@redfox let's go step by step read this thread, here I describe exactly how to create the environment for game play: https://forum.netgate.com/topic/153514/nat-issues-when-playing-games-on-two-computers once you have interpreted and have a problem, write and I will help ++++edit: @redfox "How would your suggestion work in my situation?" playing can be dangerous behind a firewall as ports need to be opened but with a good setup this shouldn't be a problem

With AEAD ciphers the "hash" function gets used as a Pseudo-Random Function (PRF) instead. It's still necessary, but not necessarily used for hashing. strongSwan is smart enough to do the right thing there. 2.5.0 allows choosing PRF explicitly as well https://redmine.pfsense.org/issues/9309

it actually looks normal to me. i can post it later, but ill have to do extensive redacts. interestingly, the upgrade pre-2.4.5 one has this entry in its backup xml: <opt3> <descr><![CDATA[LAGG0]]></descr> <if>lagg0</if> <enable></enable> <spoofmac></spoofmac> <mtu>9000</mtu> </opt3> and the new fresh install of 2.4.5 does not, but it does have all sub-interfaces for all the vlans, like this: <opt1> <descr><![CDATA[VLAN_130]]></descr> <if>lagg0.130</if> <enable></enable> <spoofmac></spoofmac> <ipaddr>redacted</ipaddr> <subnet>24</subnet> </opt1>

You can't find 2.4.4 info, because that version doesn't exist anymore (snmp bug). The actual version works just fine : root@DiskStation2:~# snmpwalk -v1 -c public 192.168.1.1 | grep 'pfSense' SNMPv2-MIB::sysDescr.0 = STRING: pfSense pfsense.brit-hotel-fumel.net 2.4.5-RELEASE-p1 pfSense FreeBSD 11.3-STABLE amd64 SNMPv2-MIB::sysLocation.0 = STRING: pfSense HOST-RESOURCES-MIB::hrSWRunParameters.426 = STRING: "-q -f /etc/pfSense-devd.conf" Btw : for "regex" reason, this snmpwalk -v1 -c public 192.168.1.1 | grep '2.2.5' will not work. "2.4.5" isn't a literal search string !

@barakath said in Email Alert for CPU Temperature: Diagnostics--> Edit file. Look at it, then never look or even use that option again. To see / load / upload to any device - not just pfSense, but any device around you (Phones, VCR, Access Points, wall clock, coffee machine, you name it), use a SFTP (example : WINSCP, or the far superior SmartFP) to access you pfSense over port 22. Also : activate the SSH access. While you're at it, test also the console access, which show the same info / same access. Also, install Putty (windows SSH client - MAC users have a SSH client build in). Ones you have access, install a descend text editor like 'nano' (or use the good old build in editor 'vi'): pkg install nano Copy the file using select in the Github windows and Ctrl-C - from here https://gist.githubusercontent.com/JMac87/1303f78c56a54165447568318eeca3b3/raw/8eaf407f0aa90d0134be12b51c0996bf9337da70/cpu_temp_alert.sh (the 'raw' view). Then, on pfSense, - login menu option 8 - open non exiting filer with nano like : nano /root/temp.sh and then paste ( Ctrl-V) the script. Ctrl-O to write the file, Ctrl-X to exit nano. 'chmod' the file (see above). etc etc.

Thanks both, that is definitely what's happing, as like bigsy I have an account with Zen. So the answer to my question is no there is no simple way of making my ports stealth . Project abandoned. I tried adding rules to see if they would make any difference which they did not so I will remove them. The implicit deny rule I have added would stop anything internally using those ports anyway. I put an extra implicit deny rule in to monitor any network activity I was not expecting. I presume like most firewalls I have worked on there is an invisible deny rule anyway. Thanks for the help

@GunerX Try to temporary disable "Block bogon networks": [image: 1595222333018-screenshot-from-2020-07-20-08-18-10.png] and run /etc/rc.update_bogons.sh (without force) again

@BocajPF You need 1 NIC on the WAN side. You set up rules according to what you want. You haven't said anything about what you're doing. For example, do you have enough public IPs for all your hosts? If so, then you'd create a subnet for those addresses and not worry about NAT. For example, on IPv6, I get 256 /64 prefixes. Each /64 can be used for a LAN or VLAN. So, on my network, I assign 1 /64 for my main LAN and another for my test LAN. This config means I have a 2nd NIC for my test LAN, in addition to the 1 used for the main LAN. Without knowing what you're trying to do, it's hard to tell you how to do it.

You could always try this: https://forum.netgate.com/topic/64735/speedtest-cli-run-speedtest-on-pfsense-box If I was able to figure it out anyone can. But not as easy as clicking "+Install" ... That said, a speedtest should be run from a client and not the FW. That's what I do. [image: 1595172691719-0da1b89d-5921-495f-9dcd-8437fc2c0531-image.png] [image: 1595172888341-932e0062-0825-4902-8c0b-f44841651d5c-image.png]

@jim0266-f said in Upgrading to 2.4.5 hosed my install: Time blends... Singing to the choir there buddy ;) And the older you get the faster it goes too... I was like it can't be 20 years - can it??? NFW ;) hehehe Had to double check to be sure.. And I was like whew.. Ok it hasn't been that long. heheeh

Thsoe IPs are in the WAN subnet (assuming they are real or representative) they can't be used directly internally. A WAN VIP and 1:1 NAT is the correct way to this if they need to have those downstream routers. They might insist on it if those are separate clients for example. Otherwise you could just have separate VLANs weth pfSense handling the subnets and the clients there directly. Just use a different outbound NAT rule for each to get different public IPs. Steve

@Farisse you welcome

@molepy, Thanks for the reply. What I am currently using works, but is VERY KLUGE. I hate that it kill all states, but that is the only way to make it work. Phizix

#2 there sounds like the expected behaviour with the CSRF check. That has been present for a long time but it was not obvious what was happening. In 2.4.5 a custom page was added that provides feedback: https://redmine.pfsense.org/issues/9799 #1 Obviously should not happen. It can take a lot longer to complete tasks if the firewall has no WAN connection and is trying to use one, such as if you have ACB configured. I've never seen it take 15mins just to complete the wizard though. #3 Is it possible you are doing that before completing or escaping the initial setup wizard? Steve

No, I don't believe that's possible. If the user has sufficient privileges to access vtysh they will be able to access pfSense. At least using the built in user priviledge management. I guess I could imagine a user who's default shell spawned vtysh.... It would probably be relatively easy to escape though. Steve