Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    cyb3rtr0nianC

    @bmeeks So after upgrading to the newest PfSense 2.8.0 everything is now working like a charm!

    Suricata no longer seems to strip off tags like it did before! Which means I can now use my network segmented by VLANs and still use the benefits of Suricata Inline IPS! Very niiize!

    I checked in the Alerts section and it is indeed generating the correct alerts from the different VLAN sections, I put Inline IPS on the parent interface of all the VLANs.

    I assume this is because the FreeBSD version is also updated with the new PfSense 2.8.0 version?

    Because before, as soon as I selected Inline IPS mode, my entire VLAN tagging would break and nothing was reachable until I switched back to Legacy mode.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    GertjanG

    @AlexK-0 said in Can't receive GeoIP databases updates anymore, banned:

    Days ago, I received from MaxMind an email, notifying me that my country has been banned to receive GeoLite City database updates.

    You've found a reason to use a VPN.

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    99 Topics
    2k Posts
    K

    @elvisimprsntr thanks for your suggestion. I will give it a try.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG

    @EChondo

    What's your pfSense version ?
    The instructions are shown here :

    1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png

    A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate.

    @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy:

    I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess.

    No need to wait x days.
    You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    89 Topics
    574 Posts
    A

    Hello,
    I am unable to get the Tailscale package to work. The page at VPN > Tailscale > Authentication is stuck. It displays the error "Tailscale is not online," but also shows a "Logout and Clean" button, with no option to log in.
    link text

    This state persists even after performing the following troubleshooting steps:

    Rebooting the pfSense router.

    Completely uninstalling and reinstalling the Tailscale package multiple times.

    Clearing browser cache and using a private browser window.

    Toggling the main "Enable Tailscale" checkbox in the settings.

    Checking the logs, which show the service gets a "terminate" signal and shuts down cleanly; it does not crash.

    Manually trying to delete the state file with rm /var/db/tailscale/tailscaled.state, which failed because the file does not exist.

    It appears that the package's configuration is corrupted in a way that persists even after reinstallation. Can anyone advise on how to perform a complete manual cleanup of all Tailscale files and settings?

  • Discussions about WireGuard

    689 Topics
    4k Posts
    P

    @patient0 Thanks for further suggestions. The tunnel is definitely up and so I don't think this is a CGNAT issue after all. WAN firewall rule is in place for UDP on port 51823 (otherwise the tunnel wouldn't work, right?). I can ping from client 1 -> client 2 and visa versa and also ping all points in between like you suggest. I just can't open an HTTPS connection from pfSenseB from Client 1 using a browser. But I can do this the other way round i.e. from Client 2 to pfSenseA

    I will try and do some packet capture to see if that reveals anything.

  • OpenNTPD - Doesn't seem to do much good?

    Locked
    3
    0 Votes
    3 Posts
    5k Views
    B

    @jeroen234:

    on the time tab in windows put the lanipadress of youre pfsense server
    and windows will use youre openntpd demon for its clock settings

    No. Please follow my links. NTP has a different RFC than DAYTIME. Some NTP severs seem to offer DAYTIME but not this package. These services even run on different ports!

  • Computer stops when adding squid to 1.01

    Locked
    7
    0 Votes
    7 Posts
    4k Views
    J

    Processor speed: 2.7 GHz 
    Processor type: Intel Pentium 4 class 
    Processor version: x86 F15 M4 S1 
    Processor features: MMX, SSE3, x86-64

    Memory 
    Total physical memory: 1536 MB

    Network connections 
    Physical network adapter: Realtek RTL8139/810x Family Fast Ethernet NIC
    Physical network adapter: Realtek RTL8139/810x Family Fast Ethernet NIC

  • Stunnel listen on WAN interface instead of IP

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Snort restart/ruleset problems

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    S

    Snort + Bridge should be just fine…

  • Bittorent

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    T

    Hell…

    thanks scott we can use pfSense...  ;D

  • Spamd

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    R

    Bill,

    Could you see my post and respond if you get a chance?

  • Snort - Please help

    Locked
    31
    0 Votes
    31 Posts
    12k Views
    N

    Hoba : Thx for the quick reply. will try that one and we'll see how it goes

  • Squid will not start on boot-up in transparent mode

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    T

    same problem here… but if there still remain some errors, just freshly reinstall 1.0.1 and then even more errors will be gone....

    same problems have been here ;-)

  • New Squid Access Control Fields

    Locked
    2
    0 Votes
    2 Posts
    4k Views
    D

    Sorry, I found a mistake squid.conf should read:
    http_access allow restrictedlist2 restricted_macs2
    not
    http_access allow restrictedlist1 restricted_macs2

    I also removed the restricted lists from the “delay_access 1 deny” entries. Restricted sites should be subject to the same restraints as normal users.

    CORRECTED .INC AND .XML FILE ATTACHED BELOW!!!!!!!

    new squid.conf:

    httpd_accel_host virtual
    httpd_accel_port 80
    httpd_accel_with_proxy on
    httpd_accel_uses_host_header on
    http_port 192.168.1.1:3128
    icp_port 0

    pid_filename /var/run/squid.pid
    cache_effective_user proxy
    cache_effective_group proxy
    error_directory /usr/local/etc/squid/errors/English
    visible_hostname localhost
    cache_mgr admin@localhost

    cache_access_log /dev/null
    cache_log /var/squid/log/cache.log
    cache_store_log none

    cache_dir diskd /var/squid/cache 100 16 256
    cache_mem 8 MB
    maximum_object_size 10 KB
    minimum_object_size 0 KB
    cache_replacement_policy heap LFUDA
    memory_replacement_policy heap GDSF
    offline_mode off

    No redirector configured

    acl all src 0.0.0.0/0
    acl localhost src 127.0.0.1
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 1025-65535
    acl sslports port 443 563
    acl manager proto cache_object
    acl purge method PURGE
    acl connect method CONNECT
    acl dynamic urlpath_regex cgi-bin ?
    acl allowed_subnets src 192.168.1.0/24
    acl unrestricted_hosts src "/var/squid/acl/unrestricted_hosts.acl"
    acl unrestricted_macs arp "/var/squid/acl/unrestricted_macs.acl"
    acl banned_hosts src "/var/squid/acl/banned_hosts.acl"
    acl banned_macs arp "/var/squid/acl/banned_macs.acl"
    acl restrictedlist1 url_regex -i "/var/squid/acl/restrictedlist1.acl"
    acl restricted_hosts1 src "/var/squid/acl/restricted_hosts1.acl"
    acl restricted_macs1 arp "/var/squid/acl/restricted_macs1.acl"
    acl restrictedlist2 url_regex -i "/var/squid/acl/restrictedlist2.acl"
    acl restricted_hosts2 src "/var/squid/acl/restricted_hosts2.acl"
    acl restricted_macs2 arp "/var/squid/acl/restricted_macs2.acl"
    acl whitelist url_regex -i "/var/squid/acl/whitelist.acl"
    acl blacklist url_regex -i "/var/squid/acl/blacklist.acl"
    no_cache deny dynamic
    http_access allow manager localhost
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports

    http_access allow localhost

    request_body_max_size 0 KB
    reply_body_max_size 0 allow all
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/10485760 -1/10485760
    delay_initial_bucket_level 100%
    delay_access 1 deny unrestricted_hosts
    delay_access 1 deny unrestricted_macs
    delay_access 1 allow all

    http_access deny banned_hosts
    http_access deny banned_macs
    http_access allow unrestricted_hosts
    http_access allow unrestricted_macs
    http_access allow restrictedlist1 restricted_hosts1
    http_access deny restricted_hosts1
    http_access allow restrictedlist1 restricted_macs1
    http_access deny restricted_macs1
    http_access allow restrictedlist2 restricted_hosts2
    http_access deny restricted_hosts2
    http_access allow restrictedlist2 restricted_macs2
    http_access deny restricted_macs2
    http_access allow whitelist
    http_access deny blacklist
    http_access allow allowed_subnets
    http_access deny all
    –------------------------------------------------------------------
    I’ve removed the old attached squid.inc.txt and added changes.

    Here is the squid files with .txt added for posting

    squid.inc.txt
    squid_nac.xml.txt

  • Squid PKG don't support header_access~?

    Locked
    7
    0 Votes
    7 Posts
    5k Views
    B

    Doh, I mistakenly thought we used the FreeBSD package of squid for our package.  Looks like we install it from pfSense.org.  Wonder what options were used in compiling that package.  If I get time, I'll see if the FreeBSD port works (chances are the reasons we have our own package are due to some of the addons - that are b0rked - we have for squid)

    –Bill

  • Squid problem with "Allow users on interface" check box

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • I can't install some packages

    Locked
    7
    0 Votes
    7 Posts
    4k Views
    Y

    Packages are working for me now. Thanks!

  • SPAMD

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    T

    works now… thanks !

  • Squid and NTOP stop working after some hours

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    H

    Monitor the values at status>system and stresstest your system (like running bittorrents and multiple http downloads).

  • Ntop does not work, when port, another than 80 is selected for WebGui

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Diag new states package

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Snort 1.0.1 bug?

    Locked
    9
    0 Votes
    9 Posts
    4k Views
    Y

    Looks like it fixed it.

  • Squid error - access denied

    Locked
    22
    0 Votes
    22 Posts
    18k Views
    H

    hint: diagnostics>edit file or diagnostics>command, download file? ;-)

  • Squid Traffic Managment does not work

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    H

    You also can restart squid from status>services btw.

  • Snort Problem

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    S

    @Brian_Andle:

    I did try your suggestion and it did not work. Also nothing shows up under Snort Blocked.

    Then your rules are not triggering.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.