....unless of course you don't mean the actual CARP traffic (which must be multicast) and are referring to pfsync or config sync, which is a common misconception. Steve

Very old topic, but we use salt to manage our pfsense ;) Thanks to https://github.com/ndejong/pfsense_fauxapi Some links : https://github.com/ndejong/pfsense_fauxapi_client_python https://github.com/alkivi-sas/salt-pfsense

Where is "someone else’s firewall", directly connected to yours ? If so a VIP + 1:1 NAT and a static default route on "someone else’s firewall" pointing to your router should do it. https://docs.netgate.com/pfsense/en/latest/book/nat/1-1-nat.html

@mod said in key based auth ssh issue: 3 . password +public key login works That is not really an option.. If you set password and public key your just using password to auth.. 2: I use linux version of putty and we don't get keygen/ don't need to convert. Pretty sure you do.. https://www.ssh.com/ssh/putty/linux/puttygen 4 Yeah no idea why your bringing that up at all - yeah no shit everyone uses 2 ;) BTW, current stable version of putty is .71

I have to say I would swap out that rl NIC if you possibly can. It will almost certainly cause you headaches in the future. https://github.com/freebsd/freebsd/blob/master/sys/dev/rl/if_rl.c#L48 Steve

well just add it to both groups on tier 3, it's that simple. if tier 1 (high packets loss or high latency) it will switch to tier 2. and if both 1,2 dropped 3 will kick in. you control which one are primary and secondary with tier numbers. believe me every day you will find a new reason to love pfsense more. i love it so much i just installed it on a VPS and configured openvpn on it. so now i have a personal vpn for 5$/moth.

From GUI ? Noop. Download latest "2.4.4" and put it on a stick. Reboot from stick, and do the initial partition thing, etc. It's also advisable to use the config file you saved just before you went to 2.5 - if not, import the 2.5 config and see what happens.

@chpalmer Thank you guys, we will be looking into this!!

You can see that if you rebooted and pfBlocker has not downloaded that alias yet. I often see that with the v4 table but as soon as it loads it the error is resolved. Try deleting the error then going to Status > Filter Reload and reloading the ruleset. If the error doesn't re-appear it has been resolved. Steve

A manual install to prove it works and does what it says it should, maybe in FreeBSD, would be the first step here. It would certainly be interesting though. Steve

Thanks, Steve. I did some more checking, and while it is difficult to know what exactly I changed to make it work, I think I needed to add the domain name to the host name boxes on the DNS Server Settings in General Setup. That, plus a couple of changes in the Cloudflare set-up, solved the problem. Thanks for your input.

@stephenw10, that sounds like it may be the problem. I have the LAGG bridged with the WLAN. I'm going to try and set the bridge's MAC to whatever it happens to be right now and see if that resolves the issue. Thanks for the insight. Best, Chuck

Thanks all for your input. Very helpful. I forgot for a moment that this is enterprise class software/hardware that I am using at home/small business. That being said, @johnpoz your at home case makes a lot of sense too! I followed another post with some PHP that should check and email me about updates (albeit is not working yet - weekend troubleshooting). Will use that and not auto update. Appreciate the education!

Yes indeed... very impressed with HAProxy in pfsense.. My only slight complaint, is that I would like to use a port alias to simplify my configurations but it seems HAProxy doesn't currently support that. So for a web site hosting 80 and 443 connections I need to duplicate everything once for port 80 and once for port 443.

Not sure where you got that idea.. Look again on ISE https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/compatibility/b_ise_sdt_26.html?referring_site=RE&pos=2&page=https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/compatibility/ise_sdt.html Cisco Identity Services Engine Network Component Compatibility, Release 2.6 Again what is the scope of devices your wanting to auth?

yet nobody reported it ;) Its gone now..

@johnpoz Actually, I do. I am using the unbound DNS Resolver with forwarding mode. I got that after you pointed out my mistake and some digging. Look. I am thankful for the help. I really am, but please do not be aggressive. There are some noobs like me who try to understand things by making mistakes and learning from them. We all start from scratch, isn't it?

@zanahoria13 said in Help with simple configuration: How can I set routing from NAT subnet to the internet without hitting home network with the outgoing and incoming traffic? You don't want to set a route for that. Instead set a block firewall rule on that interface in pfSense above any pass rules to deny access to the WAN subnet. That way clients will only be able to access either public IPs or other local subnets. You can also simply omit a pass rule for it. Steve

@johnpoz Thanks for responding. I was inquiring about MFA and not just 2FA. The admin password is secure and not the default or some variation of P@55w0rd. Switch ports on the Cisco switches are protected and therefore plugging in the laptop won't give necessary access. More than anything, I was just curious about pfSense & it's support for MFA/2FA. Thanks -r