well i given up so much a headache. i learned about conf/config. on usb it install config so i did that internet partially works.. some websites work most dont.. webpages work on firefox but not Edge Packages will not install at all.. if i manaully install it from the config file it just hang and sits there that its being initialized.. how long does it take 30 min being initialized is long enough "Please wait while the update system initializes" .. Nord VPN is down but Site to Site Open VPN is connected but. and there is a BUT only the other pfsense box. nothong on the network is accessable i locked out.. on 2.5.1 i going crazy i fed up and i got a migrain 4 days and i cant get this to work and the only reponse is its not a bug and what not from the comment above.. i not crazy.. how can it worked for 2.4.5 but soon i upgrade to 2.5.1 its totally broken and its not a bug? ugh for now i give up so fed up and dont know how to get it.. ill just wait till a real stable version out there.. sorry venting too much i just cant figure this out deleted this and that changed WAN interfance to DHCP that i got it to dhcp ... you think it would work .no still broken.. so ill just wait and use 2.4.5 as long as it works till bugs are fixed i appreciate the help and input so far.. i give up for now as no one else really put in input how do i fix this and i searched forum and couldnt find similiar issues i do a usb of 2.4.5 and config file and installs everything ok.. i sitll have some websites not working but i back up and working though ill just wait

That depends a lot, you can play with kali linux attacking from inside.. You could attack the dhcp server, like a dhcp starvation attack.. In case you have Cisco, you could attack the CDP.. You could attack the wifi network, especially those using WEP.. These are just some examples of attacks in case you are already inside the network.. ARP poisining and etc.. Rogue DHCP server, the list goes on... In case you are from outside the network, there is a block all rule in WAN. This block rule means that the firewall won't be accepting anything from outside. In the other hand, you may have a port forward in which your server could be vulnerable, and not pfsense. Also, as pfsense is a stateful firewall, it will allow the clients to go to the internet, and allow the packets to return automatically. Based on that there is a possibility that you have a host that has a malware, botnet, or this host has a CPU vulnerability (MDS, TAA, Spectre/Meltdown) and thus is vulnerable to code execution, which, according to Arch linux security wiki, this host could be remotely exploited just by accessing a website running JAVA..

@coder said in Lets Encrypt certificate files in /conf/acme - What is what here?: But it doesn't work Install Google. Type nginx fullchain and Enter. Use any of the 984255865 supplied links to guide you. Example, the official one is here. The "ssl_certificate" settings needs the fullchain.pem ( V2_my-pfsense.fullchain ) file. The "ssl_certificate_key" setting needs the privkey.pem;(my V2_my-pfsense.net.key) file. You could also have a look at this file : /var/etc/nginx-webConfigurator.conf It's the web configuartion file of pfSense. Guess what : pfSnse uses nginx. ... ssl_certificate /var/etc/cert.crt; ssl_certificate_key /var/etc/cert.key; ... and compare these two file with what you found in /cf/conf/acme/ (that is, if you obtain your certs using the pfSense acme package).

@westlos said in PFSense and Mac Addresses.: What about using apps like Facebook Why would you care if they are? If your that worried, if a real os and not some tablet or phone.. You could change your mac address.. Maybe whatever OS your running on your phone or tablet allows you do it as well? In windows its as simple as this. You can view your mac in windows with ipconfig /all [image: 1619005194139-mac.png] Pretty much any OS, and nic driver should allow you to do this. Be careful with what you set it to.. It needs to be valid, and not a multicast mac, etc. But again - why would you care if some app can see your mac address? Again as mentioned this mac is used on the local L2 only, it not use with traffic to the internet for example, only for your PC to talk to devices on your network, ie your router lan side interface, etc. Its a non identifying number, the 1st show you the maker of the device. 00133B for example is https://www.macvendorlookup.com/ [image: 1619005618450-lookup.png] The last 3 numbers would be just the numbers they put on the specific device when they manufactured it.. There is no way to track that to you.. Other than if got with the maker, and said who did you sell this too, hey store who bought this item with serial# (that is if the store actually tracked purchases based on serial# of some nic sold).. Oh F they paid cash - lets go to the camera's, oh there he is buying it with that hoodie.. ENHANCE VIDEO.. Oh its Bob! ;) Or if that nic was sold to say DELL, then have to get with DELL - hey where did this computer go that you put nic with mac abc in? I think maybe you been watching too many h@ck3r movies ;)

Hi, I have some news. After replacing the Intel 10GBE network card with an Intel X722-DA2 (ixL Interface), my performance problems are gone. But there is a new problem. When testing the 10GB performance I only get a speed of 2.7Gigabit. Here is an excerpt from iPerf3: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 276 MBytes 2.31 Gbits/sec 0 687 KBytes [ 5] 1.00-2.00 sec 273 MBytes 2.29 Gbits/sec 0 687 KBytes [ 5] 2.00-3.00 sec 276 MBytes 2.32 Gbits/sec 0 687 KBytes [ 5] 3.00-4.00 sec 281 MBytes 2.35 Gbits/sec 0 687 KBytes [ 5] 4.00-5.00 sec 279 MBytes 2.34 Gbits/sec 0 687 KBytes 5] 5.00-6.00 sec 280 MBytes 2.35 Gbits/sec 0 689 KBytes [ 5] 6.00-7.00 sec 276 MBytes 2.32 Gbits/sec 0 689 KBytes 5] 7.00-8.00 sec 276 MBytes 2.32 Gbits/sec 0 689 KBytes 5] 8.00-9.00 sec 275 MBytes 2.30 Gbits/sec 0 689 KBytes [ 5] 9.00-10.00 sec 277 MBytes 2.32 Gbits/sec 0 689 KBytes [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.70 GBytes 2.32 Gbits/sec 0 sender [ 5] 0.00-10.00 sec 2.70 GBytes 2.32 Gbits/sec receiver With the command "top -p CC" I see that the test uses only one CPU Core to 100%. However, this only happens when testing the 10GB connection. 1GB tests are distributed over all cores. As it should be. Is there a command or a way to set the pfSense to multicore for 10GBE connections? Thanks in advance. Kind regards, Kotty

@kiokoman said in Send log to syslog server RFC5424: there is some problem with 2.5.1 with nat tho Running 2.5.1 CE here, and it's just fine. I've just one WAN ..... some NAT rules and all is well. But a working Client OpenVPN - does that count as a second WAN ? Also a second WAN created to 'host' a tunnel to ipv6.he.net for my IPv6 access. edit : I'm logging to a LAN based syslogger since day one, somewhere in 2005 : [image: 1618987844205-b2199d95-dac0-4785-a503-d7755c9ecac7-image.png]

thanks a lot @noplan

@biggsy My Qotom computer has the Ethernet ports built into the mom board, so no chance of a fake card.

@vwgti Looks as if this is a problem with PPPOe per here also: https://forum.netgate.com/topic/163074/2-5-1-upgrade-have-no-internet-now-yet-reports-i-do/16

@jgq85 said in "Add Tag" button missing on Interfaces > Switches > VLANs?: It was configured that way before it was shipped by a provider. No freaking clue why anyone would set it up like that ;)

@jdarmstrong It's a syslog Priority value (facility+severity). See RFC 5424.

@leoescarpellin Stop thinking of IPSec vs OpenVPN. Both are just methods to provide an IP connection between 2 points. As such, when the VPNs are up, it's just a matter of routing and rules as to whether traffic can pass between them, just like any other IP connection. Of course, you'll have to ensure network addresses don't collide (the NAT curse strikes again).

@newberger It could be corrupted partition or boot method error. Just fresh install pfsense. A lot user upgraded to 2.5.1 pfsense without rebooting the device first.

@JKnott Sorry pfsense is on the same LAN. I built the whole lab on google cloud to test pfsense api.

@gertjan it says Filesystems are clean, continuing... i have used zfs, so i dont know if still applies? thanks p.s. this is unrelated to the first crashes, those were related to the igb driver i think they are resolved now, i just used the same thread

By selecting the check-box in front of the rule, and click dragging. As usual. Just tested it : works : [image: 1618815731829-64f71557-a257-4efd-a563-08ec4509848b-image.png] Don't know if it was "2.5.0" as it is old by now, but I guess : you would have seen others mentioning your question. The usual solutions will help your : a) Use another browser. b) Hit Ctrl-F5. as this kind of functionality is being handled by your browser. Open the web dev windows of your browser and check if it hasn't troubles loading any javascript - or other files. I'm running the latest - not 2.5.0 : [image: 1618815798587-534166b0-1464-42a0-a261-5ac75f2c229e-image.png]

@joshhboss Most of these questions can be checked, just look at the system in place right now ;) As networks like "10k" don't fall out of the sky, are not created from scratch today. Or are you really implementing a "hotspot Wifi network" on a "new aero port" or very big school or company, with nothing in place at the moment ? You probably want to double the system to make a HA set-up,and both really to be identical from a hardware perspective. Use you current system as a test-bed for updates and spare. The system you propose shouldn't be the first bottleneck you'll find ;)

@stephenw10 I will try it if it happens again. Last night I found that when I upgraded firmware on the 5548p switch the LAG which connects it to my 2428 switch was no longer a LAG. I redesignated those ports and reloaded the router. Maybe there was a network loop? I will know more of it happens again as I won't need the internet back up immediately and can investigate more.