1. Home
  2. pfSense Packages

Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    D
    I recently start have trouble saving my HAProxy configuration due to a error. It keeps adding clientca_ in front of the SSL offload certificate name. On file level this file does not exist! I tested with both HA Proxy plugins, the regular and dev version. I tried to regenerate the SSL (Lets Encrypt) but this keeps happening. [ALERT] (45623) : config : Couldn't open the ca-file '/var/etc/haproxy_test/clientca_shared-frontend.pem' (No such file or directory). [ALERT] (45623) : config : parsing [/var/etc/haproxy_test/haproxy.cfg:28] : 'bind 0.0.0.0:443' in section 'frontend' : 'ca-file' : unable to load /var/etc/haproxy_test/clientca_shared-frontend.pem Does anybody have the same behaviour? to be clear I have the 25.07-RC running. The relevant part of /var/etc/haproxy_test/haproxy.cfg frontend shared-frontend bind 0.0.0.0:443 name 0.0.0.0:443 ssl crt-list /var/etc/haproxy_test/shared-frontend.crt_list ca-file /var/etc/haproxy_test/**clientca_**shared-frontend.pem verify required crl-file /var/etc/haproxy_test/**clientcrl_**shared-frontend.pem

  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    cyb3rtr0nianC
    @rlrobs Yes it’s still working fine here.

  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K
    @pulsartiger The database name is vnstat.db and its location is under /var/db/vnstat. With "Backup Files/Dir" we are able to do backup or also with a cron.

  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    M
    I resolved this by accepting the T+Cs via https://www.maxmind.com/en/accounts/1205389/geolite2/eula

  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.

  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG
    @EChondo What's your pfSense version ? The instructions are shown here : [image: 1753262126227-1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png] A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate. @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy: I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess. No need to wait x days. You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.

  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    J
    @div444 i'm finding the same - did you find a solution or did reverting fix it? Hoping there is a patch fix or something to get it working! Rather not rollback if i can avoid it

  • Discussions about the Tailscale package

    90 Topics
    578 Posts
    T
    Re: How to update to the latest Tailscale version? I am on latest released Netgate 6100 pfSense PLUS v24 ( pfSense_plus-v24_11_amd64-pfSense_plus_v24_11 ) pkg config abi FreeBSD:15:amd64 pkg -vv | grep -A 3 "pfSense:" pfSense: { url : "pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v24_11_amd64-pfSense_plus_v24_11", enabled : yes, priority : 0, cat /usr/local/etc/pkg.conf ABI=FreeBSD:15:amd64 ALTABI=freebsd:15:x86:64 PKG_ENV { SSL_CA_CERT_FILE=/etc/ssl/netgate-ca.pem SSL_CLIENT_CERT_FILE=/usr/local/etc/pfSense/pkg/repos/pfSense-repo-0001-cert.pem SSL_CLIENT_KEY_FILE=/usr/local/etc/pfSense/pkg/repos/pfSense-repo-0001-key.pem } This firewall is obviously running on FreeBSD 15 no longer on 14. But can I use the freshports link for FreeBSD 14 amd64 quarterly which is at tailscale 1.86.2 or can I only go up to version tailscale 1.84.2_1, and need to wait until they have a version of tailscale 1.86.2 or higher for the FreeBSD 15? Would it be good enough to tell it to ignore the OSVERSION? export IGNORE_OSVERSION=yes Note: use of 14 and not 15 ? pkg add https://pkg.freebsd.org/FreeBSD:14:amd64/quarterly/All/tailscale-1.86.2.pkg service tailscaled restart tailscale up

  • Discussions about WireGuard

    690 Topics
    4k Posts
    J
    I've read through some other posts about this, but they either didn't say whether the proposed solution worked or they were very convoluted and difficult to understand. Here is our scenario: We have 6 locations--Las Cruces (LC), Sunland Park (SP), El Paso (EP), Abilene (ABI), Fort Worth (FW), and Plano (PL). LC and ABI have software that is accessed by the other 4 locations via VPN. There are WireGuard VPNs set up between LC and those 4 locations (SP, EP, FW, PL), and ABI and those 4 locations (SP, EP, FW, PL). There is also a WireGuard VPN connection between LC and ABI. LC and ABI have 2 internet connections. SP, EP, FW, and PL each have one internet connection. If the primary internet connection goes down at either LC or ABI and failover occurs to the secondary internet connection, is there a way to set up the WireGuard VPN connections so that they also failover without purchasing some 3rd party application? Thanks.
Log in to post
Load new posts
  • L

    Squid Block log deleted or name changed

    Locked
    10
    0 Votes
    10 Posts
    4k Views
    D
    Updated.
  • A

    Ntop filter out opt1 interface and settings

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • J

    Snort IP Block will not work with the latest 2.0 snapshots built on the 15th

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    jimpJ
    If it's the amd64 snapshot from very late on the 15th ("Tue Feb 15 23:25:41 EST 2011") or and i386 snapshot from the 16th ("Wed Feb 16 02:41:43 EST 2011") it should be OK again.
  • K

    Squid Custom Rule refresh_pattern help needed

    Locked
    7
    0 Votes
    7 Posts
    17k Views
    K
    Sorry For late reply. These are my refresh pattern rules…. refresh_pattern -i .(gif|png|jpg|jpeg|ico) 43200 90% 129600 ignore-reload ignore-no-cache ignore-private; refresh_pattern -i .(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv|mpg|wma|ogg|wmv|asx|asf) 43200 90% 432000 override-expire ignore-reload ignore-no-cache ignore-private; refresh_pattern -i .(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff|pdf|jar) 43200 90% 129600 override-expire ignore-reload ignore-no-cache ignore-private; To avoid no-cache response from servers & increase hit rate. Note: "ignore-private" command may give a warning message as "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP". I just Ignored it. refresh_pattern .dnl..geo.kaspersky.com/..(zip|avc|kdc) 2160 100% 10080 ignore-no-cache reload-into-ims; refresh_pattern ..avg.com/..(bin) 2160 100% 10080 ignore-no-cache reload-into-ims; refresh_pattern ..avast.com/..(vpu|vpaa) 2160 100% 10080 ignore-no-cache reload-into-ims; refresh_pattern ..kaspersky-labs.com/..(cab|zip|exe|msi|msp) 4320 100% 43200 ignore-no-cache reload-into-ims; refresh_pattern ..kaspersky.com/..(cab|zip|exe|msi|msp|avc) 2160 100% 10080 ignore-no-cache reload-into-ims; refresh_pattern ..nai.com/.*.(gem|zip|mcs) 2160 100% 10080 ignore-no-cache reload-into-ims; Anti virus update Cache Not so much luck Only 5% hit increased. Its only 3 days i am running my pfsense box. HOPE BETTER PERFORMANCE AFTER SOME DAYS. any suggestion is much appreciable. Thanks in advance.
  • M

    Squidguard deny report

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    D
    It is not envisaged.
  • M

    Log (not block) porn, time-wasting sites

    Locked
    8
    0 Votes
    8 Posts
    6k Views
    R
    @hugo: @mellow-yellow: I need to log, not block porn, gambling, facebook, and related (i.e. "time-wasting sites" as our management calls them) websites. We want to know WHO (reverse IP is fine) is viewing them and WHEN (squid). We already have pfsense, squid, and lighttpd running. These forums seem to recommend openDns or squidguard. However those products, while excellent, appear to block, not simply log such sites. lighttpd is also excellent, but it returns too many websites, since we're not interested in employees' visiting our already approved sites, including gmail, yahoo, google, etc, which represent 95% or more of the traffic. In short, how can we simply log, not block, such sites? There are specific software applications that can do that… One of them is: MyPornBlocker. Which has many options and can log access to time wasting sites and even take screenshots. That site and software sounds like a scam site or something that are trying to sell useless software to a high price to protective parents and that tip is also useless because the topic is about a BSD firewall, not a Windows client. // rancor
  • A

    PhpSysInfo from WAN?

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    A
    Any ideas? I still want to do this…
  • F

    What commands to use to properly stop/start freeswitch via Cron?

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Q

    SquidGuard Blacklists

    Locked
    13
    0 Votes
    13 Posts
    7k Views
    Q
    Oh thanks. :) # Do not edit manually ! http_port 10.10.200.254:8080 icp_port 0 pid_filename /var/run/squid.pid cache_effective_user proxy cache_effective_group proxy error_directory /usr/local/etc/squid/errors/English icon_directory /usr/local/etc/squid/icons visible_hostname ffdfw002 cache_mgr ithelp@dontcare.com access_log /var/log/httpproxy/access.log cache_log /var/log/httpproxy/cache.log cache_store_log none logfile_rotate 8 shutdown_lifetime 3 seconds # Allow local network(s) on interface(s) acl localnet src  10.10.200.0/255.255.255.0 uri_whitespace strip cache_mem 512 MB maximum_object_size_in_memory 32 KB memory_replacement_policy lru cache_replacement_policy lru cache_dir aufs /var/squid/cache 2500 16 256 minimum_object_size 0 KB maximum_object_size 1024 KB offline_mode off cache_swap_low 90 cache_swap_high 95 # No redirector configured # Setup some default acls acl all src 0.0.0.0/0.0.0.0 acl localhost src 127.0.0.1/255.255.255.255 acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 1025-65535 acl sslports port 443 563  acl manager proto cache_object acl purge method PURGE acl connect method CONNECT acl dynamic urlpath_regex cgi-bin \? acl allowed_subnets src 10.10.200.0/24 cache deny dynamic http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !safeports http_access deny CONNECT !sslports # Always allow localhost connections http_access allow localhost request_body_max_size 0 KB reply_body_max_size 0 allow all delay_pools 1 delay_class 1 2 delay_parameters 1 -1/-1 -1/-1 delay_initial_bucket_level 100 delay_access 1 allow all # Setup allowed acls # Allow local network(s) on interface(s) http_access allow allowed_subnets http_access allow localnet # Custom options redirect_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf redirector_bypass on redirect_children 3 # Default block all to be sure http_access deny all Thoughts?
  • J

    OSPF kills traffic

    Locked
    5
    0 Votes
    5 Posts
    2k Views
    J
    Bump
  • O

    SQUID - Cache renew

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    _
    Your info is here: http://doc.pfsense.org/index.php/Squid_Package_Tuning You can find that infos for (not all pages/packages at the moment) by clicking at the blue help-point ahich is present on every page in the upper right white space near the page-name.
  • N

    Pfsense + squid + Windows

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    K
    I have been having the same problem. And was thinking of using a linux box in between to authenticate Squid users on pfsense. Did you find a better solution? Or did this work for you? Thanks
  • S

    Fatal error: Call to undefined function: str_split() in /usr/local/pkg/squidguar

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    D
    What would you like me to do (?), without the following information: pfSense version; squidGuard version; full text of the error / screenshot.
  • N

    DenyHost

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    W
    Did you try checking /etc/hosts.allow? Here is a quote from: http://www.mail-archive.com/ossec-list@googlegroups.com/msg00939.html "Freebsd does not use /etc/hosts.deny but rather inserts all wrapper rules into /etc/hosts.allow." Also the formatting is ALL: XXX.XXX.XXX.XXX: deny @tracer: thanks for the file, this made my day. It seems to work now. Any idea where it creates the rules to block these IPs ?
  • W

    Squid different .confs on different NICs

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • C

    Error message on snort startup

    Locked
    3
    0 Votes
    3 Posts
    5k Views
    C
    Hey Chris! Problem is that you need to enable the HTTP inspect preprocessor. To do that… Thanks - made the changes and still got some fatal errors on startup, but these were related to the snort rule files. Deleted one rule line in /usr/local/etc/snort/snort_31447_fxp0/rules/exploit.rules and around 6 in ..specific-threat.rules and everything now starts up without any errors. Can't say I completely know what i'm doing here, but all seems to work. It's my first introduction to FreeBSD and their seem to be a whole load of options in pfsense that I don't recognise at all, so will have to get FreeBSD installed on an old machine later in the year to see how all the bits fit together. Had an uptime almost since install, with constant memory usage, so no memory leaks and a very robust, fit and forget system thus far... Regards, Chris
  • T

    Snort blocks users connection to OpenVPN

    Locked
    1
    0 Votes
    1 Posts
    3k Views
    No one has replied
  • I

    Snort

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    CrossEyeC
    @jamesdean: Im working on Snort 2.9.0.3 package for Pfsense 2.0. Please be patient. james Thanks a lot James, it is truly appreciated!! Gabriel
  • G

    Snort in Pfsense

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    G
    http://www.wiley.com/WileyCDA/WileyTitle/productCd-0764568353.html
  • N

    Proxy filter Log issue

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    D
    http://forum.pfsense.org/index.php/topic,32994.0.html
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.