Subcategories

  • Discussions about development snapshots for pfSense Plus 25.07

    58 Topics
    819 Posts
    J

    I would agree. 18 hours in and everything continues to run smoothly. The issue related to image availability I believe is the valid answer and we can close this out as solved. Thanks everyone. -JD

  • pf.os or p0f.fp

    9
    0 Votes
    9 Posts
    2k Views
    JonathanLeeJ

    @Gertjan Pfsense has the ability in theory to be the first firewall to compartmentalize docker os signatures apart from the host machines and actually control traffic in that manner:) wouldn't that be cool? Again, invasive nation state actors only attack walls at their weakest areas.

  • pfsense/FreeBSD-ports Question

    1
    0 Votes
    1 Posts
    354 Views
    No one has replied
  • How is "uniqid" for a VIP entry generated

    4
    1 Votes
    4 Posts
    665 Views
    T

    Hello, I came across the same topic, it was very useful for me.

    This is how I decided to implement it in ansible.

    - name: "Generate a virtual ip address uniq id" ansible.builtin.debug: var: query('community.general.random_string', upper=false, special=false, min_numeric=10, min_lower=3, length=13) # Example result: ['202121w730p1q']
  • pulling model, serial number, netgate device ID from CLI

    3
    0 Votes
    3 Posts
    837 Views
    B

    @jimp super helpful - just what I needed! I'm a powershell guy and here's where I landed on this in case anyone else is in the same boat:

    $hardwareModelRaw = & "$env:ProgramFiles\putty\plink.exe" admin@$pfSenseIP -pw $pfSensePW -batch -hostkey $pfSenseHostKey 'sysctl dev.netgate.desc' $pos = $hardwareModelRaw.indexof(": ") $hardwareModel = $hardwareModelRaw.substring($pos+2) $pfSerialNumber = & "$env:ProgramFiles\putty\plink.exe" admin@$pfSenseIP -pw $pfSensePW -batch -hostkey $pfSenseHostKey '/bin/kenv -q uboot.boardsn'
  • PR review? Automatic Split-DNS

    1
    1 Votes
    1 Posts
    204 Views
    No one has replied
  • Remove duplicate suppression for smtp?

    1
    0 Votes
    1 Posts
    220 Views
    No one has replied
  • Send email on GUI or VPN login script

    1
    0 Votes
    1 Posts
    225 Views
    No one has replied
  • This topic is deleted!

    1
    0 Votes
    1 Posts
    19 Views
    No one has replied
  • Ubiquiti intigration package?

    13
    1 Votes
    13 Posts
    1k Views
    JeGrJ

    @cloudless-smart-home said in Ubiquiti intigration package?:

    I do the same. any advice on reining them in? things are working fine, I guess, but always trying to learn how to improve / secure my home lab setup.

    In paranoid setups, we've setup the management network for Unifi stuff separate from the default VLAN and actually use that (default VLAN) as a "sort of jail" where devices won't get an IP and are just isolated. So Mgmt runs with all other networks on different VLANs. Initially that's a bit harder to set up so you'll not loose connection between the controller and at least one switch but it works :)
    After that it's really your choice. If you trust the updates and stuff you could leave outgoing HTTP/S open so switches, APs etc. can get their firmware themselves. Others like it better if only the controller itself has web access, no one else. You'd need to deploy the firmware via the controller then by caching it first there and then rolling the upgrading the controller should send it to the device. Or go full defense and revoke internet access from management alltogether and only open it for patch days. That choice is yours :)

    Otherwise reigning them in also means checking for things like RSTP etc. going wild etc. ;)

    Cheers

  • Development Updates Options missing

    3
    0 Votes
    3 Posts
    1k Views
    S

    @jonathanlee I don't see it, but, I suspect 23.05 is not available to test yet. It's not on other hardware, either.

  • IPSec connect through CLI?

    3
    0 Votes
    3 Posts
    418 Views
    M

    @jimp Thank you! That worked!

  • 0 Votes
    5 Posts
    1k Views
    lohphatL

    @steveits Perfect. Thanks!

  • Where is Subnetting Implemented?

    6
    0 Votes
    6 Posts
    777 Views
    jimpJ

    It's all typical subnet math, nothing special about it. The code for checking that is in util.inc, like check_subnets_overlap() but you might also look at things like gen_subnet() and get_subnet_mask() and the v4/v6 specific ones.

    The question is very vague, though. We need more context to know what you're attempting to do that the current checks aren't allowing to know if it's valid.

    While nothing stops something from using the network/broadcast addresses of a subnet (e.g. if it's routed to the firewall, all can be used for NAT so long as they aren't defined on an interface), you still can't force things to work that are not valid at a subnet level when used directly on an interface.

    When using larger subnets, there is indeed nothing special about those addresses either. Such as when using a /23, it's valid to have clients use the .254 and .0 addresses in the middle of the /23.

  • made a widget to change the web configurator theme

    1
    0 Votes
    1 Posts
    415 Views
    No one has replied
  • php shell commands not working - openvpn id needed

    3
    0 Votes
    3 Posts
    779 Views
    Cloudless Smart HomeC

    @heper nice!

  • re-building iso

    2
    0 Votes
    2 Posts
    831 Views
    M

    or can I just rebuild a kernel outside and replace the kernel on a running pfSense ? I would like to disable ALTQ

  • gui/settings change idea for ease of use

    3
    0 Votes
    3 Posts
    1k Views
    jimpJ

    That's something we want to standardize eventually but it's a much bigger task than anyone realizes, and very easy to introduce new bugs in the process. Easy to think/suggest, but much more complicated to implement.

    Overall we'd like to eliminate confusing/negative actions in options and move to a standard type of toggle control that makes it more obvious when things are on/off rather than checkboxes, too.

    But for now we've at least been trying to do the right thing for new functions that get added when it's feasible.

  • expect script not working as expected

    Moved
    7
    0 Votes
    7 Posts
    1k Views
    V

    @mephmanx
    Can you edit and re-import the config?

    If so, there is an <ssh> section within <system>.
    You can add a port line there:

    <port></port>
  • Support for Edwards Curves

    5
    1 Votes
    5 Posts
    1k Views
    johnpozJ

    @aligator638 yeah see my edit, maybe I needed more coffee ;) Not sure what I was thinking - sorry about that.

    I did some research this morning - and it seems there is a way to use it, but not with the official versions as of yet, I saw talk of compiling your own version and or manually doing some settings.

    While that might be possible in pfsense, until its a standard feature in the released versions you most likely will not see it available in the pfsense openvpn settings.

  • One big ruleset

    2
    0 Votes
    2 Posts
    772 Views
    stephenw10S

    So you would like to see a single page firewall view because that would enable drag-and-dropping a selection of rules between interfaces?

    Steve

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.