Subcategories

  • Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.

    4k Topics
    21k Posts
    D
    Retested on 24.11-RELEASE (amd64) all seems to work. So it seems right to file a bug for this issue.
  • Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.

    2k Topics
    16k Posts
    S
    So since there is no version 25.03. There is an official 25.07 now but only get a 7.08.2 what happen to the rest up to Suricata 7.0.10 or 7.0.12?
  • Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.

    571 Topics
    3k Posts
    K
    @pulsartiger The database name is vnstat.db and its location is under /var/db/vnstat. With "Backup Files/Dir" we are able to do backup or also with a cron.
  • Discussions about the pfBlockerNG package

    3k Topics
    20k Posts
    GertjanG
    @rasputinthegreatest said in pfBlockerNG not logging anything by default?: This IP does exist on my LAN but why it resolves some weird random desktop-sdshdsd.local? Then it's time to visit that device "192.168.1.85", and inspect it. pfSense was just replies on a DNS request coming from it. Loads of DNS request is 'normal' these days. Btw : buy yourself a big collection of connected devices (preference : 'foreign origin") and you wind up with loads of bizarre DNS requests. For example, a classic "Windows 11 Home" PC is already considered as 'bloated', which means that the list of all these xbox, candy store and other 'essential' processes is quiet big? And they all call 'home'. And ask yourself this question : "do you really know what users actually do with their devices" ? @rasputinthegreatest said in pfBlockerNG not logging anything by default?: Also no 192.168.51.5 exists on my network either Is "192.168.51.5" a typo ? It doesn't show up in any logs ... If your pfSense LAN uses the 192168.1.1/24 network, and a device connected to that LAN using the 192.168.51.5, it can't communicate. A network with statically assigned IP info (IP, mask/network, gateways and DNS) is hard to manage. That's why DHCP was invented, and activated by default for every device you buy. @rasputinthegreatest said in pfBlockerNG not logging anything by default?: I assume it is related to time servers? Why do you presume that ? Look them up and you'll see. "ntpns.org" is probably the NS server of ntp.org A lot of devices want to know the exact time. Even when DHCP can propose a time server - you can set up pfSense as a time server for your LAN devices - many devices will disregard this info, an insist in using their own hard coded time server source. For example, a Microsoft PC will default to time.microsoft.com, but you can set it to 192.168.1.1 or pfsense.your-sense-domaine.tld (which will point to 192.168.1.1 = pfSense). You could to do this for every LAN device. @rasputinthegreatest said in pfBlockerNG not logging anything by default?: .local addresses What is your pfSense domain set to ? @rasputinthegreatest said in pfBlockerNG not logging anything by default?: Its very mysterious and I only see this now with pfblockerNG. Set : Services > DNS Resolver > Advanced Settings : Log Level to : [image: 1754468971160-b17dd7a5-9427-497e-a3d0-5936024787b0-image.png] and save, apply. Now have a loo here : Status > System Logs > System > DNS Resolver or better : console : tail -f /var/log/resolver.log Don't forget to set back the Log Level to 1 !! ( !! ) as the resolver.log will get very big very fast. Conclusion : there is a lot of DNS traffic. These are all small packets, and finally just a small percentage of the total traffic.
  • Discussions about Network UPS Tools and APCUPSD packages for pfSense

    101 Topics
    2k Posts
    dennypageD
    @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: Interesting. I would have thought the initial reboot, which occurred as part of the upgrade, would have done the trick, but it took a second reboot, just now, to get things working. Glad you have it sorted. There was no difference in the output of usbconfig show_ifdrv at any point -- before or after unplugging/replugging the USB cable, nor after rebooting. ... Question: What would tell me whether or not a driver was loaded? If there were an attached driver, it should have shown up with the show_ifdrv command. If you use the command and look at the other usb devices, I think they will show attached drivers. I don't expect to see a driver attached to the ups, because there is a quirk that tells the OS to ignore that device (and not attach a driver). Look for idVendor and idProduct in the above output. The Vendor ID for your device is 0764, which corresponds to Cyber Power Systems, and the Product ID for your device is 0601, which is registered as "PR1500LCDRT2U UPS" (don't sweat an exact match for the name). You can see the quirk with the following command: [25.07-RC][root@fw]/root: usbconfig dump_device_quirks | grep 0764 VID=0x0764 PID=0x0005 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0501 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE VID=0x0764 PID=0x0601 REVLO=0x0000 REVHI=0xffff QUIRK=UQ_HID_IGNORE [25.07-RC][root@fw]/root: Your device is third on the list. The HID_IGNORE quirk says to ignore the device and not attach a driver. @jhg said in NUT fails to start after 2.7.2 -> 2.8.0 upgrade: You might consider adding this resolution to the release notes for 2.8. LOL... sorry, I don't have input to the release notes (I don't work here). While I wrote and maintain various packages, including NUT, I'm still just a volunteer. Most packages are actually written by volunteers.
  • Discussions about the ACME / Let’s Encrypt package for pfSense

    493 Topics
    3k Posts
    GertjanG
    @EChondo What's your pfSense version ? The instructions are shown here : [image: 1753262126227-1acdc586-cb29-4148-9e36-81ade4e5e60c-image.png] A restart of a service will start by re creating their config files. If a certificate changed, it will get included. When the process starts, it will use the new certificate. @EChondo said in Issue with ACME Certificates Refresh & Restarting HAProxy: I haven't been able to confirm if the above works(mine just renewed, don't feel like doing it again just to test), so we'll see in 60 days I guess. No need to wait x days. You can re test / renew right away, as you are 'allowed' to renew a couple (5 max ?) of times per week.
  • Discussions about the FRR Dynamic Routing package on pfSense

    294 Topics
    1k Posts
    yon 0Y
    said in Please update frr on Pfsense+ to FRR 10.3: https://redmine.pfsense.org/issues/15785 now frr 10.4.1
  • Discussions about the Tailscale package

    90 Topics
    585 Posts
    L
    @veddy254 said in How to update to the latest Tailscale version?: @lbm_ said in How to update to the latest Tailscale version?: https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.84.2_1.pkg pkg: An error occured while fetching package I would recommend verifying the DNS settings in PfSense and verifying date/time is correct. Barring that, try again later and see if it still fails. I was able to successfully run the command on my 2.8.0 install (I didn't install it because I've already installed it) so it seems localized. Interesting. After I (reinstalled) tailscale the /etc/resolv.conf was overwritten. So I just readded the DNS entries in the Pfsense WebUI, and not it worked. pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.84.2_1.pkg Fetching tailscale-1.84.2_1.pkg: 100% 11 MiB 11.9MB/s 00:01 Installing tailscale-1.84.2_1... Newer FreeBSD version for package tailscale: To ignore this error set IGNORE_OSVERSION=yes - package: 1500054 - running kernel: 1500029 Ignore the mismatch and continue? [y/N]: y package tailscale is already installed, forced install Extracting tailscale-1.84.2_1: 100% And pkg info tailscale tailscale-1.84.2_1 Name : tailscale Version : 1.84.2_1 Installed on : Wed Aug 6 09:17:23 2025 CEST Origin : security/tailscale Architecture : FreeBSD:15:amd64 Prefix : /usr/local Categories : security net-vpn Licenses : BSD3CLAUSE Maintainer : ashish@FreeBSD.org WWW : https://tailscale.com/ Comment : Mesh VPN that makes it easy to connect your devices Shared Libs required: libthr.so.3 libc.so.7 Annotations : FreeBSD_version: 1500054 build_timestamp: 2025-07-30T02:26:16+0000 built_by : poudriere-git-3.4.2-12-g74a54a88 port_checkout_unclean: no port_git_hash : 275975297bc ports_top_checkout_unclean: no ports_top_git_hash: 0cd2c078c1e Flat size : 35.4MiB Description : Tailscale is a mesh VPN alternative, based on WireGuard, that connects your computers, databases, and services together securely without any proxies.
  • Discussions about WireGuard

    692 Topics
    4k Posts
    F
    Hi again, to be honest: I guess, I did not remember exactly what I did 2 years ago. May I was mistaken by the interface name opt2 because the SG-3100 has a physical port OPT1 and I mixed up physical and virtual names. The goal was to use 2 different tunnels, one for the mobile clients and one for the site-2-site connection. And now all is running in that way . Regards
  • Squid typo

    Locked
    11
    0 Votes
    11 Posts
    4k Views
    U
    so the REAL LAN IP of the firewall is 10.0.0.2  but the VIP is 10.0.0.1 if i type http://10.0.0.1 here is the error page i get ERROR The requested URL could not be retrieved –------------------------------------------------------------------------------ While trying to retrieve the URL: http://10.0.0.1/ The following error was encountered: Connection to Failed The system returned: (1) Operation not permittedThe remote host or network may be down. Please try the request again. Your cache administrator is [hidden]. –------------------------------------------------------------------------------ Generated Mon, 25 Aug 2008 21:51:31 GMT by [hidden] (squid/2.6.STABLE21)
  • Squidguard memory exhausted

    Locked
    17
    0 Votes
    17 Posts
    7k Views
    U
    setting it to 50M worked for the urlblacklist.com
  • URL with IP and port not working

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    S
    I probably need to add that I have Squid and Squidquard running with the client using the proxy. So the client cannot get to any url with an IP and port. I take the client computer off of the proxy and it works fine. While trying to retrieve the URL: 10.0.0.30:4343 The following error was encountered: Access Denied. Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect.
  • Unable to communicate to pfSense.com

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    B
    to clarify: it doesnt work if you connect you wan interface to internet using an existing proxy (squid or isa server,etc) it does work through nat on routers or another pfsense without transparent proxy, a public ip is not manadatory…
  • PFsense LDAP, Squid

    Locked
    3
    0 Votes
    3 Posts
    18k Views
    L
    thx für reply, u are using an windows AD or? Im with Open LDAP, have i got to put my useres to a special groupe like "internet" or something?
  • Proxy With Separate Disk

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Squid problems please advise

    Locked
    5
    0 Votes
    5 Posts
    2k Views
    M
    I got it…. Thanks so much, everything is now working.
  • BandwidthD uses promiscuous mode when not called for

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • LightSquid install problem

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Squidguard sgerror.php

    Locked
    7
    0 Votes
    7 Posts
    12k Views
    U
    it seems it will sucessfully redirect to anything except my firewall 10.0.0.1 ip sgerror.php page if it points to the lan ip it allows the blocked website through, if it points to msn.com it blocks it stating msn.com's content on the page
  • Sasyncd

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    L
    I tried it before posting ;) The setup is: 2 pfsense box in HA mode (carp failover public ip) and a remote end with a single linux server running openswan. I lost traffic for about 10 mins since the vpns didn't renegociate before. Did I miss something somewhere ? Thanks
  • SquidGuard update

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    D
    Update GUI not change package version - this take only current port version.
  • Squidguard auto update blacklists

    Locked
    3
    0 Votes
    3 Posts
    5k Views
    U
    http://www.maynidea.com/squidguard/faq-plus.html#autobl theres you go
  • Snort not working

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    U
    reinstalled snort and it works please retract post
  • Minor snort bug.

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    J
    It sounds like you're using the snort package with pfsense 1.2, which isn't currently supported. Don't uninstall or try reinstalling… it will break your installation, since the files on the server are currently only compatible with pfsense 1.2.1. FYI, those bugs have been fixed, and will be uploaded to the server at some point.
  • Accesss Light Squid with out login to firewall.

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    A
    I'm also curious if this is possible? I have the webgui set on a different port (duh) and I could block this port for all except admins, but this would be kind of annoying when logging in to the gui from another location. Some services I would like to have open on the firewall, so still, blocking the webgui wouldn't be a nice feature. Anybody have any idea's on how to block lightsquid or alter the html output location?
  • 0 Votes
    7 Posts
    12k Views
    A
    I removed snort some time ago.. and I would love to give it another go.. but it's not listed in the packages list anymore.. Does it not work on the latest stable release?? Can I install it manualy? If so? how?
  • Bandwidthd 2.0.1.2 not starting on 1.2.1 - RC1

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Did I configure snort properly?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    J
    Most of snorts rules are designed to block against attacks coming over the internet… so unless you expects attacks to come from friendly's, I'd just enable it on the WAN. Regarding your second question, yes, the firewall rule created by snort should block traffic from that IP altogether, however I have noticed some inconsistencies with pfsense and firewall rules (particularly that if you're using squid, firewall rules over port 80 don't work). You should do some testing to make sure it behaves as you expect.
  • Help with squid

    Locked
    5
    0 Votes
    5 Posts
    10k Views
    T
    1Gb RAM mini-itx system. ( this for Home use only ) Here are my settings for proxy server: Proxy server: General settings Proxy interface : LAN Allow users on interface : checked Transparent proxy : checked Do NOT proxy Private Address Space (RFC 1918) : unchecked Enabled logging : unchecked Log store directory : /var/squid/log (default) Proxy port : 3128 (default) ICP port : empty Visible hostname : localhost (default) edit: "pfsense" or your routers name; to fix Squid-icons (FTP). Administrator email : admin@localhost (default) members of my family know how to find me when things go sour. ;) Language : english (default) Disable X-Forward : checked    Some forums check for ip-ranges and mess up bigtime and won't give you access.    (check these sites , "with" and "without" X-forward ;) )    example forum : http://www.evga.com/forums/    test proxy here : http://www.lagado.com/proxy-test Disable VIA : unchecked What to do with requests that have whitespace characters in the URI : strip (default) Use alternate DNS-servers for the proxy-server : empty Custom Options : redirect_program /usr/local/libexec/adzap;redirect_children 8;maximum_object_size_in_memory 512 KB;    I manually installed adzapper and configured the redirection this way.    maximum_object_size_in_memory 512 KB:    Some pictures can be bigger than the default setting of 64KB and won't be cached from memory. (speed boost)    Do not set this too big, balance this with the Memory cache size mentioned below. Proxy server: Upstream proxy settings Nothing, don't need it in my situation. Proxy server: Cache management Hard disk cache size : 1000 default is 100    Remember: Indexing this hdd cache also uses some RAM so don't ubersize your hdd cache!!! Hard disk cache location :  /var/squid/cache (default) Memory cache size : 128 default is 8    This not an absolute setting, squid can grow beyond what you set here. Minimum object size : 0 default Maximum object size : 16384 default is 4 ?!?    default according to squid should be 4096 Kb.    I use heap LFUDA, it's recommended to increase the maximum object size above default to get a better HIT ratio.   This setting is my personal trail and error setting. Level 1 subdirectories : 16 default is 16    More levels increases cache complexity and dependency on hdd speed. For normal home use I recommend default setting. Memory replacement policy : heap LFUDA default is heap GDSF    Increase Maximum object size when using heap LFUDA to increase hit ratio.    too fix in 1.2.1 RC1 package squid 2.6.21 read this topic:    http://forum.pfsense.org/index.php/topic,11008.0.html Cache replacement policy : heap LFUDA default is heap LFUDA Low-water-mark in % : 90 default is 90 High-water-mark in % : 95 default is 95    Bring these values closser together when running into memory overflow problems.    90-95 = 5% but 5% can still represent are large chuck of cache or RAM depending on your settings. Do not cache : empty Enable offline mode : unchecked Proxy server: Access control Proxy server: Traffic management Proxy server: Authentication Proxy server: Local users Not needed for "home" users. I did not configure anything here all left at default.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.