Hmm, odd. Hard to imagine that it doesn't like running cooler!

@meowmere said in Pfsense 2.6.0 CE - No internet access: could it be from the ISP router configurations that I have to change? You tell us (the details) and we'll tell you ^^

@scilek I've edited my post, I was posting the wrong link. CE link is now there.

@wendel_gt did you enable clam av it updates at night try to disable it you might not have the memory for it

@VioletDragon Same thing. On pfSense, or elsewhere, that all good. remember : processes communicate with 127.0.0.1 = local, to some locally running process, or for example to 192.168.1.10, some device on pfSense LAN, with the same process on that device.

@SteveITS Yes indeed, i found something of this and i edited the .vmx file like i found online. ethernet3.allowGuestConnectionControl = "FALSE" ethernet3.virtualDev = "vmxnet3" ethernet3.networkName = "Wireguard" ethernet3.addressType = "vpx" ethernet3.generatedAddress = "00:50:56:af:20:15" ethernet3.uptCompatibility = "TRUE" ethernet3.present = "TRUE" nvram = "Nieuwefirewall.nvram" vc.uuid = "50 2f 1b 11 f4 3d 4f cb-d2 42 74 21 30 1d 6b 79" ethernet0.pciSlotNumber = "160" ethernet1.pciSlotNumber = "192" ethernet2.pciSlotNumber = "224" ethernet3.pciSlotNumber = "256" scsi0:0.redo = "" virtualHW.productCompatibility = "hosted" floppy0.present = "FALSE" I added the new one here and added the ethernet 3 now everything boots and i get the new adapter and WAN, but.. ofcours there is a but.. 1: If i now go on my lan to the https;//192.168.6.1 site i get nothing, is not loading 2: i NEED to set the ethernet0.pciSlotNumber = "160" on the VMX0 or it does not work BUT i also see that scsi0.pciSlotNumber = "160" is also on 160, if this a problem?

@stephenw10 I guess this cements the death of PFSense CE for me now. I guess it's off to OPNSense for whatever I build next. To bad as I would have gladly paid for basic support - but they got rid of that program too years ago.

@viragomann yes yes, everything is in SSL/TLS and works perfectly in ogni server with the configuration /24 and cmq also activated in CSO

@kirenpillay said in UPNP not detected across 2 private LAN interfaces: more specific terms "upnp" is pretty generic (common) indeed - half the planet seems to have a play box thus huge network problems. But "avahi" is very, enormously unique. Throw this one in any search engines out there and you'll know what it is, does, why it exists. True, what is does is rocket science for the most common mortals, but you're not one them, these days are over. You've installed pfSense ^^

@diehard_02 Normally, I don't use IP block lists, as I don't need a tool that forbids me to go somewhere, if I don't want to go there in the first place. But ok - let's install pfB_PRI1_v4 : [image: 1721975609053-ee4fdc0a-9804-4b9c-abf9-62c0f0d171b6-image.png] and activate it so it block outbound connections : [image: 1721975570797-80c4f7c2-b068-4e3d-b0bb-a86e8f85d987-image.png] After a Force reload : [image: 1721975656310-c95b3e02-c7e7-4a0d-a9ba-5c0a53d8cb64-image.png] all is set up : I've now a floating rule that blocks all IPv4 addresses/networks that are in the list : [image: 1721975701767-f1edc018-bb9d-48bf-a73a-1d7f49945496-image.png] Let's look at the list : https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt [image: 1721975755342-0f44c70c-ca51-43e2-ac92-88649fce2947-image.png] and take the very first IP (IP? not the network !) as an example : I take a browser, and go to : [image: 1721975797605-2e5e5021-d9de-41fb-9a5e-d17238d825ac-image.png] and sure enough, after some time : [image: 1721975814536-44562a39-7245-4e82-ace1-76fc5d735744-image.png] The pfBlockerng alert tells me the same thing : [image: 1721976002371-d45d24e7-30ac-41c5-b65b-702bf3f97a87-image.png] and under IP Block stats I see the same thing : my PC, 192.168.1.6, was blocked when it tried to access 1.10.16.1 : [image: 1721975924106-53c6353f-7329-4e81-a73b-a7011738b82b-image.png] Ok, I add this IP to the white list of this feed : Click on the black round +symbol : [image: 1721976285576-f1d49b39-94b8-4b63-b71a-1c40fb03b205-image.png] You are probably asked if a whitelist should be created, and if you want to add a comment, etc. Now I wind up on this page : [image: 1721976384144-afcd7a72-afcf-4291-ad17-1021dc603c44-image.png] and at the bottom I can see that "10.16.10.1" was added. Save this page. When force reloading, I can see that I have the original feed, and the whitelist : [image: 1721976802618-5a12009a-df70-4163-8d6c-3388f47584db-image.png] Sure enough, 10.16.10.1 wasn't a web server, so my browser, still can't connect to it, but this IP isn't blocked anymore. When I visit it again, the IP block counter doesn't rise = the IP wasn't blocked by pfSense. edit : Just to be sure, as this is not a click contest, but we're still managing a firewall the old classic way : [image: 1721979684913-bbb8e55d-8c3e-42e9-b44a-a1534e39b2bb-image.png] Check that the new Whitelist or permit rule is above the block rule. My white list rule hs taken 'hits' : [image: 1721979754393-ca77e322-0a9c-4ab9-b99e-4438cdec4368-image.png] which means that the rule (with just one IP in it) matched outgoing traffic : that was me trying to contact 10.16.10.1 with my browser.

@bigtfromaz you could maybe limit the outbound nat for only the device you would be coming from lan with. Like your pc... But yeah that works.. If you just add the route as persistent it should survive reboots, upgrades, etc. you shouldn't need a batch to kick off on startup. I would normally allow ping as a way to validate connectivity..

@Stassz You didn't answer @Gertjan 's question...what version of pfSense are you running???

I figured it out - I should not put my authoritative server under the domain override section because unbound put it in a forward zone and expects a dns resolver. Instead, I switched to a stub zone under custom configuration, which requires an authoritative dns server and unbound will perform recursive lookup itself.

AFAIK pfsense doesn’t support this natively but there is a script that you can run using the cron package that works great for me. https://forum.netgate.com/topic/137707/auto-update-check-checks-for-updates-to-base-system-packages-and-sends-email-alerts/3

For reference: https://redmine.pfsense.org/issues/15618

@mkap218 said in Selectively blocking mDNS/Avahi: It seems like I can't use firewall rules to block mDNS from reaching Avahi since there's no way to filter out individual destinations, right? Yes, you can use a firewall rule to block inbound mDNS packets to the firewall, which would prevent Avahi on the firewall from seeing them. That would allow you to say that mDNS for host X on VLAN A is not seen on either VLAN B or C. What you cannot do is to say that host X on VLAN A can be seen by hosts on VLAN B, but not by hosts on VLAN C. By extension, you cannot filter out "_printer._tcp.local" for host X on VLAN A from the advertisements for VLAN B but include it for the advertisements for VLAN C.

SOLVED It was partly my fault. When importing the .XML file it configures the Interfaces per default of my other main FW Hardware. That HW uses different assignment identification than the Netgate, therefore I have mismatched the Interface IDs. Expl.: Current HW Interface assignment Port1 WAN = PPPoE0 Port2 LAN = igb1 Port3 DMZ = igb0 Port4 ANP = igb2 Netgate Interface assignment Port1 WAN = PPPoE0 Port2 LAN = igc2 Port3 opt1 = igc3 Port4 opt2 = igc0

For future ref. phpmailer is included in the mailreport package

@stephenw10 When you say, "It would be much easier if they can just route the /27 to you via the current WAN IP in the /29..." are you saying that the DC changes the gateway address to be the same for both the /27 and /29 here?

@JonathanLee , @waldo15a Ever since the updates to UPnP a few releases back I have always kept my Outbound NAT to Automatic. If I'm not mistaken, the issue with static ports is being handled correctly by UPnP since the updates. And in my ACL entries, I only allow for a few necessary ports 3074-3076 and 28960-28964 required by most (all) games. [image: 1721807732664-567c140c-bd6c-49d4-b816-10d354ce597c-image.png]