• I can't access AP with VLANs

    9
    0 Votes
    9 Posts
    2k Views
    K
    OK, I'm sorry guys… I did everything again and I found this option: "Allow remote access - Remote access allows you to manage the AP from the Internet or from a different LAN. To enable remote access, the gateway device needs to be properly configured, such as opening a port for the corresponding IP address of the AP." I didn't check that option the first time. Now It's running well ;) Thanks! At least, I checked my design with you. I hope this will be useful for other users. Now I have to focus on rules ;)
  • PfSense LAGG to Cisco Nexus Port Channel

    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Critique my design, please?

    19
    0 Votes
    19 Posts
    2k Views
    J
    @kejianshi: Is your POS pfsense rig working ok? Runs good. Ordered another!
  • Traffic graph not displaying for LAN and Sync interfaces

    3
    0 Votes
    3 Posts
    938 Views
    J
    Genius!  THANK YOU!!!
  • SG-2440 purchased from store, a few questions

    3
    0 Votes
    3 Posts
    942 Views
    J
    @phil.davis: 1. The unit is supplied with instructions about where to find the "tuned" image if you need to reinstall completely. And it will look in the special place for updates also. The "community" one works also. I am running that, as it happens, because I often follow the bleeding edge with development snapshots. I believe the "tuning" is things like the content of loader.conf.local but nobody is saying officially. 2. There is no "tuning" in the config.xml AFAIK. You can certainly import a config from elsewhere, reassign interfaces as needed and run. I did that on the 2 SG-2440 that I have in production. Awesome, thank you Phil for the information. I am excited to get it delivered. Hopefully should be here by the end of the week Cheers! Jon
  • Nested aliases don't work on 2.2.x

    2
    0 Votes
    2 Posts
    860 Views
    C
    Nested aliases work fine in general. You wouldn't be able to reach this website if they didn't. Check your table contents under Diag>Tables for that alias to verify.
  • [SOLVED] Undetected Traffic?

    4
    0 Votes
    4 Posts
    1k Views
    C
    Found out it was just a server that was behaving abnormally. Rebooted the server and all is good  :-X Noticed it by looking though pfTop after logging into the console. Thanks for the help!
  • [SOLVED] pfsense forum HTTPS problem

    8
    0 Votes
    8 Posts
    11k Views
    D
    @musicwizard: but my bitdefender also scans the sites SSL. i never changed that setting and its been like that for like 2 years now since i use that one. You might want to disable that shitty "feature". https://forum.pfsense.org/index.php?topic=93188.0
  • PRO's and CON's of having a modem in bridge mode

    13
    0 Votes
    13 Posts
    5k Views
    W
    I have a PPPoA ISP, my Draytek 120 is connected to pfSense in bridge mode, no issues, no lag, no problem. That modem, once you choose PPPoE<->PPPoA passthrough disables NAT and Firewall, also DHCP is disabled….a dumb modem. My pfSense unit takes care of what it can do better than a 25 euro combo modem/router. In the past I had a half-bridge configuration, using a Netgear WNDR3700 router (running openWRT, arokh builds) coupled to a Digicom Modem (it supported half bridge), pfSense seems not to support half-bridge scenarios. Just my experience, ADSL 20/1.
  • PFSENSE vs standard routers

    5
    0 Votes
    5 Posts
    9k Views
    W
    Depends on your personal needs. I have been an avid consumer router buyer, always chasing the last product….and after a couple of year I have been soon disappointed. I don't trust proprietary firmware on consumer router/firewall, I cannot afford and I don't need an enterprise router/firewall, I love open source and build something. pfSense gave me a lot of solutions: open source, very active and professional community, solid software, easy configuration for a home LAN...I put pfSense in a pretty good hardware (see my signature), I will not look at consumer router/firewall anymore. My Netgear R7000 and WNDR3700 have been downgraded to AP.
  • Certificate

    8
    0 Votes
    8 Posts
    2k Views
    johnpozJ
    Yeah this sounds like a mess "router is 192.168.1.1, wired PC is on 192.168.2.1, if I ping the router I get 192.168.3.1, which is my wireless network)." So you have multiple interfaces/vlan on pfsense.. ping the router I get 192.168.3.1 is your router?  Are you talking about pfsense interface on your wireless vlan or are you natting your wireless with a wifi router that is not in AP mode? Why don't you access pfsense with name?  You can setup your rules to be able to hit the lan interface lets call it 192.168.1.1 of pfsenes for its web gui from any of your segments.  You could setup different names for your different segments and hit that interface via that name with cert for that name, etc.  for example pfsense.local.lan is 192.168.9.253 on my setup, and pfsense.wlan.local.lan is 192.168.2.253 this is the pfsense interface in my wireless segment, then a few more dmz, ps3, etc. Personally I never access pfsense gui from anything other than the wired network.. Wifi shouldn't really be open to your firewall admin gui if you ask me ;)
  • Varnish and Multiple servers and multiple ports

    4
    0 Votes
    4 Posts
    3k Views
    G
    If I got it right, seems like a peculiar necessity. Anyway, I'd go with nginx + varnish (if you need caching) combination, and multiple subdomains also. Taking into consideration that remembering an URL is simpler than remembering a port number when it's about end-user interaction. But if you still want to go with varnish and in the way you want it, you need to put its daemon listening on all the ports you want (in your example, 80, 8080, 8081). Then define the all backends you have serving varnish. And, finally, you just set the flux and point the correct backend for the request, based on the server.port attribute. This last one done through the vcl_recv subroutine. I have no means to test it, but should be something like: sub vcl_recv {   if (server.port == 8080) {     set req.backend = webserver2;   }   elsif (server.port == 8081) {     set req.backend = webserver3;   }   else {     set req.backend = webserver1;   } } This documentation can help you with it: https://www.varnish-cache.org/docs/trunk/users-guide/vcl-backends.html If it doesn't work, at least I hope it guides you to the right path. :)
  • SG-2440 Firewall options

    1
    0 Votes
    1 Posts
    878 Views
    No one has replied
  • 3g dongle failover and traffic block

    1
    0 Votes
    1 Posts
    546 Views
    No one has replied
  • PfSense Crashing

    13
    0 Votes
    13 Posts
    4k Views
    F
    Quite possibly, although traffic shaping is not on by default so PRIQ is not enabled at least on what I have here. I'd look through all your logs if you can and see if anything shows up as I suspect its a lack of resource possibly behind the crash. I've noticed my 8Gb SSD machine is struggling to stream data from a radio station causing frequent stutters and hangs in the last two version of pfsense, which I've yet to track down, and I could get it to crash with a 2.42mbps ddos when I attempted to look at the RRD graphs. https://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Priority_Queueing_.28PRIQ.29 "Priority queuing is the simplest form of traffic shaping, and often the most effective. It performs prioritzation of traffic only, without regard for bandwidth." https://doc.pfsense.org/index.php/ALTQ_drivers Section 30.3.2. Enabling ALTQ for more info, but I dont think its on as a default option. https://www.freebsd.org/doc/handbook/firewalls-pf.html You nic's might not even support some or all of the ALTQ features either.
  • Ubiquiti Toughswitch duplex problem

    2
    0 Votes
    2 Posts
    706 Views
    D
    Do yourself a big favour and get a different switch. This one's just POS with known severe bugs totally ignored by UBNT. https://community.ubnt.com/t5/ToughSwitch/bd-p/ToughSwitch
  • Seeting up Subdomains in pfSense

    12
    0 Votes
    12 Posts
    11k Views
    johnpozJ
    So your using a wildcard record..  Not really a good idea if you ask me.. What happens when user goes to sljdflsjdfljdljflsjdff.example com ??  What gets served?  Your default page? In your example you have 2 private side Ips, .10 and .11 – if you this was all just on one box then you don't need a reverse proxy.  Your httpd can see the host headers and serve up whatever site you want to serve be it www.example.com or mail.example.com or whatever.example.com
  • Multiple OpenVPN client connections to multiple VLANs

    3
    0 Votes
    3 Posts
    1k Views
    F
    Also worth issuing a cert to each user, this way you can tell when they have been hacked if someone else attempts to connect, and also having short cert lives which you keep issuing, timescales before expiring depend on what you need for extra piece of mind.
  • Settings long loading times

    9
    0 Votes
    9 Posts
    1k Views
    D
    @creepwood: Wow, that seemed to help. Superfast. Let's hope it's not some sleep thing https://doc.pfsense.org/index.php/2.2.4_New_Features_and_Changes#Security.2FErrata_Notices
  • Ftp server

    19
    0 Votes
    19 Posts
    2k Views
    F
    @KOM: OK, it's fixed.  ARE YOU HAPPY NOW GUYS???  ;D and just amazes me how many people run and use ftp and don't really understand it's pretty simple: the average IT person is expected to be an expert on everything these days, which is impossible.  I fully admit I'm a jack of all IT trades and master of none.  I know enough to (usually) get by, but I must admit that my working knowledge of the exact sequence of FTP handshakes in sorely lacking… Ultimately it boils down to what the programmers decided when writing what looks like a FTP server, the one's I've written even just work on port 21 as there was no need to support more than one connection at a time, in a scheduled time slot fashion. You dont always have to conform to industry standards if the customer requirements are different to others. The avg IT support person can up their game by learning to program as its the programmers who ultimately write the manuals the support people follow, so having a good overview of how everything works and then coding for them can be quite illuminating. Alpha/Beta testing can be useful for understanding the skill of other programmers, seeing the bugs and how quickly things get fixed to understand strengths/weaknesses of said programmers.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.