If your ISP can only provide those IPs to you directly on the WAN, rather then routing them to you via a different public IP, then your options are limited.

You can setup IPAliases for those publlic IPs on the WAN connection and then 1:1 NAT them to private IPs internally. That means the servers using them cannot have a public IP directly which may or may not be an issue.

With a non-PPPoE connection you could bridge the WAN and the internal interface in order to use the public IPs directly on the servers.

Steve

It's NodeBB, https://nodebb.org

@ivor said in Roadmap? Any idea how much longer till I need AES-NI?:

Likely not this year, still a lot of work is to be done.

Thanks.... that's exactly the answer I was looking for. For me it's no rush as I'm in no hurry to lay out more $$ for another mini PC. Given there is a period of support for 2.4.x after 2.5 comes out, it looks like I'm good till about the 3rd-4th Quarter of 2019 before I'm totally unsupported.

This thread is quite old but others who are searching for it may find it helpful.
On Chrome, you can fix this Error by adding -disable-prompt-on-repost

Follow these steps

Open application's folder in Program files in C Drive Right-click and open properties Click on the target field and add -disable-prompt-on-repost to the end of the directory Try again to check if Chrome is still showing the error

Image for reference
Confirm Form Resubmission

Hope this Helps :D

Source: Confirm Form Resubmission

Yes, it is safe.

Firewall > Rules, WAN tab. Edit the OpenVPN rule. Change the protocol to UDP. Save. Apply.

Then update to 2.4.3-p1.

Thanks for the suggestions.

It turns out that it was the physical network adapter. I swapped it out and it has been stable for 5 days now.

You do understand that now your firewall will need human intervention on power cycle. Is your firewall not in a secure location.

What is exactly on there that might be of concern other than the CA, and private key for the web gui? Move the CA off..

This topic has been gone over a few times over the years - its just doesn't have a valid use case on a firewall..

Do any of the major players provide for FDE for their routers/firewalls? Cisco, Palo, Juniper, Fortinet?

Your still open to evil maid attack as well. So what does it buy you? Not like you can loose your firewall, forget it on the subway. someone break window on your car and take it while your parked for lunch, etc.

edit: For ref this the last time I recall this topic coming up
https://forum.netgate.com/topic/114030/installation-with-whole-disk-encryption

Use ZFS if you want to do it - just pointless IMHO and IMPO both personal and professional.

I've rebooted the ISP modem and pulled the ethernet cable out many times as well, and, like you said, no problem. I thought dns at first also but tried to access the gui via ip and it also hung. DNS was also affected though as I could not do an nslookup. Weird?!

@Derelict @JKnott Thanks guys for setting me on the straight and narrow. I'll now hunt down a hub with a BNC port instead of BNC NIC, and I still get to use pfsense :)

Thanks for that. I sort of had a gut feeling it would be Suricata.

I thought the settings allowed for the logs to be regularly emptied but that seems to be not working or either I did not set them up correctly. I will take look and see what I can find out.

Yes I did have Snort installed at one stage but removed it. So I guess I will have to learn how to delete that data that remains.

Much appreciated your reply.

If it can authenticate against Freeradius on localhost it should be able validate against an external radius server.

Can you authenticate against it from Diag > Auth?

Check for valid states being created.

Run a packet capture to make sure it really is trying.

Check the daloradius logs for evidence it's trying to authenticate or any errors.

Steve

It seems like many business branded comps (Dell, Lenovo, etc) have security issues on onboard ethernet (exposing either IPMI or AMT). On my router machine, I'm only using the onboard ethernet for a 'management lan' that gets no internet access at all. IPMI and switch management interfaces shouldn't need to access the internet anyway. WAN and LANs served by an intel 4-port card. I just don't trust those manufacturers to patch management bugs fast enough.

For all those who ran into this data usage issue, I'd urge you to reset your IPMI or AMT interface to factory defaults before locking it down. It's an annoyingly nontrivial task in some cases. If it's got gigs of data usage, I'd be concerned that a bad actor somewhere has pwned your management interface.

@waqar-uk said in General Questions from a Noob:

@johnpoz said in General Questions from a Noob:

@waqar-uk

Yeah they are fine for dumb - but why would you have purchased a smart if all you wanted wanted/needed was dumb. Was your future plan to use them as vlans? If so the v2 version has not gotten a firmware update while the v3 models seems to have a firmware update out that is suppose to fix their mishandling of vlans.

I just bough a TP link 8 port switch to use as a way to pass my Pfsense LAN to many of my devices, be they a wireless AP, power line networking and my main desktop direct Ethernet connection.

They're OK as a regular switch or even for port mirroring. However, you can forget about using them for VLANs.

I would suggest running a VPN between the AWS instance and your home router (which I assume is pfSense, if not why not! 😉 ) so that the NAS IP is always the same private IP.
The VPN itself can just use a dyndns entry or if you use OpenVPN it doesn't matter if the IP changes.

Steve

Yes, you are right. Looping is occuring between in router and pfsense.

Router ip Pfsense ip Router ip Pfsense ip
....

Thx

@jegr said in pfSense as VPN+Firewall on hosted server:

@mkaltoft As I suppose your datacenter ISP that hands out the public IPs hasn't allocated you a public IP subnet/space that could be routed, just let him point all public IPs to IP of the pfSense in VM1. Then use 1:1 NAT or port forwardings to map .171 public to .171 private.

That makes a lot of sense - thank you so much.