• Terrapin SSH Attack

    Pinned
    33
    16 Votes
    33 Posts
    29k Views
    STLJonnyS
    @willowen100 It basically forces your ssh (on the Windows side) to utilize that encryption algorithm. You'll need to do that on any machine you ssh from. I'd have rather found a more elegant workaround (preferably on the pfSense side, so the mod only has to be done in one location), but this works in a pinch.
  • pfSense Hangouts are available on YouTube!

    Pinned Locked
    1
    5 Votes
    1 Posts
    11k Views
    No one has replied
  • Share your pfSense stories!

    Pinned Moved
    76
    0 Votes
    76 Posts
    63k Views
    V
    Mine may be typical, maybe not..... Took over a large sennior living facility with a pretty robust it infrastructure spread between 4 IT rooms, 23 access points, 12-14 switches, and 200 internal devices and 200 guest/resident devices, all being run by a Sonicwall TZ350. I had been wanting to reallign everything network wise for some time but the TZ had 2 ports that were failing. I had worked with ClearOS from back in the ClarkConnect days and started searching for something similar. I found PfSense and it just fit what I wanted to do. I tested it a bit on an old Athalon64x2 rig for proof of concept and had planned on installing on a mini pc or something, but I wanted 6 nics. Standing in my main IT room I looked down and in the bottom of the rack were 4 HP DL380s, 2 of which were decommissioned 2 years ago. It's such huge overkill for hardware that it's hard to explain, but who wouldn't want redundant power supplies, raid 60 with 25 drives and remote system monitoring through ILO? lol I spun one up and loaded PfSense and started tweaking. 2 weeks ago I switched over and have been working out gremlins since.. Overall it's gone well, just one snag that a couple members here have been very kind in helping me work out. Thank you to this page for all the help. [image: 1697753147328-pfsense1.png]
  • Strange DNS Issue

    8
    0 Votes
    8 Posts
    124 Views
    J
    @johnpoz said in Strange DNS Issue: Could be a peering problem your isp currently having.. But yeah if you are resolving and can not talk to the owning NS for a domain, your not going to be able to resolve anything from them. I came to the same conclusion as it's now miraculously working! I knew I dotted all my i's and crossed my t's and coming up with nothing on my end lead to me to believe it was something upstream. Thanks to everyone that chimed in!
  • If you move pfSense ssd to another pc, will it work in new pc?

    1
    0 Votes
    1 Posts
    19 Views
    No one has replied
  • Port Forwarding stopped working after upgrading to 2.8.0

    73
    0 Votes
    73 Posts
    2k Views
    C
    i think cuz my internet so slow and if it gets bogged down where pages dont load etc that it triggers something in pfsense like a flag and doesnt let internet to work properly again as my internet is only 3mbps and 500k upload and thats if i lucky just bad internet now a days for rural areas.. but i am getting fiber sometime this year they doing projects.... so i figure my slow internet triggers something in pfsense to disable things and restore fixes it now im probably wrong.. but that is what i thinking is going on. from what i experiencing
  • Listen queue overflow

    3
    0 Votes
    3 Posts
    73 Views
    I
    @chrcoluk i added 'kern.ipc.somaxconn' in system tunables and set it to 2048 however I'm still seeing the error Can you clarify what you mean about the OpenVPN lower queue limit and how that mioght be raised ?
  • OpenVPN bad encapsulated packet length question

    9
    0 Votes
    9 Posts
    124 Views
    N
    @amrogers3 Now really, you are considering the ai driven forum spams? Don't mess with mtu. its not the cause for dropouts.
  • pfSense Plus 25.03 release question

    26
    1 Votes
    26 Posts
    2k Views
    C
    okay, i`m still waiting for the release of july... ;-)
  • OpenSSL Library Error when Creating New Certificate

    20
    0 Votes
    20 Posts
    2k Views
    T
    I ran into this same problem and ended up in this thread. Having since solved the problem, I wanted to return to report my findings. I had to dig into the PHP source code for the PFSense Web Configurator as well as the C source code for OpenSSL to figure this out. What I found is that these error messages indicate errors when parsing something in the config file, and since it is complaining about an empty or null name, I had some idea what to look for. In my OpenSSL configuration file, I found an empty SAN entry on line 14: /etc/ssl/openssl.cnf # pfSense: default SAN value if $ENV::SAN is not defined # SAN = /etc/ssl/openssl.cnf (after change) # pfSense: default SAN value if $ENV::SAN is not defined # SAN = DNS:myname This simple change solves the issue.
  • Changing My Netgate Contact Information

    1
    0 Votes
    1 Posts
    25 Views
    No one has replied
  • pfSsh.php playback script to change username

    1
    0 Votes
    1 Posts
    14 Views
    No one has replied
  • Frequent Crashing (Page Fault) After Upgrade to 2.8.0 From Latest 2.7

    60
    0 Votes
    60 Posts
    763 Views
    N
    @rfranzke Its waaaay too difficult to blame faulty installation for random crashes. If something like that happens (say, a faulty drive) then crashes are immediate and repeatable. The bsd bug that Steven has found is a better candidate. Obviously its rare, if it wasn't there would be plenty of reports here about it. Now you are able to catch full crash dumps. A debug kernel is the next thing. This is deep waters and you know it. Give it some time.
  • Restore backup file from the console CLI

    8
    0 Votes
    8 Posts
    292 Views
    luckman212L
    @patient0 just a quick note, I updated that script to operate correctly on newer versions of pfSense (2.8/25.07). Let me know if you run into any issues.
  • List or toggle rules on/off via CLI

    11
    5 Votes
    11 Posts
    2k Views
    luckman212L
    Just a quick note, I updated my script to operate correctly on newer versions of pfSense (2.8/25.07). Let me know if you encounter any issues.
  • How to block spotify on pfsense?

    7
    0 Votes
    7 Posts
    11k Views
    keyserK
    @ser There is still the IP block option which really BLOCK's it, but is maybe also a little cumbersome. You could look into using the package pfBlockerNG and then select one of two paths: 1: If you can force all clients to only use your pfSense as DNS you could block all DNS lookups that relates to Spotify. That would effectively either require a some good google-foo to find those names, or alternatively setup at test and have your DNS server log all queries when Spotify opens. 2: If Actual blocking is needed rather than just preventing nameresolution, then pfBlockerNG can also be configured to import lists that contains IP addresses. I'm sure there is some site somewhere that maintains Spotify's IP in a list - alternatively you could attempt to fetch the ASN ownership of IP blocks that Spotify owns, ,but that might not cut it (CDN's and such...) Option 1 I ususally the easiest and best working model even though it only prevents nameresolution rather than actual blocking.
  • pimd

    8
    1 Votes
    8 Posts
    320 Views
    M
    @louis2 Hello ! Thank you for your work with pimd ! I have been able to test your pimd binary, it seem to work but I still have the same bug I discribed here When starting PIMD, after a few seconds it works as it should, seeing multicast sources and routing it if needed. But after about 3 minutes, PIMD is "loosing" multicast sources even if pfSense still receive this multicast traffic (packet capures, and network traffic). PIMD does not "receive" multicast source anymore. Restarting PIMD makes it see again multicast sources until it looses it again after about 3 minutes. @louis2 do you have the same problem ? I really do not understand why I have this
  • How to Forward mDNS/Bonjour (UDP 5353) Across IPsec Tunnel?

    3
    0 Votes
    3 Posts
    99 Views
    A
    @dennypage Thanks for the info. Yeah, it appears somewhat complicated with IPSEC. ARD works over IPSEC but without live status and system information, which is what we had hoped to get working over our old IPSEC tunnels. ARD works fully with OPENVPN for us. Has anybody else had some successes here? Thanks, Alfredo
  • Freeing disk space on very old routers (disk space accumulates over time)

    3
    0 Votes
    3 Posts
    80 Views
    stephenw10S
    Indeed, not an easy way I'm aware of. I'd just reinstall clean to be honest. However you may need to wait for the 1.1 installer that has a 'low resource' mode to allow writing to a 4G eMMC.
  • Access to new interface

    routing firewall rules
    4
    0 Votes
    4 Posts
    108 Views
    stephenw10S
    Unless you need to accept inbound connections there it should only be an outbound NAT rule. Even if you did have inbound connections a port forward is often better. You shouldn't need to manually add any rules though as long as the gateway is added into the new interface. That will trigger the auto outbound rule to be added.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.