@keyser @bingo600 After some additional digging it seems it’s not related to Zabbix but rather unbound resolver in combination with pfblockerNG-devel 3.0.16 I started suspecting unbound because “top -SH” in I/O mode (press m) showed that unbound constantly was doing disk I/O I’m investigating further for now, but stopping pfblockerNG (which stops and reconfigures unbound) releases the allocated diskspace which then returns to the 25% it should be. Maybe it’s something related to the new python integration i pfblockerNG and Unbound. The Issue must have arisen when I upgraded to 21.05 from 21.02 I’ll close this thread and create a new one under the pfBlockerNG forum.

@steveits Yup. Unfortunately RealTek holds a huge market share for NIC chips, including in embedded devices and IT appliances, and in my case, the integrated NICs on the motherboard I'm using. Hard to avoid, therefore perhaps should be better supported in FreeBSD. I'm no stranger to FreeBSD and they are notorious for seemingly arbitrary and sudden driver breakages after updates and I'm not entirely convinced the problem wouldn't happen to Intel one day either. Unless they've decided that's the only card they test - which would be short sighted. Too bad this has to run on FreeBSD and not Linux but I do understand why.

@dlogan said in No traffic on WAN, gateway status down, errors "arpresolve: can't allocate llinfo for <WAN IP> on igb1: I have a WAN configured on IGB1 of an SG5100. How? PPP, DHCP, etc? Some hints on this in the logs?

Hmm, not sure why the ix NIC doesn't see it then.

That's a firewall rule and the destination is a public IP. You need a NAT rule too and that changes the destination to the internal target IP for the firewall rule. https://docs.netgate.com/pfsense/en/latest/nat/port-forwards.html#adding-port-forwards Steve

@cza There is the ifconfig command to shut and open an interface, which might help. However, i also suspect it's a hardware issue.

@dilligaf said in Pfsense 2.5 stacks at boot with dots: I also fully understand already that ClamAV isn't going to see encrypted traffic. What I've should have mention where I wanted to go : ClamAV will see the traffic that all the process read and write to disk. What if : some key word(s) in this traffic (the config file to be written) doesn't please ClamAV ? Is there a way, as any (many) anti virus can do : exclude this file from being scanned ? Does the issue exists with ClaAV running and not with ClamAV stopped ?

@mrjoli021 if you plan on inspecting https traffic using squid that's not possible without doing a MITM unencryption of the traffic and even then your users are going to see warnings in their browsers even if you install your own certificates. This will just alarm your users and flood you with complaints. If you want to reduce the chances of your users connecting to malicious sites configure DNS to use the Quad9 servers.

@stephenw10 said in samba server: Nope. Is the short answer. Technically yes, but you shouldn't is the longer one. Steve thanx steve

@nogbadthebad Thanks Nog. I am thinking of testing moving an Apple TV to the IoT.

Thanks for your answers

@jcasale said in Issue with pfSense and having to restart constantly: Where should I look as to the cause of the problem? I looked at the systems logs and have not seen anything that stuck out. Was the Liva PC a wise hardware decision? If not, what hardware would you recommend? It seems that your backup is also corrupted and often it's caused by power failure. Its time for a clean install and clean configuration. No one can comment on your new hardware when you haven't stated what you bought.

@macusers First of all, again check your internet-facing IP on the LTE router. If this is not a real public IP, your ISP provides only a private subnet to you and there is nothing you can do. You will not get any traffic from the internet to your router, cause this is controlled by the ISP. In this case you can only use it for upstream connections.

@ducati0927 What turned out to be the problem? I have the same thing going on with a Spectrum modem right now.

Less important, but I am reducing cable usage on my switch by using 1 10GbE link instead of four 1 Gb links.

The only antivirus you might have on pfSense, clamav, only scans traffic that is cached by Squid. It is probably not doing anything for traffic coming over a VPN. But even if it is it's no substitute for AV on hosts where it can have far more visibility. Steve

That should work. We're going to need to see some data to find out why it isn't. Can we see the ifconfig output with the new card and the interfaces assigned? Steve

@akuma1x said in Block personal wireless devices at work: It is in a safe spot, just in case they need it Sticky note on the monitor?

The logs are straight from Strongswan so maybe: https://wiki.strongswan.org/projects/strongswan/wiki/Loggerconfiguration Though I don't see any specifics there. There are existing log parsers for strongswan though as it's widely used. You might look at those. Steve