@stephenw10 P.S. in case I did not imply it, Thank you for helping me. If you're ever in Illinois, I'll buy you a $drink

Yes, I understand. The goal of resetting the state table after enabling the rule is to understand whether the rule is not matching the traffic or you are not killing the required states when you kill them individually. It's probably the latter since it's very easy to use a filter expression against the state table that cannot be used the kill states. Steve

Opened a feature request: https://redmine.pfsense.org/issues/11102 Add a comments there if more is needed. Steve

Also just an FYI. I ran a file check 4 times and it came back clean everytime. It appears if I run a file check then reboot. PFSense will reboot just fine and obtain an IP. But if I don't run a file check, more often then not. It will not obtain an IP until I reboot like 4-8 times in a row.

I have seen that before if the firewall is under significant DDoS attack. It logs every blocked connection by default but you can disable that by unchecking Log firewall default blocks in Status > System Logs > Settings. Or by adding your own block rule on WAN without logging enabled. That leaves other blocked traffic still available for troubleshooting. What are you seeing in the logs currently? Steve

It's probably because you're sending all your traffic across the VPN, including the registration from the plex server. You probably want to exclude the plex server from the policy routing so it just uses the WAN directly. Steve

@ramses-sevilla said in Where are log files system / openvpn / firewall saved?: Do you know where are saved all log files? Here : [image: 1606133392678-4adabe7f-662f-4121-a70f-79ea8df481e5-image.png] Or here : /var/log/ ( as any othor unix/linix/freebsd/openbsd/etc OS) Note that : @kiokoman said in Where are log files system / openvpn / firewall saved?: 2.4.5 use a binary circular log format known as clog to maintain a constant log size without the need for rotation is a silent hint that explains the need of a quick Google lookup. Or reading the pfSense manual. As https://docs.netgate.com/pfsense/en/latest/monitoring/logs/manage.html or https://docs.netgate.com/manuals/pfsense/en/latest/the-pfsense-documentation.pdf page 139

@Cporter said in See all devices: Does that mean others have the same question and want to see the answer? Noop. They probably read, and abandon. You have a router on the LAN of pfSense. All that can be seen from a pfSense point of view is : the IP of the router source, and traffic to some other IP, where ever on the Internet. It is impossible to see or know what device are behind the router that emitted that traffic. The same goes for your ISP : they can not see if you have one PC, or 100 PC's behind your ISP router. It's part of the concept of routing. So : the fast answer is : your question doesn't make sense - is impossible to answer. You should use a switch behind pfSense, and attach all devices to this switch.

Hi, Open console or SSH. When you see the menu, chose option 8. Goto the root directory : cd / Execute du -h -d 1 From the list shown, take the biggest directory and 'cd' into it : Example : you find that the /var directory is the biggest one : cd /var and repeat the 'du -h -d 1' command, cd into the biggest etc. Report what you have found. To list a directory, type ls -al to see all the files and details. Example : [2.4.5-RELEASE][admin@pfsense.brit-hotel-fumel.net]/var/log: ls -al total 108324 drwxr-xr-x 9 root wheel 1024 Nov 12 09:51 . drwxr-xr-x 32 root wheel 512 Nov 12 09:51 .. -rw------- 1 root wheel 511488 Nov 23 08:41 dhcpd.log -rw-r--r-- 1 root wheel 9832 Nov 12 10:47 dmesg.boot -rw------- 1 root wheel 511488 Nov 2 11:09 filter.log -rw------- 1 root wheel 511488 Nov 20 11:53 gateways.log -rw------- 1 root wheel 511488 Nov 25 2018 ipsec.log -rw------- 1 root wheel 511488 May 9 2016 l2tps.log -rw-r--r-- 1 root wheel 0 Jan 29 2015 lastlog drwx------ 2 www www 512 Jan 13 2020 lighttpd drwxr-xr-x 2 munin munin 512 Jul 13 12:11 munin drwxr-xr-x 2 root wheel 512 Apr 6 2020 nginx -rw------- 1 root wheel 1000000 Nov 23 08:35 nginx.log drwxr-xr-x 2 root wheel 512 Jan 29 2015 ntp -rw------- 1 root wheel 511488 Nov 23 04:51 ntpd.log drwxr-xr-x 2 uucp uucp 512 Mar 19 2020 nut -rw------- 1 root wheel 511488 Nov 23 05:34 openvpn.log -rw------- 1 root wheel 232 Nov 23 08:43 openvpn.status drwxr-xr-x 2 root wheel 512 Nov 23 06:00 pfblockerng -rw------- 1 root wheel 511488 May 9 2016 poes.log -rw------- 1 root wheel 511488 Nov 23 06:44 portalauth.log -rw------- 1 root wheel 511488 Jun 4 08:40 ppp.log -rw------- 1 root wheel 511488 May 9 2016 pptps.log drwx------ 5 root wheel 512 Apr 19 2018 radacct -rw------- 1 root wheel 8634282 Nov 23 08:40 radius.log -rw------- 1 freeradius freeradius 12320 Nov 23 06:44 radutmp -rw------- 1 freeradius freeradius 0 Apr 17 2018 radwtmp -rw------- 1 root wheel 511488 Jul 27 2016 relayd.log -rw------- 1 root wheel 511488 Nov 22 21:33 resolver.log -rw------- 1 root wheel 511488 Nov 20 11:53 routing.log -rw-r----- 1 root wheel 89196103 Nov 23 06:44 sqltrace.sql -rw------- 1 root wheel 511488 Nov 23 08:03 system.log -rw------- 1 root wheel 2158303 Nov 12 10:47 userlog -rw-r--r-- 1 root wheel 591 Nov 23 07:23 utx.lastlogin -rw------- 1 root wheel 192348 Nov 23 07:23 utx.log -rw------- 1 root wheel 511488 May 9 2016 vpn.log -rw------- 1 root wheel 511488 Oct 25 2017 wireless.log

I think will start an ISP and call my packages.. .Ultimate Fiber 10ge, in the small print just put *fiber is used somewhere in the connection when you go to google.com - we promise that 100% ;) Your connection speed may vary..

That site comes up with tls 1.3.. [image: 1606053080061-site.png] So I don't think your setting had anything to do with fixing whatever issue you were having with the site. Maybe the cert was expired before.. With a 90 day cert age, and it being good til feb 13, would mean it was just recently renewed.. 11/15/2020, 4:03:38 PM (Central Standard Time) To be exact ;)

I think the idea is he doesn't want to go there ;) He just wants to go to the site, vs routing it through that site... Something like this is done on the browser.. Before you ever go anywhere. If I try and proxy that with proxy stripping out the shit and going to where you want to go.. https://shitsite.com/blahblah-https://realsite.tld You send connect to your proxy saying you want to go to shitsite.com, but it really goes to realsite.tld and tries to send that back you browser is going to say wtf is this.. That is not shitsite.com.. You do it at the browser level, so browser goes to realsite.tld Keep in mind - with links your going to click on, the addon might not change those... Which is why you use the copy and paste clean option on something you want to click on.. I was not all that worried about tracking stuff via browser called stuff in the site.. But wanted a simple way to clean up shit links before I sent them to friends, etc. Or posted them on forums without having to do it manually.. But what the addon on does in the background is removing tracking stuff in say scripts and other stuff called by a website your loading.. you can turn on local logging to see what its doing in the background.. But for stuff like an email your reading with some shit link like you posted, and you want to just go to where it ends up without routing you through some tracking that you clicked their link - the copy paste is the best option. Or the addon has a little tool you can load to copy paste stuff.. [image: 1606045953731-tool.png]

Thanks for the responses. I realized that I could use the TCP port of the pfSense OpenVPN service on the firewall to accommodate this request of mine. All is good now!

@Modesty Based on http://37.120.203.163 I am going to say it is a NordVPN server.

@guardian Click on the version number in the package screen. [image: 1605975063006-capture3.png]

You wouldn't be changing it on the "modem" you would be making sure that pfsense as it routes and nats that it doesn't drop the ttl.. This is common method of hiding a nat from some device that only wants directly attached device vs many.. This question has been around for ages and ages.. Here is a very very old thread where you edit the scrub value to set a min ttl https://forum.netgate.com/topic/4435/modify-ttl-value-for-security-reasons This will mangle your ttl to be a normal default value, 64, 128, 255 etc.. In your attempt that you have a router with more devices behind it..

@guardian Unbound restart: Status --> Services Find unbound , and press the "Circle arrow" [image: 1605947186296-067cb738-7c41-45df-8f8d-a52b5b6e621e-image.png]

@bingo600 said in Unifi controller on pfsense?: Right .. But in a multi floor building w. a Vlan for each floor. It's pretty cool to just be wandering around with your lappy , and a VoIP call wo. a drop. I don't like the price (WLC) , but love the feature. I first heard of such a system about 11 - 12 years ago. I don't recall the make, but they called it a "blanket". Each AP had to be connected directly back to the controller, without even a switch in between. Back in 2005 I was working at IBM (my 2nd time there) supporting a major U.S. telecom. One woman called in complaining that the Wifi didn't work in the parking garage, an area that specifically didn't have Wifi. She didn't want to accept that as an answer.