@stephenw10 Agree, but do you know how pfsense determines the WAN link is UP?

When I reboot with wrong credentials my WAN static IP is shown on the Dashboard which I can ping o.k, the UP timer is running but I can't do anything else and that puzzles me? My Pfsense box is behind an OpenReach fibre modem. Can that issue an IP address from the ISP which does nothing until the link is authenticated by the firewall?

@stephenw10 Thanks, this helps a lot.

No, pfSense is intended to be used through the webgui. There will be functions that only work that way. But you could likely create a php shell script that created users with certs. It would need to be coded directly though.
If you have a very large number of users you probably want to be using some external authentication server anyway.

+1 🤔

Regards

@biggsy

thanks for the Quick reply.
I will use a Docker image as it is only going to be a low load.

@jimp I've restarted the service and that solved the problem.... HACKERMAAAAN 🕺

Which issue specifically is that?

@johnpoz All of the devices use same dns server. It's veeeery strange. I disabled also ipv6 just in case, but nothing works

The only other thing it does is restart the webgui to use the new cert.

@steveits It doesn't look like they are allowed in those various configurations i mentioned. I've been having to hand-type the the networks and ports anywhere outside of the Firewall tab.

@cmcdonald Thanks. I did mess with DNS settings quite a bit lately if that could set this off... Last message about two hours ago, about the time I was done. Fingers crossed that was it. :)

@troy-0 Remove the offending lines from Suppression file:-

Services -> Snort -> Suppression -> List

Then hit save.

Ah, nice!
Yeah it's very easy to get stuck down the wrong path with something like that. Sometimes you need to re-examine the problem.

Steve

Not exactly what you asked for, I do not have multiple pfSense devices here in real action.
I am using IPsec for site-2-site VPN, but because remote devices supports only IPsec v1, the VPN connection is only established by demand (I enable the tunnel in pfSense GUI).
For remote access to my LAN I use both, IPsec (v2) and Wireguard.
Wireguard is really fast compared to the IPsec, but some complain, the client is less secure when the mobile device gets lost.

With IPsec, you can specify an individual password when establishing the connection, with Wireguard all settings are stored iin the configuration. So if someone has physical access to the mobile device, he just opens the Wireguard app and is able to establish a connection.

Regards

@troubleshooting74

You need none of those.

To download an openvpn client config file, go here :
OpenVPN > Client Export Utility

and over a created user ( System > User Manager > Users ) you can select :

c7d3f740-db42-4477-937a-bbe672d4d5f1-image.png

For most of the options, the needed certs will be in the opvn file.

See here https://www.youtube.com/@NetgateOfficial/video and have a look at :
How to use pfSense Plus OpenVPN Client Import Package
Configuring OpenVPN Remote Access in pfSense Software
etc.

no one ? maybe I didn't explain good

the scenario at beginning is

1 vm with pf sense and public ip and lan

1 vm with another public ip and lan

how is possible that disabling 1:1 nat i can still get to the vm with is own public ip? no the pf sense vm obviusly

@johnpoz Thank you, I will try your idea. That is what I want, all internet to go via vpn router and no internet via lan. This is a little slower but I do not read Japanese and some sites have rules for overseas access. Thank you elmo

@orkopaede Hi! Run wireshark on the Windows machine and see if anything catches your eye. Also check Windows power-saving for the NIC you are connecting from. For some poorly written drivers, Windows tends to make some bass-ackwards assumptions about what "energy saving" vs "disrupting key functionality" means.