Captive Portal

• M

  pfSense-Bandwidth-Max-Down not working on radius server
  • maherg  

  5
  0
  Votes
  5
  Posts
  17
  Views

  F

  @maherg that's because your freeradius configuration has error please check the logs of your freeradius server.
• D

  captive portal to collect user info without authentication for guests at a restaurtant
  • DeanB_NYTS  

  6
  0
  Votes
  6
  Posts
  13
  Views

  

  @Derelict said in captive portal to collect user info without authentication for guests at a restaurtant: Yeah but there is nothing there that says "give us your email or you can't use the internet" because it is already authenticated. Good point, but only if they figure it out. I'd bet a good percentage of users will just happily fill in the form and be on their way.
• M

  Captive Portal + Radius Server : Create a generated users list
  • moelharrak  

  2
  0
  Votes
  2
  Posts
  12
  Views

  F

  hi, no. you could however create your own system that generates users and insert them into the mysql DB it is possible, using some tweaks in the freeradius configuration. This forum is not for freeradius, so I won't detail many things here, but in short you could know the login date for each user(using accounting), then only accept logins having loginDate<30 minutes in the past. you can do that by changing the SQL queries that freeradius make on the database anyway, this is purely freeradius configuration. no, but you could use an external script to do that
• W

  Captive Portal - ntopng
  • WD_Doug  

  5
  0
  Votes
  5
  Posts
  42
  Views

  W

  @kiokoman - Thanks for the feedback. I haven't thought about squid. I will have to look in to it and research it a little. Then I can have a look at installing it to see some of its configuration & settings. Thanks again......
• T

  Captive Portal Configuration, willing to hire someone...
  • Tom8888  

  9
  0
  Votes
  9
  Posts
  124
  Views

  

  @Tom8888 said in Captive Portal Configuration, willing to hire someone...: then when i try to use the default captive portal page, You mean, you activate the cave portal first .... Then you disconnect your RJ45 cable or Wifi connection ... (to stop any IP,'s states, etc) Re connect .... When the connection (cable or Wifi) is re-established, watch your device closely. If it's recent enough it will tell you some user action is needed (popup on the right bottom of the screen if it's a Windows 7 - on an iPhone or iPad : the login page will show up by itself - Windows 10 : I don't know, I guess it works ...) See the the official video : what did you do - didn't do ? Take note of the DNS settings : if you use the resolver and you did not change any settings, then DNS is ok. And as always : https://docs.netgate.com/pfsense/en/latest/captiveportal/captive-portal-troubleshooting.html Did your device get an IP ? (an IP giving to your device by the DHCP server running on pfSense ?) Did your device get an DNS ? (typically, this will be the IP of the network on which the captive portal is running - such as 192.168.1.1) Did your device get an gateway ? (typically, this will be the IP of the network on which the captive portal is running - such as 192.168.1.1) Before logging in - right after you received an IP/Gaterway/DNS, can you resolve ? Open a 'cmd' and ping to google.com. It will resolve google.com to an IPv4 but there will be no replies (normal, you're not logged in yet). But you saw that "google.com" was resolved something like "209.85.233.139" this means DNS isn't broken. (aka : DNS works - this is important).
• N

  pfsense
  • nit  

  3
  0
  Votes
  3
  Posts
  50
  Views

  N

  @free4 said in pfsense: packetFence I thought of packetfence but am not sure whether I will be able to configure packetfence on one machien and pfsense on another. The confusion was with respect to architecture. Should Packefence be inline with one link to the internal network and the other NIC connected to pfsense which has three nics(two wans and one lan) Will this solution slow down the speed with ths extra latency
• H

  Captive portal ignoring MACs in latest version and allowing all machines access
  • h2professor  

  42
  0
  Votes
  42
  Posts
  358
  Views

  

  I"m still reading here .... trying to figure out. Last couple of weeks I loaded a Hyper-VM on my 2012 Win server, it has 3 NIC's, so I can simulate and test without disturbing my companie network. Also : I'm using a second PC @home loaded with pfSense (using VM also). Detail these 2 phrases : @h2professor said in Captive portal ignoring MACs in latest version and allowing all machines access: After, with 28:c6:8e:0f:95:9b set to Block after.txt I note that the MAC is not found in the second output. As soon as the captive portal is activated on an interface, everybody (MAC, IP, whatever) is blocked. Even when you have this : on the LAN interface. ipfw takes precedence of the ip firewall. ip being the firewall you set up with the GUI. When you add a MAC on the MAC tab as a "pass" , this MAC will be part of your table "default_pipe_mac": 02100 145763334 141217081935 pipe tablearg ip from any to any MAC table(default_pipe_mac) This is a snaphot of your "default_pipe_mac" : dc:ef:09:9b:a8:c0 any 2671 1155484 1699152753 1560263421 any dc:ef:09:9b:a8:c0 2670 11 0 1560262129 You can see the MAC, the pipe rule numbers 2670 (down) and 2671 (up) and the number of bytes received and send. These are the related pipe rules 2670 and 2671 : ..... 02670: unlimited 0 ms burst 0 q133742 100 sl. 0 flows (1 buckets) sched 68206 weight 0 lmax 0 pri 0 droptail sched 68206 type FIFO flags 0x0 16 buckets 0 active ..... 02671: unlimited 0 ms burst 0 q133743 100 sl. 0 flows (1 buckets) sched 68207 weight 0 lmax 0 pri 0 droptail sched 68207 type FIFO flags 0x0 16 buckets 0 active ... Both are unlimited pipes. Btw : I found one (just 1) speed limiting (half a mega / s )pipe : 02223: 500.000 Kbit/s 0 ms burst 0 q133295 100 sl. 0 flows (1 buckets) sched 67759 weight 0 lmax 0 pri 0 droptail sched 67759 type FIFO flags 0x0 16 buckets 0 active Pipe 2223 : so this is device 28:c6:8e:0f:95:9b any 2223 11722 14806366 1560263421 any 28:c6:8e:0f:95:9b 2222 2 0 1560262183 is speed limited - this is the only device I found that was limited speed. The blocked MAC list : as you might have understand, MAC's that are blocked are not present in the ipfw tables and rules. When you add a MAC as blocked, it's been put in a list handled by the GUI. The Captive portal web server, when intercepting a (in your case : http) visitor web browser http requests, are redirected to this page page : (some conditions have to be met, like this page must is on the same LAN segment as the captive portal - there must be a http web server that can serve the page, etc - it might, it might not. For me, using an iphone, it didn't redirect well ) If no URL, the device is blocked, for any IP, for any port, for any protocol. But : when a MAC isn't present on the MAC tab, or it's set as a red block, it won't pass. I advice you to use and old PC to test - make sure there is a second NIC, and setup pfSense for yourself. Although I strongly advise you to use a captive portal on a dedicated - OPT1 - NIC, and leave the LAN for administrative purposes. When applied the minimal setup as per Netgate's video (there are 3 videos on Youtube, the Netgate channel, take a recent one that handles basic operations) no device can connect, and they will show the default Login when you use a web browser on a visiting device. https restrictions might apply. Now, when you add ONE MAC as a pass, this device can pass to the net. Right ? Still, no other device can pass. Right ? Add another MAC as a pass. It passes right ? An still, no other devices can pass. For the fun, add a MAC of a device that you own, as a BLOCK. It can not pass, right ? And again, other, non listed MAC's still can't pass. Etc etc. You could even import your entire "300 MAC" list. I would do this by exporting the config.xml - then use notepad++ to insert the block of .... <passthrumac> <action>pass</action> <mac>xx:8d:79:91:ec:52</mac> <bw_up></bw_up> <bw_down></bw_down> <descr><![CDATA[Sophie]]></descr> </passthrumac> <passthrumac> <action>pass</action> <mac>7c:bb:35:f2:a9:0e</mac> <descr><![CDATA[Serge Nouveau portable]]></descr> </passthrumac> ..... in the correct section, and import that file back in again. Still, unlisted device you own can't pass as they are not part of the list. I ended up listing all my devices (9) as blocked : they didn't pass. I removed them from the MAC tab, so not listed as a pass or block : they still didn't pass. Btw : do not hesitate to reset firewall states. I don't know if it is really needed, but it would harm to reset they all the time, after changes. My main question is : can you replicate your issue on a barebone system, after a manual minimal setup. And if so, after which change your issue happens ? Also : export your .... <passthrumac> <action>pass</action> <mac>xx:8d:79:91:ec:52</mac> <bw_up></bw_up> <bw_down></bw_down> <descr><![CDATA[Sophie]]></descr> </passthrumac> <passthrumac> <action>pass</action> <mac>bb:bb:35:f2:a9:0e</mac> <descr><![CDATA[Serge Nouveau portable]]></descr> </passthrumac> ..... section, and drop it in here. Mistify all MAC's be replacing the first byte by placing 'bb', as I did above. I'll import your list. I wonder if I see the issue then ...
• E

  images from file manager not showing
  • exofio  

  12
  0
  Votes
  12
  Posts
  60
  Views

  

  @kiokoman said in images from file manager not showing: of course not there is a specific section on the Captive portal to load images, Right. It's here : Check out this : Got it ? You see the first "check" : "Use custom captive portal page Enable to use a custom captive portal login page" ? It's not clear if @exofio is using the default, build in login page - which has an optional replaceable background and logo image, or if he is using a self-made login 'html' page.
• X

  pfSense config with daloRadius (freeRadius) to setup download quota limitation
  • xsmael  

  2
  0
  Votes
  2
  Posts
  37
  Views

  F

  I might say obvious things, but did you have a look to the documentation ? It has been updated recently https://docs.netgate.com/pfsense/en/latest/captiveportal/captive-portal-configuration.html
• I

  Send() failed (40: Message too long)
  • ishtiaqaj  

  38
  0
  Votes
  38
  Posts
  10813
  Views

  

  @wazim4u : Do you redirect a new, just logged-in user to an URL ( setting After authentication Redirection URL ) ? This is what I think : when a user logged in using the IP (or URL) of the captive portal page, the users browser gets redirected to the same URL (== the captive pprtal's web server).... which will redirect again - to itself -, and again, and again etc - recursif. The URL thrown back to the browser becomes to big, nginx will finally produce the "send() failed (40: Message too long)" error. For myself, I redirect, no matter what, to "https://www.google.com" but you can take any URL like a your companie's site. Another explanation : you have quiet a lot of portal users. Not every user uses the latest smart devices /PC's with the latest OS and the best browsers. Even I see still IE8 (Windows XP) connecting to my portal. These ancient devices are not portal aware. They won't behave correctly. Or even : not all the apps are written the same way. At least, Apple reviews (some what) each and every app before it's released - the Android society is a pure zoo. So, a bad app can throw out an URL that's to big. nginx will bail out. So, mind you, these are all theories. I do not have the test park to test them.
• D

  Template Roll Printer with options (for 2.2.6, 2.3, 2.3.4, 2.4.0, 2.4.4)
  • DanieleIT  

  70
  0
  Votes
  70
  Posts
  17120
  Views

  

  Hi, (sorry for necroposting here). Excellent and awesome! Kudos for keeping it working still in 2.4.4. Brgs,
• N

  SAML Authentication
  • nico77  

  4
  0
  Votes
  4
  Posts
  40
  Views

  

  Well, it seems supporting LDAP - which is supported by pfSense. Never heard from "shibboleth" related to pfSense .... A forum or Google search confirms. Edit : there is one : https://forum.netgate.com/topic/60524/cp-authenticating-to-idp-via-saml !
• 

  A couple of usability issues come to mind
  • awebster  

  6
  0
  Votes
  6
  Posts
  77
  Views

  

  I agree totally. People that use devices to connect to the Internet are aware of the fact that an capital X and small case x are not always the same. I know - again : we as a company still receive, ones in a while, mails in all capitals - or all lower case. Better yet : check out this forum, you will find the same thing. Btw : forcing whatever is entered as a user name to capital ? No big deal. Find line 216 in /usr/local/captiveportal/index.php Here it is : $auth_result = captiveportal_authenticate_user($user, $passwd, $clientmac, $clientip, $pipeno, $context) Surround $user with "strtoupper" like this : $auth_result = captiveportal_authenticate_user(strtoupper($user), $passwd, $clientmac, $clientip, $pipeno, $context) This will force whatever the user entered, to capitals. True : when pfSense updates, you will have to redo this edit - ones or twice a year. A small shell script that starts when pfSense reboots could do this for you.
• B

  Images in the captive portal are blocked
  • bero.k  

  11
  0
  Votes
  11
  Posts
  617
  Views

  E

  thank you. i am adding the school's default background.
• S

  (SOLVED) PFS 2.4.4 Captive Portal not auto redirecting
  • seramis  

  5
  0
  Votes
  5
  Posts
  85
  Views

  S

  @Gertjan separating LAN and WAN works! great Sir! thank you!
• C

  Logo and Background images missing
  • Cameroncitro  

  4
  0
  Votes
  4
  Posts
  80
  Views

  

  @exofio said in Logo and Background images missing: i cant upload due to img limit size 10mib.. what to do? Serious ? An index landing page that weights over 10 mega ??? If you really have to, put the videos, images and other big resources in separate files, and link to them from the main index login page. Note : None of the files can be bigger then 10 M. Also : everything you upload will be stored into the config.xml file.
• M

  Caching image on external captive portal page
  • Mypfsense2016  

  5
  0
  Votes
  5
  Posts
  784
  Views

  E

  i uploaded the file to var/db/... what code will i use to call it on html file?
• 

  (SOLVED) Captive portal looping
  • awebster  

  4
  0
  Votes
  4
  Posts
  72
  Views

  

  @Gertjan said in Captive portal looping: The 'login' page and nearly identical 'login-error' page are not stored in /var/db/cpelements. Thanks for the tip, that was indeed the source of the problem. An older login page was uploaded (at some point in the past) to the captive portal error page.
• P

  Can't generate Vaucher
  • phdemartin  

  5
  0
  Votes
  5
  Posts
  42
  Views

  P

  @jimp I found the problem, in the Voucher config page, I entered the server ip, the port and the username and password. And it gave me those errors. But if I let them blank, the Local Database being on the localhost, everything work perfectly now. Thanks
• F

  Freeradius3 accounting bugs
  • FrottyZ  

  21
  0
  Votes
  21
  Posts
  1182
  Views

  

  Those are placeholders from when the old forum transitioned to the new one. Images from old posts were lost.
• I

  One Voucher Per Device
  • ishtiaqaj  

  100
  0
  Votes
  100
  Posts
  1406
  Views

  

  Tip : The easiest file to edit / change first the https://pastebin.com/QLhNhgAW : the GUI web config page. Search for 'noconcurrentlogins' occurrences in that file. The only thing that changes in that file is that the state of 'noconcurrentlogins', it chances from // $newcp['noconcurrentlogins'] = $_POST['noconcurrentlogins'] ? true : false; = true or false to true, false or multiple. This is handled in several places, and easy to spot. Test this one first. You can see in the GUI that it works : changing settings in the GUI can be tested using the 'viconfig' command : you should see the state of (noconcurrentlogins) in captive portal settings page.
• 

  One account ONLY for one device on the captive portal
  • ontzuevanhussen  

  2
  0
  Votes
  2
  Posts
  57
  Views

  F

  @ontzuevanhussen said in One account ONLY for one device on the captive portal: one account for one device, but does not disconnect the account that was previously logged. not sure i quite understand...you mean you want to allow only one login per user, and block additional logins attempts using an error page? if yes : pfSense does not natively support this feature. since you seems to be using freeradius, you could nevertheless add some freeradius setting (like simultaneous-Use : 1) to prevent an user to log in more than once. keep in mind that this kind of freeradius setting is not compatible with "reauthenticate users" for obvious reasons... also, independently of "is this technically possible", you should not do this. pfSense is using a MAC address&IP address couple to identify an user. for privacy reasons, a device may change them randomly over time. once its MAC or IP has changed, a device will face the login page again but won't be able to login anymore...is that really what you want?
• 

  Change Notification on Captive Portal Login Page
  • ontzuevanhussen  

  3
  0
  Votes
  3
  Posts
  62
  Views

  

  @free4 Ok, I found it. Thank you so much friend..
• 

  How To Configure FreeRadius on pfsense with Unifi AC Pro?
  • ontzuevanhussen  

  2
  0
  Votes
  2
  Posts
  64
  Views

  N

  @ontzuevanhussen What are you trying to do? Have you registered the aps in freeradius or the controller, it needs to have the aps registered. Try running rasdniff -x from the pfSense cli, it might give you a clue. https://docs.netgate.com/pfsense/en/latest/captiveportal/using-captive-portal-with-freeradius.html
• S

  No internet access when user restarts device after connected to CP
  • ssattannae  

  10
  0
  Votes
  10
  Posts
  119
  Views

  F

  @ssattannae you are welcome if after further testing you still think that the patch is really fixing your problem...then don't hesitate to make a thumbs up on https://github.com/pfsense/pfsense/pull/4042 and/or make a small comment "friendly bump, this pull request resolve a very impactful problem..." The patch and pull request are ready since a while (2.4.4-p2)...the current stable release is 2.4.4-p3 and the pull request is not merged yet...
• D

  [HOWTO] Captive portal + FreeRADIUS + local MySQL user friendly single step
  • deajan  

  154
  0
  Votes
  154
  Posts
  75393
  Views

  

  @Nova9 said in [HOWTO] Captive portal + FreeRADIUS + local MySQL user friendly single step: Maybe the .js files aren't loading properly? Use the right button of your mouse. Every browser will give you the possibility to see the 'html source of the web page. You'll be seeing in a split second if resource files like css and js files are not load, most of the time because they have another file on the system name. Btw : The subject "Captive portal + FreeRADIUS + local MySQL user friendly single step:" is a rather big project. Nothing something that can be pulled of 'ASAP'. Using an old pfSense version gives you a new feature : you created a security time bomb.
• C

  Radius or voucher authentication on same captive portal.
  • christopheb  

  7
  0
  Votes
  7
  Posts
  2528
  Views

  T

  @Trel said in Radius or voucher authentication on same captive portal.: Here's an example multi-method login page. It's probably overkill for anything you're trying to do though. multicappor.txt Can I please have a copy of the code?
• K

  freeradius just stop working
  • kramtw  

  8
  0
  Votes
  8
  Posts
  68
  Views

  K

  i had two different urls in, one disable the freeradius and the other did not. i used both of them and that was the result i observed. with the url that is not disabling the radius i am also redirected to the redit URL.
• G

  CP with Freeradius and MySQL - fixed number of concurrent logins per user
  • Grogorio  

  6
  0
  Votes
  6
  Posts
  4839
  Views

  C

  @jhochwald @jhochwald said in CP with Freeradius and MySQL - fixed number of concurrent logins per user: @EMWEE: Anyone got a solution for this problem? I cant figure it out. I need a solution were a username can use 2 MAC's maximum. So one user can register his phone and laptop on the same account. The Solution is easy: Open /usr/pbi/freeradius-amd64/etc/raddb/sql/mysql/dialup.conf (or i386 if you run this) and search for the following: #simul_count_query = "SELECT COUNT(*) \                             #FROM ${acct_table1} \                             #WHERE username = '%{SQL-User-Name}' \                             #AND acctstoptime IS NULL" Change it to: simul_count_query = "SELECT COUNT(*) \                             FROM ${acct_table1} \                             WHERE username = '%{SQL-User-Name}' \                             AND acctstoptime IS NULL" As you can see it works fine: [2.1.5-RELEASE][root@hotspot.test.lan]/root(24): radtest USER PASS 172.16.1.1:1812 0 Start1234 Sending Access-Request of id 199 to 172.16.1.1 port 1812 User-Name = "USER" User-Password = "PASS" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 172.16.1.1 port 1812, id=199, length=68 Reply-Message = "\r\nYou are already logged in - access denied\r\n\n" [2.1.5-RELEASE][root@hotspot.test.lan]/root(25): Please note: You must configure the Accounting Table in Service/FreeRADIUS: SQL If you do not use your SQL Server for, the feature will not work. P.S.: I configured it on a group base, but it works also per user. Hi, i cant find this path /usr/pbi/freeradius-amd64/etc/raddb/sql/mysql/dialup.conf (or i386 if you run this) i am running pfsense 2.4.4-RELEASE-p3 (amd64) i am looking to limit the logins per user to 2, without a third login kicking out the first one. kindly guide me through please.
• T

  Captive Portal Hard Limits
  • tmtechonline  

  20
  0
  Votes
  20
  Posts
  112
  Views

  T

  @Gertjan Great! I think I saw that code somewhere. Will start with this one. Thanks a lot @Gertjan. If anyone has other ideas that can make this happen, please do add some lines here :)
• A

  Captive Portal Upload and Download Limit
  • AYSMAN  

  2
  0
  Votes
  2
  Posts
  50
  Views

  

  Put them on another LAN/OPTx interface ?! Or, use FreeRadius, which gives a per user upload and download limit - although I guess the MAC added users all still handled by the captive portal main setting. I never tried this.
• L

  captive portal over wireless client access point
  • layek  

  7
  0
  Votes
  7
  Posts
  109
  Views

  L

  thanks
• V

  [Solved] Captive Portal | 1 user per| Log in
  • Vincent_28  

  3
  0
  Votes
  3
  Posts
  54
  Views

  V

  @Gertjan Thank you for the info.
• B

  RESOLVED: Captive Portal - One Time Password Help
  • blaine07  

  14
  0
  Votes
  14
  Posts
  124
  Views

  B

  Alright used it for a hour. Turning that check box, Reauthenticate Users, under Captive Portal Configuration OFF appears to have no other adverse effects. Idle timeout and hard timeout, again on Captive Portal Configuration page, are respected still as well. So I guess the moral is, anyone looking to utilize OTP with Captive Portal...make sure above mentioned box IS UNCHECKED(toggled off). :-) Thank you for all the help and tips @Gertjan; I appreciate your time.
• L

  [Solved] Squid trans proxy and Captive Portal
  • lncsence  

  1
  0
  Votes
  1
  Posts
  39
  Views

  No one has replied

• J

  Captive Portal - Enable / Disable by Schedule or Cron
  • Joao Paulo  

  9
  0
  Votes
  9
  Posts
  113
  Views

  

  @Joao-Paulo you need to understand what that script is doing IPFW is a stateful firewall used by captive portal it does not literally disable captive portal we are putting a firewall rules on top of every other rules inserted by captive portal, in this case the first rule should match and let any connection to go anywhere, so if we analazy the command ipfw add 10 allow ip from any to any keep-state we are telling ipfw to add a rules that allow any ip to go to any destination with priority 10, that should circumvent the captive portal this is for example: [2.4.4-RELEASE][root@pfSense.localdomain]/var/log: ipfw add 10 allow ip from any to any keep-state 00010 allow ip from any to any keep-state :default [2.4.4-RELEASE][root@pfSense.localdomain]/var/log: ipfw list 00010 allow ip from any to any keep-state :default 01000 skipto tablearg ip from any to any via table(cp_ifaces) 01100 allow ip from any to any 02100 pipe tablearg ip from any to any MAC table(test_pipe_mac) 02101 allow pfsync from any to any 02102 allow carp from any to any 02103 allow ip from any to any layer2 mac-type 0x0806,0x8035 02104 allow ip from any to any layer2 mac-type 0x888e,0x88c7 maybe the only trouble that can arise is if there is people that have used captive portal before we add that line and still have a state running, so please explain what is exactly not working
• S

  Captive Portal wget redirect loop
  • SBTech  

  2
  0
  Votes
  2
  Posts
  43
  Views

  

  I tried it and I see there are two redirects, from nbc.com to www.nbc.com, then another to https://www.nbc.com. Note that I do not have captive portal installed so its not an equivalent comparison. While not directly addressing your issue, does it work if you go direct via wget https://www.nbc.com?
• M

  July 22, 2019 Any UPDATE Pre-Auth Captive Portal
  • milivhann  

  4
  0
  Votes
  4
  Posts
  96
  Views

  M

  @free4 well how did you do it correctly?? what's the secret behind???? please tell me please.....i will screenshot the page so you can see whats happening somehow okay
• M

  Guys Do we have development alreadyin Captive Portal Pre-Auth?
  • milivhann  

  2
  0
  Votes
  2
  Posts
  68
  Views

  

  This https://forum.netgate.com/topic/137979/what-happened-to-pre-authentication/3 is as mucth as I know right now - didn't re tested it since.
• W

  Dell R430 bge (Built-in Port Hangs ) & Captive Portal Stop working
  • wazim4u  

  23
  0
  Votes
  23
  Posts
  191
  Views

  W

  I would like to update changes i have made in case someone else is facing same issue now or in future to fix similar problems. given below is status after 2 Days System Running. Captive Portal Status ( 2000+ Users ) Network Status ( so far only 1 Error ) Changes I've Made 1- In /boot/loader.conf.local - Add the following (created new file): for Broadcom NIC kern.ipc.nmbclusters="1000000" hw.bge.tso_enable=0 hw.pci.enable_msix=0 2- In Interface/Portal ( Portal Interface bge2 ) Speed & Duplex select 1000baseT full-duplex ( Auto setting was giving some errors on Zyxel switch logs ) 3- In /usr/local/etc/php-fpm.d/www.conf listen.backlog = 511 ( default ) to listen.backlog = -1 php-fpm related errors gone after changing listen.backlog ( didn't get any till now in two days ) php-fpm error kernel: sonewconn: pcb 0xfffff80130a2f0f0: Listen queue overflow: 193 already in queue awaiting acceptance (155 occurrences) now only one issue i am sorting out related to nginx given below. nginx: 2019/07/20 10:25:19 [alert] 95352#100567: send() failed (40: Message too long)