1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    N

    Can I use pgblockerng aliases in Haproxy?

    80758505-9bad-4dad-a80b-c159be1045a2-image.png

    If it was a firewall rule, typing pfb would produce a dropdown to select.

    Here it has to be written, but will it work? Is it supported?

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    bmeeksB

    I saw where the Netgate kernel developer updated the Suricata package in the pfSense 25.07 development branch to work with the new kernel PPPoE driver. But so far as I know that updated package has not been migrated to 2.8 CE.

    Here is the commit into the DEVEL branch: https://github.com/pfsense/FreeBSD-ports/commit/68a06b3a33c690042b61fb4ccfe96f3138e83b72.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K

    @pulsartiger
    The database name is vnstat.db and its location is under /var/db/vnstat.
    With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    GertjanG

    @AlexK-0 said in Can't receive GeoIP databases updates anymore, banned:

    Days ago, I received from MaxMind an email, notifying me that my country has been banned to receive GeoLite City database updates.

    You've found a reason to use a VPN.

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    99 Topics
    2k Posts
    K

    @elvisimprsntr thanks for your suggestion. I will give it a try.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    johnpozJ

    @MacUsers

    https://help.zerossl.com/hc/en-us/articles/360060119933-Certificate-Revocation

    edit: oh you prob out of luck

    You can revoke any certificate issued via the ZeroSSL portal. Currently, certificates issued via ACME can not be revoked from inside the portal - please follow the instructions of your ACME client for revoking those certificates.

    the gui in pfsense does not have the ability to revoke - you prob have to move the certs to something you have certbot installed to and revoke that way.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    R

    I had a similar issue with Routed VTI over IPsec recently. FRR lost its neighbors after rebooting or when a tunnel went down. It never re-discovered it automatically. Only restarting FRR (either in GUI or via CLI) brought the neighbors back.

    When I manually added those under the OSPF neighbors tab in the GUI it seems to solve the problem as well.

  • Discussions about the Tailscale package

    88 Topics
    573 Posts
    luckman212L

    For 25.07 RC, this worked for me (run sh first)

    [25.07-RC][root@r1.lan]/root: sh # export IGNORE_OSVERSION=yes # pkg add https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.84.2.pkg # service tailscaled restart # tailscale up # tailscale version 1.84.2 go version: go1.24.4 # tailscaled -version 1.84.2 go version: go1.24.4

  • Discussions about WireGuard

    689 Topics
    4k Posts
    P

    @patient0 Thanks for further suggestions. The tunnel is definitely up and so I don't think this is a CGNAT issue after all. WAN firewall rule is in place for UDP on port 51823 (otherwise the tunnel wouldn't work, right?). I can ping from client 1 -> client 2 and visa versa and also ping all points in between like you suggest. I just can't open an HTTPS connection from pfSenseB from Client 1 using a browser. But I can do this the other way round i.e. from Client 2 to pfSenseA

    I will try and do some packet capture to see if that reveals anything.

Log in to post
Load new posts
  • B

    OpenNTPD - Doesn't seem to do much good?

    Locked
    3
    0 Votes
    3 Posts
    5k Views
    B

    @jeroen234:

    on the time tab in windows put the lanipadress of youre pfsense server
    and windows will use youre openntpd demon for its clock settings

    No. Please follow my links. NTP has a different RFC than DAYTIME. Some NTP severs seem to offer DAYTIME but not this package. These services even run on different ports!

  • H

    Computer stops when adding squid to 1.01

    Locked
    7
    0 Votes
    7 Posts
    4k Views
    J

    Processor speed: 2.7 GHz 
    Processor type: Intel Pentium 4 class 
    Processor version: x86 F15 M4 S1 
    Processor features: MMX, SSE3, x86-64

    Memory 
    Total physical memory: 1536 MB

    Network connections 
    Physical network adapter: Realtek RTL8139/810x Family Fast Ethernet NIC
    Physical network adapter: Realtek RTL8139/810x Family Fast Ethernet NIC

  • B

    Stunnel listen on WAN interface instead of IP

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • A

    Snort restart/ruleset problems

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    S

    Snort + Bridge should be just fine…

  • S

    Bittorent

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    T

    Hell…

    thanks scott we can use pfSense...  ;D

  • L

    Spamd

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    R

    Bill,

    Could you see my post and respond if you get a chance?

  • P

    Snort - Please help

    Locked
    31
    0 Votes
    31 Posts
    12k Views
    N

    Hoba : Thx for the quick reply. will try that one and we'll see how it goes

  • D

    Squid will not start on boot-up in transparent mode

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    T

    same problem here… but if there still remain some errors, just freshly reinstall 1.0.1 and then even more errors will be gone....

    same problems have been here ;-)

  • D

    New Squid Access Control Fields

    Locked
    2
    0 Votes
    2 Posts
    4k Views
    D

    Sorry, I found a mistake squid.conf should read:
    http_access allow restrictedlist2 restricted_macs2
    not
    http_access allow restrictedlist1 restricted_macs2

    I also removed the restricted lists from the “delay_access 1 deny” entries. Restricted sites should be subject to the same restraints as normal users.

    CORRECTED .INC AND .XML FILE ATTACHED BELOW!!!!!!!

    new squid.conf:

    httpd_accel_host virtual
    httpd_accel_port 80
    httpd_accel_with_proxy on
    httpd_accel_uses_host_header on
    http_port 192.168.1.1:3128
    icp_port 0

    pid_filename /var/run/squid.pid
    cache_effective_user proxy
    cache_effective_group proxy
    error_directory /usr/local/etc/squid/errors/English
    visible_hostname localhost
    cache_mgr admin@localhost

    cache_access_log /dev/null
    cache_log /var/squid/log/cache.log
    cache_store_log none

    cache_dir diskd /var/squid/cache 100 16 256
    cache_mem 8 MB
    maximum_object_size 10 KB
    minimum_object_size 0 KB
    cache_replacement_policy heap LFUDA
    memory_replacement_policy heap GDSF
    offline_mode off

    No redirector configured

    acl all src 0.0.0.0/0
    acl localhost src 127.0.0.1
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 1025-65535
    acl sslports port 443 563
    acl manager proto cache_object
    acl purge method PURGE
    acl connect method CONNECT
    acl dynamic urlpath_regex cgi-bin ?
    acl allowed_subnets src 192.168.1.0/24
    acl unrestricted_hosts src "/var/squid/acl/unrestricted_hosts.acl"
    acl unrestricted_macs arp "/var/squid/acl/unrestricted_macs.acl"
    acl banned_hosts src "/var/squid/acl/banned_hosts.acl"
    acl banned_macs arp "/var/squid/acl/banned_macs.acl"
    acl restrictedlist1 url_regex -i "/var/squid/acl/restrictedlist1.acl"
    acl restricted_hosts1 src "/var/squid/acl/restricted_hosts1.acl"
    acl restricted_macs1 arp "/var/squid/acl/restricted_macs1.acl"
    acl restrictedlist2 url_regex -i "/var/squid/acl/restrictedlist2.acl"
    acl restricted_hosts2 src "/var/squid/acl/restricted_hosts2.acl"
    acl restricted_macs2 arp "/var/squid/acl/restricted_macs2.acl"
    acl whitelist url_regex -i "/var/squid/acl/whitelist.acl"
    acl blacklist url_regex -i "/var/squid/acl/blacklist.acl"
    no_cache deny dynamic
    http_access allow manager localhost
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports

    http_access allow localhost

    request_body_max_size 0 KB
    reply_body_max_size 0 allow all
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/10485760 -1/10485760
    delay_initial_bucket_level 100%
    delay_access 1 deny unrestricted_hosts
    delay_access 1 deny unrestricted_macs
    delay_access 1 allow all

    http_access deny banned_hosts
    http_access deny banned_macs
    http_access allow unrestricted_hosts
    http_access allow unrestricted_macs
    http_access allow restrictedlist1 restricted_hosts1
    http_access deny restricted_hosts1
    http_access allow restrictedlist1 restricted_macs1
    http_access deny restricted_macs1
    http_access allow restrictedlist2 restricted_hosts2
    http_access deny restricted_hosts2
    http_access allow restrictedlist2 restricted_macs2
    http_access deny restricted_macs2
    http_access allow whitelist
    http_access deny blacklist
    http_access allow allowed_subnets
    http_access deny all
    –------------------------------------------------------------------
    I’ve removed the old attached squid.inc.txt and added changes.

    Here is the squid files with .txt added for posting

    squid.inc.txt
    squid_nac.xml.txt

  • A

    Squid PKG don't support header_access~?

    Locked
    7
    0 Votes
    7 Posts
    5k Views
    B

    Doh, I mistakenly thought we used the FreeBSD package of squid for our package.  Looks like we install it from pfSense.org.  Wonder what options were used in compiling that package.  If I get time, I'll see if the FreeBSD port works (chances are the reasons we have our own package are due to some of the addons - that are b0rked - we have for squid)

    –Bill

  • D

    Squid problem with "Allow users on interface" check box

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • M

    I can't install some packages

    Locked
    7
    0 Votes
    7 Posts
    4k Views
    Y

    Packages are working for me now. Thanks!

  • T

    SPAMD

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    T

    works now… thanks !

  • H

    Squid and NTOP stop working after some hours

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    H

    Monitor the values at status>system and stresstest your system (like running bittorrents and multiple http downloads).

  • D

    Ntop does not work, when port, another than 80 is selected for WebGui

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • D

    Diag new states package

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Y

    Snort 1.0.1 bug?

    Locked
    9
    0 Votes
    9 Posts
    4k Views
    Y

    Looks like it fixed it.

  • B

    Squid error - access denied

    Locked
    22
    0 Votes
    22 Posts
    18k Views
    H

    hint: diagnostics>edit file or diagnostics>command, download file? ;-)

  • D

    Squid Traffic Managment does not work

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    H

    You also can restart squid from status>services btw.

  • B

    Snort Problem

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    S

    @Brian_Andle:

    I did try your suggestion and it did not work. Also nothing shows up under Snort Blocked.

    Then your rules are not triggering.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.