• Terrapin SSH Attack

    Pinned
    33
    16 Votes
    33 Posts
    29k Views
    STLJonnyS
    @willowen100 It basically forces your ssh (on the Windows side) to utilize that encryption algorithm. You'll need to do that on any machine you ssh from. I'd have rather found a more elegant workaround (preferably on the pfSense side, so the mod only has to be done in one location), but this works in a pinch.
  • pfSense Hangouts are available on YouTube!

    Pinned Locked
    1
    5 Votes
    1 Posts
    11k Views
    No one has replied
  • Share your pfSense stories!

    Pinned Moved
    76
    0 Votes
    76 Posts
    63k Views
    V
    Mine may be typical, maybe not..... Took over a large sennior living facility with a pretty robust it infrastructure spread between 4 IT rooms, 23 access points, 12-14 switches, and 200 internal devices and 200 guest/resident devices, all being run by a Sonicwall TZ350. I had been wanting to reallign everything network wise for some time but the TZ had 2 ports that were failing. I had worked with ClearOS from back in the ClarkConnect days and started searching for something similar. I found PfSense and it just fit what I wanted to do. I tested it a bit on an old Athalon64x2 rig for proof of concept and had planned on installing on a mini pc or something, but I wanted 6 nics. Standing in my main IT room I looked down and in the bottom of the rack were 4 HP DL380s, 2 of which were decommissioned 2 years ago. It's such huge overkill for hardware that it's hard to explain, but who wouldn't want redundant power supplies, raid 60 with 25 drives and remote system monitoring through ILO? lol I spun one up and loaded PfSense and started tweaking. 2 weeks ago I switched over and have been working out gremlins since.. Overall it's gone well, just one snag that a couple members here have been very kind in helping me work out. Thank you to this page for all the help. [image: 1697753147328-pfsense1.png]
  • Frequent Crashing (Page Fault) After Upgrade to 2.8.0 From Latest 2.7

    60
    0 Votes
    60 Posts
    744 Views
    B
    @rfranzke I'm seeing the same issue here with GPFs occurring regularly every 7~12 hours after a 2.8.0ce install/upgrade. I previously had no issues with either 2.6 or 2.7.2 running on the same hardware prior to upgrade. I did perform the upgrade as a 'fresh install' using the netgate memstick installer and then uploaded the prior configuration xml file to the system. So far I have seen three crashes in the last 24 hours here. All three times Pfsense did reboot after the crash and generate crash reports. (I posted the crash reports in my other message in the 2.8.0ce upgrade thread.) Given the apparent instability of 2.8.0ce at this point, I am seriously considering a roll back to at least 2.7.2. All the best, bill
  • Listen queue overflow

    3
    0 Votes
    3 Posts
    65 Views
    I
    @chrcoluk i added 'kern.ipc.somaxconn' in system tunables and set it to 2048 however I'm still seeing the error Can you clarify what you mean about the OpenVPN lower queue limit and how that mioght be raised ?
  • Port Forwarding stopped working after upgrading to 2.8.0

    71
    0 Votes
    71 Posts
    2k Views
    GertjanG
    @comet424 said in Port Forwarding stopped working after upgrading to 2.8.0: it will work for a long time or so.. then internet doesnt work VPN goe offline.. VPN and WAN internet no longer work.. Pfsense cant ping google.ca but it can ping 1.1.1.1 Please rephrase. You can't reach 1.1.1.1 - and get replies back - when your internet is down.
  • OpenVPN bad encapsulated packet length question

    9
    0 Votes
    9 Posts
    113 Views
    N
    @amrogers3 Now really, you are considering the ai driven forum spams? Don't mess with mtu. its not the cause for dropouts.
  • pfSense Plus 25.03 release question

    26
    1 Votes
    26 Posts
    2k Views
    C
    okay, i`m still waiting for the release of july... ;-)
  • OpenSSL Library Error when Creating New Certificate

    20
    0 Votes
    20 Posts
    2k Views
    T
    I ran into this same problem and ended up in this thread. Having since solved the problem, I wanted to return to report my findings. I had to dig into the PHP source code for the PFSense Web Configurator as well as the C source code for OpenSSL to figure this out. What I found is that these error messages indicate errors when parsing something in the config file, and since it is complaining about an empty or null name, I had some idea what to look for. In my OpenSSL configuration file, I found an empty SAN entry on line 14: /etc/ssl/openssl.cnf # pfSense: default SAN value if $ENV::SAN is not defined # SAN = /etc/ssl/openssl.cnf (after change) # pfSense: default SAN value if $ENV::SAN is not defined # SAN = DNS:myname This simple change solves the issue.
  • Changing My Netgate Contact Information

    1
    0 Votes
    1 Posts
    20 Views
    No one has replied
  • pfSsh.php playback script to change username

    1
    0 Votes
    1 Posts
    11 Views
    No one has replied
  • Strange DNS Issue

    7
    0 Votes
    7 Posts
    102 Views
    johnpozJ
    @JonesTech said in Strange DNS Issue: ;; communications error to 98.142.103.195#53: timed out ;; communications error to 98.142.103.196#53: timed out Those are the 2 name servers for that domain - if you can not talk to them, then yeah your going to have hard time getting the an IP for a record they are serving. nanjones.com. 86400 IN NS ns2.fistbumpmedia.com. nanjones.com. 86400 IN NS ns1.fistbumpmedia.com. Could be a peering problem your isp currently having.. But yeah if you are resolving and can not talk to the owning NS for a domain, your not going to be able to resolve anything from them.
  • Restore backup file from the console CLI

    8
    0 Votes
    8 Posts
    291 Views
    luckman212L
    @patient0 just a quick note, I updated that script to operate correctly on newer versions of pfSense (2.8/25.07). Let me know if you run into any issues.
  • List or toggle rules on/off via CLI

    11
    5 Votes
    11 Posts
    2k Views
    luckman212L
    Just a quick note, I updated my script to operate correctly on newer versions of pfSense (2.8/25.07). Let me know if you encounter any issues.
  • How to block spotify on pfsense?

    7
    0 Votes
    7 Posts
    11k Views
    keyserK
    @ser There is still the IP block option which really BLOCK's it, but is maybe also a little cumbersome. You could look into using the package pfBlockerNG and then select one of two paths: 1: If you can force all clients to only use your pfSense as DNS you could block all DNS lookups that relates to Spotify. That would effectively either require a some good google-foo to find those names, or alternatively setup at test and have your DNS server log all queries when Spotify opens. 2: If Actual blocking is needed rather than just preventing nameresolution, then pfBlockerNG can also be configured to import lists that contains IP addresses. I'm sure there is some site somewhere that maintains Spotify's IP in a list - alternatively you could attempt to fetch the ASN ownership of IP blocks that Spotify owns, ,but that might not cut it (CDN's and such...) Option 1 I ususally the easiest and best working model even though it only prevents nameresolution rather than actual blocking.
  • pimd

    8
    1 Votes
    8 Posts
    319 Views
    M
    @louis2 Hello ! Thank you for your work with pimd ! I have been able to test your pimd binary, it seem to work but I still have the same bug I discribed here When starting PIMD, after a few seconds it works as it should, seeing multicast sources and routing it if needed. But after about 3 minutes, PIMD is "loosing" multicast sources even if pfSense still receive this multicast traffic (packet capures, and network traffic). PIMD does not "receive" multicast source anymore. Restarting PIMD makes it see again multicast sources until it looses it again after about 3 minutes. @louis2 do you have the same problem ? I really do not understand why I have this
  • How to Forward mDNS/Bonjour (UDP 5353) Across IPsec Tunnel?

    3
    0 Votes
    3 Posts
    99 Views
    A
    @dennypage Thanks for the info. Yeah, it appears somewhat complicated with IPSEC. ARD works over IPSEC but without live status and system information, which is what we had hoped to get working over our old IPSEC tunnels. ARD works fully with OPENVPN for us. Has anybody else had some successes here? Thanks, Alfredo
  • Freeing disk space on very old routers (disk space accumulates over time)

    3
    0 Votes
    3 Posts
    78 Views
    stephenw10S
    Indeed, not an easy way I'm aware of. I'd just reinstall clean to be honest. However you may need to wait for the 1.1 installer that has a 'low resource' mode to allow writing to a 4G eMMC.
  • Access to new interface

    routing firewall rules
    4
    0 Votes
    4 Posts
    108 Views
    stephenw10S
    Unless you need to accept inbound connections there it should only be an outbound NAT rule. Even if you did have inbound connections a port forward is often better. You shouldn't need to manually add any rules though as long as the gateway is added into the new interface. That will trigger the auto outbound rule to be added.
  • 2.8.0 fails to save SMTP Notification password

    3
    0 Votes
    3 Posts
    63 Views
    J
    @SteveITS said in 2.8.0 fails to save SMTP Notification password: The test button text does say, "The last SAVED values will be used, not necessarily the values entered here." Ah, but that's not what actually happens. The just-entered new password IS used for the test, but then forgotten by the time you scroll down and "Save".
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.