No, just ignoring it.

Further information on both packages @johnpoz listed can be found in this sub-forum: https://forum.netgate.com/category/53/ids-ips. And here is some specific documentation created for the Snort package: https://docs.netgate.com/pfsense/en/latest/ids-ips/setup-snort-package.html.

Thank you, this was the problem...

If you used the wizard the match rules that put traffic in the queues will be on the floating rules tab. Create schedule in Firewall > Schedules. Edit the rule you want it to apply to and set the schedule there in the advanced section. Steve

Yes, VPN into pfSense and then access it from there is far more secure. If you are going to use port forwards you should definitely be using the secure server port (https). Steve

@stephenw10 I got it going. Literally every cable I tried was bad. I feel like an idiot haha. Thanks everyone

well when you manually set it only going to do ipv4? Turn off ipv6.. Does that make your issue go away? With ipv6 still off, set ipv4 to only 1 dns.. You sure this dns is working ;)

man - I'm embarrassed! I thought I'd disabled the proxy for testing but seems I hadn't. I disabled it, tests ran fine, re-enabled it and still worked - must have been a random glitch. thank you so much

Presumably to force you to purchased their VoIP offering. It should be relatively easy to do this by either handing the OpenDNS servers top client to use directly or by having clients use pfSense for DNS and have that forward to OpenDNS. In either case be sure to block or redirect DNS connections to other servers directly. Steve

@johnpoz said in Need to block PSIPhon app: openappid for psiphon I don't believe we have one for that in our detectors ruleset but you might be able to load one fro somewhere else. That is likely the only way you will block it and even then it's not guaranteed if that app is specifically designed to prevent detection. Steve

If you just want to test OpenVPN just setup a port forward to it on the edge firewall. You can use 1:1 NAT to forward all traffic to the test VM if you really need to. Apart from any other port forwards you might already have that is. Steve

Figured it out after you suggested the ping test, turns out i had not specified the gateway in the Windows dhcp scope.... So rookie mistake. Thanks

You mean specify a MAC address the voucher will be valid against in advance or just have the voucher locked to whichever MAC it is first activated against? Steve

post up your pcap of the dhcp conversation, discover, offer, request and ack. If your saying the dhcpd is sending out the correct mask, and others are using it correctly - then you got something wacked on those clients! Options shows that there was an option 1 of type Text with a blank value. Option 1 is - tada - subnet mask. So yeah that would F it up big time!! But you would of seen that in the offer, or lack of the offer containing mask.

Upgrade. Use sudo.

I'd really like to see Zerotier support added to the core product, or a supported package. https://forum.netgate.com/topic/91683/zerotier-one-as-a-package-100usd/67 https://redmine.pfsense.org/issues/9238 It would be pretty cool if "pledges" could be made towards issues in Redmine.

sorry because replying this old post.. so for the oposite operation to import certificate or maybe overwrite a specific certificate it is possible or exist some solution scripting?? at today i'm looking for a solution to automate the copy to anothers pfsense and import these certificate previously generated by acme, i will ask for help to a developer on another department to make a search of the encodec certificate and remplace by the new if it has not be changed or expired over php on xml config, based on anothers scripts like this https://forum.netgate.com/topic/95774/automating-certificate-imports-with-letencrypt-script/12

When you say "Two other devices that need full LAN and Internet access", are these wifi devices, or are they wired devices with cables plugged into your distant network switch? Jeff