@ahking19 I chose the free version of OPNsense. I had already tested pfsense CE in the past. I had to switch to pfsense+ because the CE version was not compatible with my equipment.

I didn't want to waste time on that. And in principle, I do not accept the fact that Pfsense+ became chargeable for home use, even though it was announced to be free. the price is excessively expensive…

Why don't you just disable that rule instead? It is an ET Policy rule. Those are usually used just for notification or to enforce some corporate policy. You've discovered that it is falsely triggering in your network due to the VPN traffic (a false positive), so just disable it. Click the red X under the GID:SID column in the ALERTS tab.

Good idea, I still have the equipment that I migrated from, so I will go back to that one and pull the config and see if I can find the differences in the config, thank you

@bmeeks :
Ok. So I disabled and unassigned the WAN Sort interface. Then copied it back to the newly unused WAN interface, enabled and started it and...... IT WORKED!!! I'm getting Alerts and its generating blocks as before the upgrade!

Same name as before, but apparently an internal interface mapping in Snort was still looking for the old WAN interface id.

Thanks!!!

@hspindel said in Question about cron package:

@Gertjan Thank you for the reply.

pfSense is already setup to send notifications.

So what do I do have the simple command "vmstat -m" run from cron and send an email?

Never mind. Figured it out. Thank you.

@dennypage i think that because of the package that can be seen by pfsense and openwrt_b and esphome_dashbord in vlan_iot and openwrt_b can reflect/re-create the package to vlan_server well, there is no problem with the openvpn or firewall rules.

for now i think i will just use avahi in my openwrt_b.

Release notes for IDS/IPS package upgrades are usually posted in the IDS/IPS subforum here on the Netgate Forums. Here is a link to the Release Notes post for Snort 4.1.6_15: https://forum.netgate.com/topic/186417/new-snort-package-v4-1-6_15-update-release-notes.

Since my native (and unfortunately, only) language is English, I post the release notes for both Snort and Suricata in English in the IDS/IPS sub-forum located here: https://forum.netgate.com/category/53/ids-ips.

@mathais said in speedtest-cli ERROR: Unable to connect to servers to test latency.:

@Gertjan Thank you, so you removed speedtest-cli ?
I have openvpn configured on my pfsense and all my IPV4 traffic pass through the VPN .

All traffic? Even video&music streaming? Why???

Do you know another tool for testing my internet speed ?

Saying “internet speed” what EXACTLY You mean: uplink to ISP, between Your pfSense and certain server, between Your device(s) and certain server?

Check all cables, connected speed on NIC, no collisions and errors on interfaces.
2.
SWITCH ON RACK/QUICK congestion control (CC) in FreeBSD.
3.
DISABLE OFFLOADING on NICs - nowadays this have no sens.
4.
DISABLE POWER MANAGEMENT on motherboard (off CPU Threading, CPU power states, PCI & NICs power mgmt, etc…)
5.
only now test by

Speedtest Fast Librespeed iperf3

Your UPLINK (of course no any other net activity on pfSense would be).

After that You have:

maximum possible on certain moment from Your hardware & FreeBSD drivers; measurements from nearest and far servers (not very accurate because workload time of the day and loading of certain server);

Better to automate this by Smokeping (on the pfSense device itself) OR Prometheus+Grafana on separate server (but agent on pfSense).
With alerting on Pushover by API or email.

@akha666 Hello please how were you able to configure the stunnel to work with your OVPN. I keep trying to do the configuration on my pfsense but it doesnt work

@Lockie Run speedtest-cli -h to see the syntax. It seems you could run speedtest-cli --source <VPN IP> to test.

@wija86 i did not find any soulsion on it so i did reinstall my PFsense and now its working.
I was stuck between 2.7.0 and 2.7.2 it did say i had the newest update but my GUI did say 2.7.0
now after the reinstall my Gui says 2.7.2 and my packages are working again.

@rlljorge said in Haproxy block user-agent:

Hello there,

I would like to block some user agents in haproxy like:

Baiduspider
Sosospider
Sogou
ZumBot
Yandex

I found some examples in haproxy community but Didn't make work in pfsense/haproxy, example:

acl blockedagent hdr_sub(user-agent) -i -f /etc/haproxy/blacklist.agent
http-request deny if blockedagent

And how You resolve it ?

@Trey said in FreeRADIUS sync interfaces:

Hi all,

the new sync method is synchronising everything from freeradius. This destroyed our freeradius setup in multiple branches, as it overwrote all interfaces and all eap certificates in every sync host. We have about 7 branches with the freeradius deamon running and used the sync to sync only users and NAS/clients.

Was this change really intended? For me this is more a bug as a feature…

Could someone clarify this?

Thanks for your help

If you used a common CA and Radius certificate (same thumbprint) across the different pfSense boxes, and created only a 127.0.0.1 interface in Radius, would it then not work again?
You would obviously need to create a NAT rule for ports 1812/1813 on the interfaces where Radius should be present (pointing to 127.0.0.1)

@viragomann

@viragomann said in Using HAProxy to redirect, but not to load balance:

But do the printers check the host name at all, or do they only simply listen on IP and port?

The printers are connected to the Pi with a USB cable. They don't deal with IP at all. What does deal with anything like that is the slicer when I use it to upload to OctoPrint to print, but that's something I expected to have to deal with.

Sounds like the configuration is pretty much the same as what I had to do on the Pi I was using for printing and shouldn't be too hard.

Thanks - and thank you for not going into why to just use the names I give each host instead!

Hi @Gertjan

Thank you sharing your configuration and suggestions. I'll review my config and carry out more testing with debugging on this weekend. Can I ask, are you authenticating users or devices using username and password in the 'Users' tab, and/or devices with MAC address in the MAC's tab ?

Thanks,
Stuart