Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    D
    Retested on 24.11-RELEASE (amd64) all seems to work. So it seems right to file a bug for this issue.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    cyb3rtr0nianC
    @rlrobs Yes it’s still working fine here.
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K
    @pulsartiger The database name is vnstat.db and its location is under /var/db/vnstat. With "Backup Files/Dir" we are able to do backup or also with a cron.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    R
    hey forum. maybe someone can help me with pfBlocker. I have this nice overview on pfsense mainpage but it logs nothing. [image: 1754330105763-overview.png] I found a related thread that never got resolved however https://forum.netgate.com/topic/175045/pfblockerng-not-logging-everything Is this normal behaviour? I am using the default out of the box settings here. When doing a nslookup of a blocked domain I seem to be getting the correct response. nslookup c.bing.com Server: 127.0.0.53 Address: 127.0.0.53#53 Non-authoritative answer: Name: c.bing.com Address: 10.10.10.1 But I don't see anything logged in the main tab. Do I need to change something in this setting here: Global Logging/Blocking Mode By default it is set to "No Global Mode" [image: 1754330032261-stats.png] Under alerts I see my nslookups but it only shows "unknown" and not the actual website. I also expect more than just this to show up here when browsing the web. What do i need to change to get this to resolve properly? I have searched already and couldn't find a good answer. I am using Unbound btw. and this under general setup: [image: 1754330288353-dns-settings.png]
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG
    @EChondo What's your pfSense version ? The instructions are shown here : [image: 1753262126227-1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png] A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate. @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy: I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess. No need to wait x days. You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.
  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    J
    @div444 i'm finding the same - did you find a solution or did reverting fix it? Hoping there is a patch fix or something to get it working! Rather not rollback if i can avoid it
  • Discussions about the Tailscale package

    90 Topics
    582 Posts
    dennypageD
    @Gertjan said in can I install a FreeBSD 14 pkg on a FreeBSD 15 pfSense?: If the package contains binaries : forget it. The ABI is different. It's not a hard and fast rule like that. It depends upon what the binary is, what dependencies it has, and how everything was compiled. I am currently running a binary package, which was built on FreeBSD 14.2-RELEASE, on pfSense 25.07 (FreeBSD 15.0-CURRENT) without issue.
  • Discussions about WireGuard

    692 Topics
    4k Posts
    F
    Hi again, to be honest: I guess, I did not remember exactly what I did 2 years ago. May I was mistaken by the interface name opt2 because the SG-3100 has a physical port OPT1 and I mixed up physical and virtual names. The goal was to use 2 different tunnels, one for the mobile clients and one for the site-2-site connection. And now all is running in that way . Regards
  • Snort loosing configuration

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    jimpJ
    @rds_correia: Question: shouldn't all other packages have a similar feature in case something breaks from one version of pkg to another version of pkg? Regards. All other packages automatically keep all of their settings by default, they are not deleted. Snort is the only package the removes its settings and gives the option to save them. IMHO, that should be reversed so they are kept by default with the option to delete them, or just reverse the behavior and remove the option entirely so they are always kept and never deleted.
  • SNORT UPDATE ISSUE WITH DISABLED RULES

    Locked
    7
    0 Votes
    7 Posts
    5k Views
    D
    I just wanted to see where this issue is at on maybe a fix. Because everytime SNORT gets an update as it should, it will disable rules I enabled, and it will enable rules I disabled. Take for instance when using ICMP rules, I don't want to block ICMP ping, because this will block almost everything on the Internet and gets very annoying when using certain categories. I find myself saying the heck with it and simply disable the whole category list of rules just for the sake of a few rules causing issues everytime SNORT gets updates. This is making the package hard to work with when you have to redo all your setting manually after every update. Thanks for any help.
  • Snort config files

    Locked
    2
    0 Votes
    2 Posts
    4k Views
    G
    /usr/local/etc/snort is where the config files are /usr/local/www/snort is where the file you are looking for is. Heh that is a lot of file editing. Wouldn't it be easier to upgrade to 1.31?
  • Reverse Proxy Question

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    G
    HAProxy on works on port 80 to my knowledge so that is why SSL fails. Will load balancing not work instead of Reverse Proxy?
  • Find snort rules name from snort alert

    Locked
    6
    0 Votes
    6 Posts
    5k Views
    G
    [] [1:2406235:192] ET RBN Known Russian Business Network IP UDP (118) [] Also most of the categories relate to the alert. With a little guesswork most of the time you can go right to it in the gui. emerging-rbn.rules ET= Emerging Threats
  • Cool little snort blocked list mod I tweaked

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    jimpJ
    @g4m3c4ck: Hey that is an extra click too many!  ;D Same number of clicks, just involves moving your finger a centimeter or two to the right :-)
  • Proxy: Permit one website

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    M
    I'm so sorry, my fault, misconfiguration, pfsense semms to ignore the "disable rule" so it continue dto apply it.   Thank's
  • How to install GUI part of packages from commande line ?

    Locked
    3
    0 Votes
    3 Posts
    6k Views
    L
    Hello, @jimp: You can't install packages for pfSense that way. The only way to install the pfSense package for squid is via the GUI. Ok  :( thank you very much for your answer…
  • Multiple domains, one IP

    Locked
    15
    0 Votes
    15 Posts
    13k Views
    G
    Guess you are going to need your own subnet then.
  • Snort - Barnyard2 Plugin starts then fails

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    G
    I have the same issue with 1.31 to a remote database. A packet capture shows no attempts to connect. However, the system log says it can't connect. I have been trying to find a log file somewhere to see what is going on but no luck so far.
  • Snort 1.31 Problem [Solved]

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    G
    Not sure what was causing the issue but after I disabled the offending category for each interface that was failing the snort service started working. After that I noticed that a lot of my rules were not there. I guess that may have been due to manually installing the rules when update was broken. I then noticed nothing was selected under "Install Snort.org rules" in Global Settings. After selecting "Install Basic Rules or Premium rules" and updating rules again all rules returned. Hope this helps people.
  • Snort does not start on a PPPoE Interface.

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    N
    Thank you, been waiting for hearing from dev, it's good to hear from you finally. cheers,
  • Snort can not start service !

    Locked
    3
    0 Votes
    3 Posts
    6k Views
    K
    hello Arylikh , Thanks for your reply. I just use 2 rules snort_p2p.rules and snort_chat.rules. I have just found the problem. Tab " Preprocessors" check enable Performance Statistics, Enable "HTTP Inspect Settings", HTTP server flow depth = "0" Now the snort can start. Thanks you so much.
  • Squid Reloading filter… stuck

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    C
    It's probably done reloading long ago…...maybe just a refresh of the browser would have been what was needed.
  • SquidGuard blocking all but 1 or 2 sites

    Locked
    5
    0 Votes
    5 Posts
    2k Views
    M
    Oh you meat the links by your signature, dumb me, thanks mate i'll test it monday.
  • How do you write suppress rules for snort

    Locked
    7
    0 Votes
    7 Posts
    6k Views
    J
    @fosiul: @johnnybe Thanks, yes that rules works Now i can suppress necessary logs Well, you know… you should say thanks to jamesdean. He made the Snort package FAQ. Thats where I've learnt. You're welcome, whatsoever.
  • Snort results in no internet traffic

    Locked
    5
    0 Votes
    5 Posts
    2k Views
    K
    I switched nic's and so far so good.  I still have some testing to do.  thanks
  • Snort problems

    Locked
    5
    0 Votes
    5 Posts
    4k Views
    F
    After five attempt it doesn't work. But, i use the method to upload manually. Now snort works fine, but when i try to auto-update that's not work.
  • Snort Rules update Broken

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    S
    Thanks guys - Manual update worked in the end, auto still not happening up until now. Maybe now that there's a rule set in place the auto updates will roll in? We'll see in ~6 hrs I guess.
  • Snort Updating problems !!!

    Locked
    72
    0 Votes
    72 Posts
    38k Views
    jimpJ
    @nocer: now that my concern is how you can conpromise longer i/f names that looks like 2.0 specific issue which won't snort from starting at the booting, or any other attempt. i tricked some diy for i/f naming but none of those were permanent fix, system will assign a new name, everytime reload the box. That's a matter for a separate thread. Since the updates now work for everyone (so far) this particular issue is closed. If it breaks again, it'll be a new issue, and other problems should be in new threads. Locking the topic. :-)
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.