1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    J
    @JonathanLee use Pfsense 2.8.1.

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    DARAD
    Hello team, I have a Netgate 8200 running 24.11-RELEASE (amd64) with Suricata 7.0.8_5 package installed. Suricata doesn't seem to start. It loops to red once I press the Play button on the interface. It leaves no logs in the System logs, it leaves no logs in suricata.log at /var/log/suricata/suricata_ovpns933787/suricata.log I tried launching it manually: # /usr/local/bin/suricata -V or # /usr/local/bin/suricata -c /usr/local/etc/suricata/suricata_33787_ovpns9/suricata.yaml -i suricata_ovpns933787 and I get this output ld-elf.so.1: /usr/local/bin/suricata: Undefined symbol "__strlcpy_chk@FBSD_1.8" Thanks in advance, Dara

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    573 Topics
    3k Posts
    dennypageD
    @kabeda If memory serves, that old version of ntopng did not run as user ntopng, but as user nobody. There are lots of problems in that old version. Anyway, check the ownership and permissions of /var/db/ntopng and make sure it matches the user that ntopng runs as. You may need to set ownership of the entire hierarchy. Example: /usr/sbin/chown -R nobody:nobody /var/db/ntopng However, the better choice would be to upgrade to a more recent version.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    tinfoilmattT
    @vicking said in No blocks on IP: Is it a bad idea to have the action set to deny both instead of inbound only? Question is squarely for admin. Per the infoblock which explains, in part, the "Deny Inbound", "Deny Outbound", and "Deny Both" actions: 'Deny' Rules: 'Deny' rules create high priority 'block' or 'reject' rules on the stated interfaces. They don't change the 'pass' rules on other interfaces. Typical uses of 'Deny' rules are: Deny Both - blocks all traffic in both directions, if the source or destination IP is in the block list Deny Inbound/Deny Outbound - blocks all traffic in one direction unless it is part of a session started by traffic sent in the other direction. Does not affect traffic in the other direction. One way 'Deny' rules can be used to selectively block unsolicited incoming (new session) packets in one direction, while still allowing deliberate outgoing sessions to be created in the other direction. In other words: When set to "Deny Inbound", incoming connection requests from WAN hosts are blocked and therefore no state will be created. However a LAN host can still establish state to an otherwise listed IP. If set to "Deny Outbound", outgoing connection requests from LAN hosts are blocked and therefore no state will be created. However an incoming connection request from an otherwise listed IP to an 'open' WAN port can still establish state. If set to "Deny Both", both incoming connection requests and outbound connections requests are blocked and therefore no state will be created regardless of connection direction.

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    102 Topics
    3k Posts
    C
    @dennypage Nicely done sir!

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    503 Topics
    3k Posts
    M
    I am using the DNS-Update method I have to use a DNS-Sleep of 5 minutes to let the letsencrypt txt dns record update propagate. During this 5 minutes the acme-webgui times out. when the acme-webgui times out the Action list is NOT executed. How can I solve this ? Would it maybe be an idea to let the acme.sh script execute the actions in the action list as a post-hook instead of the web-gui? Or maybe add an option to add post-hooks in the webUI ?

  • Discussions about the FRR Dynamic Routing package on pfSense

    296 Topics
    1k Posts
    C
    This one has been tricky still not sure what to try. Any ideas?

  • Discussions about the Tailscale package

    93 Topics
    654 Posts
    C
    @luckman212, Thanks for your suggestion. I will check what I have in /usr/local/pkg/tailscale/state, and also the RAM disk settings others have brought up. I could learn more about where Tailscale and pfSense store system files. If I find anything worth sharing, I will let you know.

  • Discussions about WireGuard

    715 Topics
    4k Posts
    H
    @RNM-0 Thanks for your comment and sharing your fix. Unfortunately I don't want to take down pfsense and downgrade versions. I'm currently fine at the moment since I'm using Tailscale and that works. I also fixed the other crash I was having with pfblocker by changing a line code that wasn't pushed out under this version. Hopefully the stable release won't take too long to release but it appears there's still some open bugs that need to be fixed before that happens, and ironically, both the pfblocker and wireguard issues aren't on that list of bug fixes.
Log in to post
Load new posts
  • B

    lldpd not working on XG-7100 (or any version with a built in switch?)

    1
    0 Votes
    1 Posts
    281 Views
    No one has replied
  • JeGrJ

    Filer Package doesn't load content of file

    1
    2
    1 Votes
    1 Posts
    523 Views
    No one has replied
  • S

    PFsense Remote NUT server to UPS connected to a Synology

    2
    0 Votes
    2 Posts
    1k Views
    S
    UPDATE: Looks like an update from synology did the trick. :-)
  • S

    [Solved] How to configure HAProxy to forward client IP's to backend web servers

    2
    0 Votes
    2 Posts
    7k Views
    S
    There was no issue with HAProxy. The issue was related with my Apache config, sorry for that. I'm now using mod_remoteip instead of deprecated mod_rpaf and appropriate log format options. On HAProxy side, it's only required to select option 'Use "forwardfor" option' in the frontend, as described in below documentation: https://github.com/PiBa-NL/pfsense-haproxy-package-doc/wiki/haproxy_pass_clientip_to_webserver
  • S

    Arpwatch -v option for CARP not working for me.

    1
    1 Votes
    1 Posts
    360 Views
    No one has replied
  • F

    Squid log file conversion

    1
    0 Votes
    1 Posts
    208 Views
    No one has replied
  • junicastJ

    haproxy question about: dual stack / authentication

    5
    0 Votes
    5 Posts
    836 Views
    junicastJ
    Thank you @PiBA. I changed my actions so that they use the ACLs. Works quite nicely. Regarding IP Filter / Authentication I found this article: https://hochwald.net/user-authentication-with-haproxy-on-pfsense/ I have not tried it, yet but I really prefer authentication over IP filter since you do not see if the filter works when you come from an authorized IP. I would have preferred an LDAP user backend but a static user list will suffice for me, too.
  • jimpJ

    Subcategory for FRR

    2
    2 Votes
    2 Posts
    6k Views
    No one has replied
  • D

    usb_modeswitch for ARM devices (SG-3100, SG-1000)?

    1
    0 Votes
    1 Posts
    180 Views
    No one has replied
  • junicastJ

    haproxy configuration generation hiccup

    3
    0 Votes
    3 Posts
    313 Views
    junicastJ
    @PiBa Thank you for your reply. That lead me to another interesting thing. In pfSense's WebGUI the right certificate is chosen. I have a look into /var/etc/haproxy/shared_frontend and did: openssl x509 -in ip.domain1.net -text -noout And baam, the common name is 'images'. The letsencrypt certificate though had a wrong CN configured so that's what this is.
  • W

    Bind9 - zone transfers

    4
    0 Votes
    4 Posts
    657 Views
    johnpozJ
    @watkinsufs said in Bind9 - zone transfers: thought there would be a listing of the transferred records. why would you think that? Its a gui around the config..
  • T

    Remote printing over stunnel

    5
    0 Votes
    5 Posts
    1k Views
    T
    @johnpoz first off, I'm dismayed that you are belittling my request for support. If I wanted advice on how to best connect a remote printer, I would have asked that in the appropriate section of the forum. I've done the research and determined that a VPN is not the best solution. I don't (nor likely will) have any ability to change the network setup on the distant side of the solution. In most cases, they are built using off the shelf products that typically leverage one or two very common Class C network IP ranges. This would require a rather complicated split-tunneling VPN solution a user would need to manually start. I would also add that a proper VPN deployment is much more than running a wizard and dumping out a config file. As I received no such support, I spent hours researching solutions on my own. Here is what I've built, tested, and fielded, for folks out there actually looking for a solution: Most printers using standard IP printing use port 9100 and the RAW protocol over TCP. Local Side pfSense Firewall w/ stunnel add-on installed pfSense Stunnel Config: Listen On Port: 9100 (Can be whatever you like, as long as it matches the stunnel config file on the distant side.) Redirects to IP: XXX.XXX.XXX.XXX (Printer IP attached to the LAN (or better, a DMZ)) Redirects to Port: 9100 Custom Options: PSKsecrets = /conf/stunnel_psk.txt stunnel_psk.txt contains a list of identities and preshared keys in the format ID:Key. pfSense even provides a handy editor under Diagnostics once the file is created in the conf directory. Create WAN firewall rule to pass inbound TCP traffic on 9100. (Even better, only allow connections from specific public IPs you need to print from.) Distant Side Install standard stunnel from: www.stunnel.org then enable running as Windows service. Edit stunnel config file: ; encrypt outbound printing [Remote_Printing_9100] client = yes accept = 127.0.0.1:9100 connect = XXX.XXX.XXX.XXX:9100 (Public IP and the "Listen on Port" of pfSense firewall.) PSKsecrets = psk.txt PSKidentity = ID Create psk.txt in the same folder as the config file and past the same ID:Key combination from stunnel_psk.txt and restart the stunnel service. Then simply change the IP port of the printer to the local host and enjoy!
  • brightwolfB

    Did a clean install of 2.4.4. Got two additional packages??

    3
    0 Votes
    3 Posts
    902 Views
    brightwolfB
    @Rico OK thanks for your feedback, I guess I just leave them be unless there's some risk involved? I do not need them...
  • C

    HAProxy - Slow Page Load on 1 (of 4) FrontEnds

    10
    0 Votes
    10 Posts
    2k Views
    C
    Just to follow up, after moving all my sites to a new VM, speed is as expected. Dunno.
  • B

    PFSense FreeRadius Quota

    5
    0 Votes
    5 Posts
    1k Views
    B
    @Gertjan thanks, for the reply.. I'll try your suggestion.
  • P

    Can not disable http_inspect rule.

    6
    0 Votes
    6 Posts
    1k Views
    NogBadTheBadN
    @Peglas Your welcome
  • R

    Freeradius on new SG-1100

    6
    0 Votes
    6 Posts
    1k Views
    jimpJ
    That is just an automatic one that should generate itself for convenience. It is much better to make your own.
  • E

    Redis needs manual start from shell, to get NTOPNG working

    6
    0 Votes
    6 Posts
    5k Views
    R
    @Sefiadem said in Redis needs manual start from shell, to get NTOPNG working: rm -rf ntopng/ That works for me, maybe was a corrupt file then deleting all structure and the deamon start correctly
  • E

    FreeRADIUS - quota exceeded CP wrong message

    4
    0 Votes
    4 Posts
    690 Views
    GertjanG
    I just ran into another FreeRadius question, an found this : clog /var/log/system.log | grep "FreeRADIUS: User" Run it yourself on your system. Console access or SSH, option 8. Now, when user logs in, you have it's user name, right ?! Let say, the user is called "107" What about this : clog /var/log/system.log | grep "FreeRADIUS: User 107" Now, take the last line : clog /var/log/system.log | grep "FreeRADIUS: User 107" clog /var/log/system.log | grep "FreeRADIUS: User" | tail -1 My idea is : when you make your own portal login page and portal error page (the page where the red error shows teh somewhat misleading : ""invalid credential"") Edit this error page, and add some PHP code that executes these shell commands - and if there is some result (read : useful messages). Show the result on the error page ! Something like : User x has reached the daily amount of upload and download traffic (124 MB of 8 MB). The login request was denied. Now, all you need to do is scripting this together using some PHP and the commands you found above, and put it into the captive portal error page.
  • T

    Stunnel Broken in latest package update with development build.

    Locked
    5
    0 Votes
    5 Posts
    692 Views
    jimpJ
    Doesn't matter if you're on -p2 or -p3 the stunnel package is the same. You should be on -p3. The problem in this thread has been solved. If you have a new problem, upgrade to the most current release and package version and post the details of your problem in a new thread.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.