@glen4cindy said in New User - Filter YouTube pfSense:

The only issue with this is that I have found "YouTube" is either "allowed" or "blocked" and although I do not have experience with these other services, I've just had it in my mind I'd like to get this setup.

I'm pretty sure the Family Shield settings at OpenDNS allows all YouTube videos.

Jeff

Can we see the system log produced when it fails to connect in a stable manner?

Steve

Ah, yup that will do it! There have been a number changes gone in for 2.4.5 to address that sort of incorrect gateway selection.

Usually if you only have one gateway is will continue to be used whether or not it's marked off-line. It's only if you have gateway groups or failover that it has any effect.

Steve

@jimp Done:

Login Page: Make pfSense Login Page Tab Name More Unique

There isn't a powershell script I'm aware of, but you can connect with ssh and run pfSsh.php playback changepassword admin, then enter the new password and confirm it.

Together with something like clusterssh or tabs with shared input in SecureCRT you could change a bunch to the same password all at once.

@stephenw10 Thank you for this suggestion. Initially it didnt work because i followed the steps literally. So i enabled dns forwarder... after rolling that back and setting domain override in Unbound (dns resolver) it worked.
Although i dont like to manually maintain these records in pfsense it suits the needs for test servers.

====
close.

@jknott said in Advanced congestion control in FreeBSD:

@yon-0 said in Advanced congestion control in FreeBSD:

so i am using openvpn p2p mode, maybe it is helpful.

OpenVPN normally uses UDP, which is not affected by those changes. They only work with TCP.

yes, but i don't know why it is helpfull for network. now i have change othe vpn side ubuntu use Westwood+ congestion control. before use is bbr. but freebsd no find the Westwood yet.

I don't think it will make any difference here but just to confirm the modem you have is an actual Openreach device? Is it the Huawei or ECI 'modem'?
As far as I know there is no difference between them in practical terms and they are not configured any differently for Talktalk.

Steve

The first things to check are these things:
https://www.netgate.com/docs/pfsense/routing/unable-to-access-some-websites.html

Steve

I've been isolating and troubleshooting some more and it seems like it's an IPv6 issue after all.

Fully disabling IPv6 resolves all issues.

So, now I need to find out which pfSense settings need adjustments. There are some tutorials for my ISP (XS4ALL) but none of those resolve the issue.

I'm going to dive into a config export of the ISP's router and see if I can discover something funky. Because that one works.

That seems very odd. The US layout should be the default.

Yes exactly what image are you using?

Steve

@jknott said in Network security in garage:

Only high class burglars can afford to live in Vancouver. 😉

Ha. It probably does mean you have a higher class of bored teenager which is a far more legitimate threat!

Steve

Perfect. It's all the same system.

I'm planning on backingb up say the DHCP section. Edit the xml and cut the static mapping parts out and paste them under the new DHCP server entry for the vlan.

Probably do the same for for the firewall rules too. Mostly any of the labor intensive parts where there's a lot of entries to move.

@akuma1x said in [LAN overlap problem between work VPN and home LAN]

Jeff

That worked! I had one issue that involved changing some rules under the firewall section. Thanks again!

Problem solved

For some reason, the BIOS and pfSense system had been working fine with the SMART settings as they were. However, with an update of pfSense, it appears that it developed a problem trying to access the drives for normal operations as well as the re-install with the BIOS having the SMART options turned off. I turned them on and the errors went away and the system re-laoded with no problems.

Thank you all for your answer.

I am upgrading everything ( getting an i5-560m for AES support, ) and getting new antennas for the wifi card (because the internal antenna cables were cut (not intended) by its old owner unfortunately.

I will use the Pfsense AP as a backup AP then just in case the main one does not reach (the house is not very big anyway)
tomorrow cabling will be done (CAT6E , yes over overkillcables and they were so cheap for some reason and that's the only cables the guy had anyway)

I did not get a success authentication test yet, but I assume this is due to my configuration file or a cert. issue.
Cheers,
N

This is pretty interesting. Any chance You'll have the time to write a How-to? Also how would this work with more than 2 interfaces per firewall?

I am guessing

I am also looking at https://github.com/ndejong/pfsense_fauxapi, however that would require me to write python modules for ansible.

Does the firewall have Internet connectivity and working DNS?

Check System > Routing, make sure you have a gateway set as default
Check Diagnostics > Routes, make sure the default gateway is shown there
Check System > General, make sure that you either have DNS servers set there or you have the DNS resolver setup in non-forwarding mode, with Disable DNS Fowarder unchecked.

Try to ping an Internet site from Diagnostics > Ping
Try to resolve an Internet site hostname from Diagnostics > DNS Lookup

There is not a separate section of the config for user/groups.

You'd have to download complete backups from each site and copy/paste the relevant portions, then restore.