internals of pfSense. When you first run the developer ISO after installation, a bootstrap process grabs the latest version of the configured FreeBSD and pfSense CVS branches (or HEAD in the pfSense case; you can't use FreeBSD HEAD nor should you want to) and builds a normal ISO. Whilst you can check out pfSense 1.3, you'll find it almost impossible to build as I don't think there's a publicly available pfSense developer ISO based on FreeBSD 7.0. Upgrading the FreeBSD version in a developer installation is very much non-trivial. I am sure we will see snapshots and, later on, beta builds of 1.3 - but the code needs to be ready for those builds to be released. Giving early access when it isn't ready for public viewing causes the problems mentioned in my quote. Neither pfSense nor FreeBSD works on a timed release schedule - in a similar vein, there is currently no timescale for FreeBSD 7.1. As someone who is very familiar with FreeBSD, though not as familiar with the pfSense internals, I thought I'd try to explain some background that will hopefully help silvermage and others in a similar position. pfSense 1.2.1 is on its way, which is based on FreeBSD 6.3 rather than the 6.2 of pfSense 1.2-RELEASE. The pfSense team have stated that they hope to release 1.2.1 by the end of May 2008, which is the end of life date of FreeBSD 6.2-RELEASE (and the point at which there's no longer any FreeBSD security team support for it). There are a great deal of improvements in FreeBSD 6.3 - including better hardware support together with various enhancements and bug fixes that were suitable for backporting from the active development in the HEAD of FreeBSD CVS. FreeBSD refers to such backports as MFC - Merge From Current (FreeBSD CVS HEAD is referred to as FreeBSD CURRENT). Because FreeBSD 6.3-RELEASE was released so long after 6.2-RELEASE, the 6.3 FreeBSD packages are much more up to date than the 6.2 ones. In fact, the FreeBSD 6.3-RELEASE packages are the same versions as in 7.0-RELEASE because the release cycles of the two OS versions were aligned from a ports/packages point of view. (There were a handful of cases where there were security flaws found in packages between the two OS release dates, so a later version might just have shipped in 7.0-RELEASE in that case). This should help pfSense package developers, as work done on pfSense 1.2.1 should hopefully be easy to port to the FreeBSD 7 based pfSense 1.3. You talked about different Linux distributions (or 'flavours'). There's no such concept with the BSDs - each is a kernel and userland, unlike Linux where Linux is technically only the kernel and it's up to each distribution to come up with a userland. Each approach has strengths and weaknesses - I prefer the FreeBSD approach, but I can see how there are advantages in being able to have an OS distribution that's packaged to suit your intended application. Of course, there is code sharing between the BSDs and even from beyond the BSDs when licences are compatible. OpenBSD's OpenSSH, in its portable guise, is used in almost every free *NIX operating system, incluidng the other BSDs. OpenSolaris's ZFS has been ported to FreeBSD - though it's still an experimental feature in FreeBSD 7.0. There are also derivative distributions - from FreeBSD there's the FreeSBIE Live CD, m0n0wall and pfSense amongst others. There's usually no trickery needed to install software on FreeBSD. If a FreeBSD port is compatible with a particular major OS version, a binary package will be produced for that version. The port itself, in conjunction with the ports framework, deals with the differences between the OS versions. If the source material for a port is only available as a binary for a particular major OS version, it is usually possible to use that binary on a later major OS version using the compatibility features of the OS and the compatibility libraries, so a package is still possible - if so, this is transparent to the user. The port maintainers and ports committers do all this work for the end users - though FreeBSD PRs (problem reports) with feature requests, bug reports and especially patches are always welcome for any issue you have with a FreeBSD port or package. Some Linux binaries can be used on FreeBSD via FreeBSD's Linux emulation. There are some examples amongst the ports and packages of this - usually linux appears in the name of the port or package. As is often said on these forums, FreeBSD is not Linux. Linux shell scripters can get caught out on FreeBSD because bash is not the default shell, /bin/sh is not bash, and bash is not installed unless you install the bash port/package or install bash from source. Similarly, the default make program on FreeBSD is BSD make - if you need GNU make (gmake on FreeBSD), you need to install the gmake port/package or install from source. If you wish to do any pfSense development, it may pay to familiarise yourself with FreeBSD, its documentation and ports/packages system. A FreeBSD port is simply the recipe to create a binary package - though installing from ports often allows you to tune the port to your requirements. I've yet to get into pfSense package development, though I'm going to explore the possibility of an apcupsd package. apcupsd has better support for SNMP managed UPSes than nut - my server rack has such a UPS. I'm grateful for Perry's links - I knew about the devwiki, but the last one is new to me. I wonder if the right way to develop this is to experiment on the version of FreeBSD i386 corresponding to the pfSense version you're developing for, check your work at the shell of a pfSense developer ISO, then start to build the UI and other components required for a pfSense package. That's only a thought from me, however - it's not based on any experience.
  • I need support for APC SNMP in NUT

    Locked
    7
    0 Votes
    7 Posts
    5k Views
    D
    I am still looking into making an apcupsd package for pfSense. Unfortunately I'm very busy at the moment, including with a couple of other tasks in my software development pipeline that really need doing before this one. The FreeBSD side of this holds no fears - I'm used to administering FreeBSD machines, and I'm very familiar with the FreeBSD ports and packages system (I maintain several FreeBSD ports). However, I'm not very familiar with the pfSense package system yet - I need some time to familiarise myself with it. For now, my pfSense machine is running from a LiveCD with the configuration on a USB memory key. A power failure is unlikely to damage such a system, even though there's no way for it to interact with the UPS. At least deploying the new hardware put my production pfSense system on its permanent hardware platform and I could retire the horrid Cyrix 333MHz PC I threw together from junk box parts when the Ethernet switch in my old router failed in December. I want to move pfSense onto the new machine's hard disks so that I can install packages. That is blocking on two things - I need a UPS monitoring solution I'm happy with, also I need to decide if I'm going to install a RAID controller so that I can use two hard disks in RAID 1 for added robustness (as it stands, the machine has two identical hard disks but no RAID controller). I have the pfSense developer ISO running under VMware Workstation 6 on a Windows machine, so I have a platform to experiment on before deploying my eventual solution to my production firewall. I will update this thread if I have anything to share. If I do develop an apcupsd package, it will be contributed to the pfSense project.
  • BandwitdthD - CoreDump after few hours.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    Z
    512MB of DDR ram, 1.7GHz Pent4, 40GB hdd. Running pfSense 1.2, squid and bandwidthD. Serving only 6 or so PC's. I know squid isnt causing the problem as i just installed, as in bandwithd was acting up before installing it. Not that it might not contribute to the problem. Edit: Stats page currently reporting 34% Ram usage. I have another 512MB stick i could use if 512 is not enough.
  • Monitor web based chat and meebo using imspector

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    Cry HavokC
    Hint: Search - this has been discussed before. Short answer: no.
  • Playing with XTRadius

    Locked
    9
    0 Votes
    9 Posts
    5k Views
    J
    i´ll try those tools you mentioned, but, one of my tasks is to make the current accounting software (that accounts most things in the company) compatible with the RADIUS backend (currently they do everything using a small software developed using Delphi, but this software cannot enforce anything upon users, the network owner must manually do everything, from blocking users to creating logins… this sux) so i thought freepascal was a nice way to go, extending the software and porting (actually, just copy and paste) some of its functions to the radius backend running at pfSense... and the current setup (using monowall captive portal user list) cannot even give per user bandwidth... Everyone has the same network speed (bad comercial model). These people wont understand RADIUS reply, RADIUS bla bla bla, this is out of this world for them...
  • Custom Error Page redirect for SquidGuard?

    Locked
    9
    0 Votes
    9 Posts
    16k Views
    M
    [smacks head]duh![/smacks head] Thanks, I had a major brain fart.  We do use a different than 80 port, and of course that fixed it. Thanks for everything (including SG!) -Marty
  • LDAP with Squid

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    D
    Typically options such as LDAP support that create added dependencies on fairly 'heavyweight' libraries are disabled by default in FreeBSD ports - and are therefore disabled in the FreeBSD package. This is to avoid pulling in a load of unnecessary baggage that many will not use, also there are at least four options for the OpenLDAP client libraries (2.3 or 2.4; in either case with or without SASL). The www/squid30 port does have an LDAP option that you can set, but you'll need a FreeBSD box (or virtual machine) to build a suitable package, and you're on your own so far as getting the LDAP features going in pfSense.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.