@AlphaSecurity said in GovCloud Compliance of Google vs. pfSense Open Source Security and Privacy Interests:

I am blocked out from changing the password to one of sufficient quality

Your saying your pfsense was breached, you had it open to the public? The web gui is not available to the public internet out of the box..

If someone accessed your pfsense and changed the password, just console in and reset the password. You then for good measure reinstall clean, etc. The pfsense gui should never be exposed to the public internet without restrictions on what IP can access, or only via vpn access, etc.

@JMV43-0 you know how your router at home nats your public IP to your rfc1918 address. CGnat is like that - the nat is just done in the isp network, and then your router nats the cgnat space 100.64/10 (normally) to your rfc1918 space 192.168/16,10/8 or 172.16/12

Thanks
both IP ranges are /24 now ans can see each other

(feel so silly)

@SteveITS that fs and disk troubleshooting has lots of very useful info - shame it's buried there!

I could certainly image that the faster you push traffic the more is lost, though not necessarily as a percentage.

Do you see the same when connected to other servers? Is that server in London far from you, is the latency high?

Steve

@NollipfSense said in Hot / Standby Pfsense PC:

@stevencavanagh said in Hot / Standby Pfsense PC:

Assuming I back it all up

You're just backing up your workable configuration...nothing more.

Yep, all backed up so just need to order another disk

Update: It looks like a firmware update for the adapters may fix this problem.

So it's been about 6 weeks since anything happened and we had a crash today. Just replying to add 2 pieces of information in case anyone comes across this post in the future. Today we rebooted the VM host for the first time in 8 weeks after pushing some Microsoft updates. Second, I tried to reboot from shell and it hung on stopping ntopng. I think the reboot is anecdotal/coincidental.

@SteveITS I just read them more carefully now, thanks!
That leaves node exporter then.

@stephenw10 Factory reset modem seems to have cleared up the link issue. ISP claims nightly outage is scheduled service

Hmm, well if that is the case you might be able to set the NIC to just link at 1G only and be able to remove the switch.

Yup AFAIK it only affected that one card.

Nice. Yes 32 decimal is 0x20 in hex so 5G only.

@tomasenskede

Root cause identified and resolved!

The issue was related to the Digitus Media converter, which didn't support mixed speeds. I had a 10 Gbps connection on one side and a 2.5 Gbps connection on the WAN side of pfSense.

However, after replacing the media converter with a switch that had both 10 Gbps and 2.5 Gbps ports, the collisions and errors ceased.

Case closed, and now my WAN data flows without any errors!

Can you QOS the backup traffic?
Can you force the backup through a port set to a lower speed?

@jmcmillen It shouldn't do anything :) but per other posts some people say it solves link negotiation issues, or issues where the ISP router reboots and pfSense sees the NIC disconnect/reconnect and restarts packages.

I'd try another patch just to rule it out. I know it doesn't always make sense but...

@invoker Also: https://www.netgate.com/training/pfsense-fundamentals-and-advanced-application

Just the refreshment (based on this thread and on https://unix.stackexchange.com/questions/117023/expanding-the-disk-size-on-pfsense-under-vmware-esxi). pfSense is a Proxmox VM, virtual hard drive is virtio0.

[root@gw-2 ~]# swapoff -a swapoff: removing /dev/label/swap0 as swap device [root@gw-2 ~]# df -h / Filesystem Size Used Avail Capacity Mounted on /dev/ufsid/59d3a17dccecce22 2.9G 2.5G 180M 93% / [root@gw-2 ~]# gpart show => 63 8388545 vtbd0 MBR (4.0G) 63 8388513 1 freebsd [active] (4.0G) 8388576 32 - free - (16K) => 0 8388513 vtbd0s1 BSD (4.0G) 0 16 - free - (8.0K) 16 6291345 1 freebsd-ufs (3.0G) 6291361 2097152 2 freebsd-swap (1.0G)

After the virtual drive expansion (added 2G in the Proxmox interface):

[root@gw-2 ~]# gpart show => 63 12582849 vtbd0 MBR (6.0G) 63 8388513 1 freebsd [active] (4.0G) 8388576 4194336 - free - (2.0G) => 0 8388513 vtbd0s1 BSD (4.0G) 0 16 - free - (8.0K) 16 6291345 1 freebsd-ufs (3.0G) 6291361 2097152 2 freebsd-swap (1.0G) [root@gw-2 ~]# gpart resize -i 1 vtbd0 vtbd0s1 resized [root@gw-2 ~]# gpart show => 63 12582849 vtbd0 MBR (6.0G) 63 12582849 1 freebsd [active] (6.0G) => 0 12582849 vtbd0s1 BSD (6.0G) 0 16 - free - (8.0K) 16 6291345 1 freebsd-ufs (3.0G) 6291361 6291488 - free - (3.0G) [root@gw-2 ~]# gpart resize -i 1 -s 5GB vtbd0s1 vtbd0s1a resized [root@gw-2 ~]# gpart show => 63 12582849 vtbd0 MBR (6.0G) 63 12582849 1 freebsd [active] (6.0G) => 0 12582849 vtbd0s1 BSD (6.0G) 0 16 - free - (8.0K) 16 10485760 1 freebsd-ufs (5.0G) 10485776 2097073 - free - (1.0G) [root@gw-2 ~]# growfs /dev/ufsid/59d3a17dccecce22 Device is mounted read-write; resizing will result in temporary write suspension for /. It's strongly recommended to make a backup before growing the file system. OK to grow filesystem on /dev/ufsid/59d3a17dccecce22, mounted on /, from 3.0GB to 5.0GB? [yes/no] yes super-block backups (for fsck_ffs -b #) at: 6411392, 7693632, 8975872, 10258112 [root@gw-2 ~]# df -h / Filesystem Size Used Avail Capacity Mounted on /dev/ufsid/59d3a17dccecce22 4.8G 2.5G 1.9G 56% / [root@gw-2 ~]# gpart add -t freebsd-swap vtbd0s1 vtbd0s1b added [root@gw-2 ~]# /sbin/glabel label swap0 /dev/vtbd0s1b [root@gw-2 ~]# swapon -a swapon: adding /dev/label/swap0 as swap device

Screenshot 2023-10-04 at 6.34.52 PM.png

2100-SG no go

:(