I don't know how easy that would be. You could open a feature request for it though: https://redmine.pfsense.org Steve

@BailsBails @BailsBails said in Is there work being done on bringing openvpn up to v 2.5 on pfsense?: Hi Is there work being done on bringing openvpn up to v 2.5 on pfsense? I have a user on OSX using tunnelblick which has recently started mcdvoice receiving warnings and I'd just like to know if there is any work going on at present to bring the openvpn server up to 2.5.X Thanks Bails being a user on OSX i used to wonder the same because i was having same problem some time before when i was using it

Download any crash reports you see. You can also check in /var/crash for old reports. Ah, yes I'm running a different theme on the box I was checking on. The Filter icon does the same thing. If you want a time range you need to use regex to specify it. Steve

And still bad when putting the Verizon router back in line? Or testing directly with a single client? Steve

That would do it if it was on the LAN interface. However you do need to NAT the internal subnets to the WAN CARP VIP on the WAN interface. Without that when it fails over the states will no longer be valid and new states have to be created. https://docs.netgate.com/pfsense/en/latest/highavailability/configuring-high-availability.html#setup-manual-outbound-nat Steve

If the ISP supports v6 is may have sent that ACK in repsonce to a config request. If your interface is not configured for v6 it would just have ignored it. Unless you are actually seeing a connections problem there I would ignore that. I looks like a harmless response. Steve

Why can you not just LDAP to auth to your AD?

It's strictly for a lab environment , on an inside segment. Bingo

@stephenw10 yes it helped thanks for tip. I started learning now about traffic shaping to see if i can do more to improve performance and just to learn about it for fun :)

@stephenw10 is spot on. On the LOG MGMT tab are settings for controlling the size of each active log and for retention of rotated logs. There is also a setting for controlling the maximum allowed size of the entire /var/log/suricata tree. Be sure to allow for some overrun when setting the size limit, though. This is because the log managment feature is handled by a cron task that runs periodically to check on and clean up logs. On a busy network, there can be a lot of log growth that happens in between the 5-minute checks the cron task performs. Unless you have a quite large hard disk (say at least 30 GB or more), then enabling packet logging can be dicey on a busy network. You will need to limit the log size and particularly the retention (the number of old, rotated logs/files kept on disk).

Mmm, already watching.

Yes you can do that. pfSense can run the OpenVPN client and route all traffic through it. But there are two issues that make it at least inconvenient to do this with pfSense. There's no good way to search for and connect to a wifi network from the pfSense GUI. You would need to 'discover' the wifi network on something else and then manually configure pfSense to connect to it. Or use some other device to connect to the wifi network. As you said pfSense will just try to connect to that network to bring up the VPN. You would need to have at least once device that is not routed over the VPN or maybe a particular site you can access by IP that is not routed in order to be redirected to the captive portal login. Steve

@stephenw10 said in System Log: Mmm, I can't answer that without more research but it logs like that on every firewall I see. So whilst it may be a bit ugly it's nothing to worry about. Steve Thank you - Nolli

@kiokoman thank you so much for this tutorial. I will try this setup. Once again, thank you so much I really appreciate your help. :)

If you WAN bandwidths are that different the first thing you should do is weight the gateways in the load-balance group so you get 5:1 connections using the ISP B gateway. Then a great way to set equal bandwidth per user is to use dynamic limiters based on a /32 mask. Unfortunately the screenshots have been lost from here: https://forum.netgate.com/topic/57476/per-ip-traffic-shaping-share-bandwith-evenly-between-ip-addresses The description is still good though. Steve

The VPC subnet is assigned in AWS. All interfaces are DHCP and receive their settings from AWS. This does make things a little odd for some things. So LAN will receive a gateway and be treated as a WAN by pfSense. You probably want to set outbound NAT to manual or hybrid and prevent it NATing out of LAN. Steve

@jpod2019 said in Can you run DHCP, DNS and NTP on different VIPs?: (I’m assuming everything will be done through the LAN interface and VIPs) I'm assuming you mean WAN there. You can have a single interface and it will be WAN and that's fine. The anti-lockout rule will be applied there instead of LAN in that case. If you add a VIP on the WAN all services will listen on it by default so you can add VIPs for NTP and DNS and it will work. DHCP will only run on the interface address though. By default DHCP wil hand out it's own IP for NTP and DNS so you would need to make sure you set those values in the DHCP setup. Though it would still work fine for anything using DHCP since those services would also be listening on the interface IP. Steve

sshguard also protects access to the GUI, not just SSH.

@JKnott ok

Working Thank you soo much.