@othomas said in Web Configurator traffic is not being fragmented when it should be: User data TCP/IP over IPSEC, over IPSEC (again), then over GTP-U. We had to do MSS clamping down to 1280 bytes. ugghh - yeah that isn't fun..

Hi @stephenw10 , glad you liked it! I Opened a feature request at https://redmine.pfsense.org/issues/14923

2.7 was released in June. See: https://docs.netgate.com/pfsense/en/latest/releases/versions.html Currently the config version in 2.7 is the same as in Plus 22.05.1 so you can install 2.7 and import the config again. Downgrading directly is not supported at this time.

@chudak Well no, not really. Better to have it all in one place instead of many threads in many forum categories.

See: https://docs.netgate.com/pfsense/en/latest/services/snmp.html And the linked hangout: https://www.netgate.com/resources/videos-monitoring-pfsense-24-with-snmp The fan status probably isn't available since pfSense doesn't see that. Steve

I understand. Thanks for the feedback.

Link? A quick look into pricing looks like: https://shop.netgate.com/products/pfsense-software-subscription And Enterprise TAC at a home user, ok maybe if you need it?

Yes backup the config and try re-installing clean to be sure.

At the command line run: pkg-static install realtek-re-kmod Then: echo 'if_re_load="YES"' >> /boot/loader.conf.local echo 'if_re_name="/boot/modules/if_re.ko"' >> /boot/loader.conf.local Then reboot and check the boot logs show the 1.98 driver: re0: <Realtek PCIe GbE Family Controller> port 0x1000-0x10ff mem 0xf7a00000-0xf7a00fff,0xf7900000-0xf7903fff irq 16 at device 0.0 on pci1 re0: Using Memory Mapping! re0: Using 1 MSI-X message re0: ASPM disabled re0: version:1.98.00 re0: Ethernet address: 00:0d:b9:38:30:10 Steve

Nice, I expected closer to 3GB so that doesn't seem unreasonable.

No only pfSense Plus is available in AWS.

@hspindel said in ping from WAN disallowed by default?: pinging my DDNS name Well if you have your vpn up, and it reports the vpn IP as your ddns name, and then you ping the ddns name - then yeah you would be pinging the vpn endpoint.

@bumpmark said in PSA - 2.7.0 and ssh keys: It seems that Microsoft has decided Win11 users don't need a later version Not sure why anyone would limit themselves to what MS puts out - just use the another.. You can grab windows version here https://www.mls-software.com/opensshd.html Microsoft Windows [Version 10.0.19045.3570] (c) Microsoft Corporation. All rights reserved. C:\>ssh -V OpenSSH_9.4p1, OpenSSL 1.1.1v 1 Aug 2023 C:\> Or just use your fav client, I use securecrt most of the time, its not a free option. But it is a very robust client.. There is also https://itefix.net/copssh-client which has 9.5p1 C:\tools\copssh_client_7.12.0_x64_free\bin $ ssh -V OpenSSH_9.5p1, LibreSSL 3.7.3 Putty is a common fav as well.

Opened to track it: https://redmine.pfsense.org/issues/14917

@stephenw10 Thanks for the update.

Ok, then first check the state table in Diag > States when you try to place a call. Is the phone opening the expected SIP states? Next would be to run a packet capture for that SIP traffic and check when the phone is actually sending and whether anything comes back from the PBX.

You should block the specific url you are trying to deny access to in Squid. It's a lot of trouble to go to to just block one URL though.

Thanks for the info. This is my first time setting up a pfsense. I have been using Sonicwall for years. Site to Site VPN seems to work good with ipsec. Steven V. Snead, MCSE, CCNA

@stephenw10 will do

You can using openssl, though I've never tried it in Windows: https://docs.netgate.com/pfsense/en/latest/backup/restore.html#encrypted-configuration-files Steve