• 0 Votes
    1 Posts
    1k Views
    No one has replied
  • MOVED: Has anyone setup htop in pfsense environment?

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Random Dropouts 5 Times Per Day

    Locked
    6
    0 Votes
    6 Posts
    2k Views
    C

    Also might be helpful to post the system logs.

  • Syslog: Sending logs to server on a subnet other than the LAN

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    C

    It can send them anywhere. I have some that send to something behind a different router, some that log over IPsec, some over OpenVPN, if the firewall can communicate with that host it can log to it.

  • How bad are power outages?

    Locked
    5
    0 Votes
    5 Posts
    2k Views
    C

    I always intentionally yank the plug on my boxes, have done that thousands of times now and never had anything go wrong. It'll automatically run fsck to repair any filesystem inconsistency.

    Years ago write caching was enabled for a period and could definitely cause filesystem corruption, that hasn't been the case for years though.

  • Show|List ipfw settings.

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Who has pfSense-Full-Update-1.2.3-RC2.tgz around still?

    Locked
    4
    0 Votes
    4 Posts
    2k Views
    chpalmerC

    I have pfSense-Full-Update-1.2.3-20090628-0242.tgz

    I forget what version that is though…

  • Some questions about pfsense (for PCI requirements)

    Locked
    2
    0 Votes
    2 Posts
    1k Views
    jimpJ

    Not sure how this might help, but pfSense keeps the last 25-30 or so config files, which you could run through diff to approximate what you are after.

    On the filesystem, look in /conf/backup/

  • Custom config at bootup

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • MOVED: Traffic shaping by mac address

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • ARP Flood in Logs

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    GruensFroeschliG

    enable Advanced –> Shared Physical Network

  • [SOLVED] Activate inetd at startup.

    Locked
    6
    0 Votes
    6 Posts
    5k Views
    E

    Well, err… My bad...

    You're right perry, many thanks. I got an issue in the script with and semi-colon i added... Now the SH script is ok. ;) And is correctly executed at startup.

    He must be executed correctly before, but did not ran inetd because of syntaxes errors.

    Many and HUGE thanks. And btw thanks for the status.php page, didn't knew about it.

  • Recommendations - large firewall sandwich deployment

    Locked
    27
    0 Votes
    27 Posts
    10k Views
    S

    I am on vacation now and will be slow to respond.  Hopefully the book can help you in the meantime.

  • Huge difference between real ram vs avail ram.

    Locked
    4
    0 Votes
    4 Posts
    5k Views
    W

    My previous response was meant to be qualitative rather than quantitative, indicative rather than exhaustive.

    I don't currently have access to FreeBSD sources on a local system so it would be quite time consuming to do the necessary trolling through the source files to get detailed answers to your questions.

    Here's a bit of quantitative speculation to help illustrate why a fair bit of memory might be needed to "manage" 2GB. A common thing an operating system wants to do is allocate and free pages. Pages can be in a number of different states: free, locked in memory (can't be swapped or paged, example: kernel code, kernel data, active i/o buffers), swappable/pageable etc. We might want to keep some flags about pages (example: a page is shared by a number of users, shared data or code) and a reference count (of sharers) to avoid "freeing" a page which has been released but is still in use by other sharers. So, for each page we might want a data structure with a couple of pointers (to allow quick insertion and removal from doubly linked lists of free pages, locked pages etc, (2 x 4 bytes), flags (say 32 bits), reference counter (say 32 bits). Thats 16 bytes. In a kernel for multiprocessor systems we might also want to add a lock to prevent multiple CPUs trying to change characteristics of the same page at the same time. We might also want to add some debugging information, say 32 bytes all up.

    On a system with 2GB and a page size of 4kB there are 512K pages. So an array of page structures (one element per page) will occupy 325121024 bytes = 1610241024 bytes (16MB).

    Suppose the kernel is allowed to grow to 1GB and it is decided to preallocate the page map pages for the kernel to avoid the complication of having an attempt to grow the kernel fail. The preallocated page tables require a little more than 1MB of RAM. (Note this is not the same as preallocating the 1GB kernel space.)

    @houms:

    Thank you for your response… though I am not sure I understand all of it :). If I understand it correctly, your saying the kernel is allowed to preallocated page tables for its own use?

    Yes.

    something like caching?

    yes (f preallocation is like caching)

    Is 500 MB reasonable in that regard?

    Don't know. I haven't done an exhaustive calculation.

    i mean if BIOS reports say 2014MB, then this is real memory, but is it supposed to use +500MB to manage 2014MB?

    See previous answer.

    and if so, then is it really only managing the avail memory?

    My list of examples of the likely use of that 500MB memory was not meant to be an exhaustive list.

    I am just trying to understand if it is actually using all the ram? I know that question is a bit of an oversimplification, but is that "unavailable" ram being utilized as ram or for kernel functions?

    If FreeBSD swaps or pages its probably using all the available RAM. If it is not swapping and not paging its probably not using all the available RAM.

    The default FreeBSD kernel build in FreeBSD 6.x allowed for a maximum kernel size of 1GB. (I don't know about pfSense nor about FreeBSD 7.x.) If the same applied to pfSense in basic firewall applications there would be little point in having much more than 1GB RAM because the basic firewall application generally does most of its work in the kernel. Of course some applications run sometimes so it would be good to have a bit more than 1GB. In a lot of cases, 2GB will be the next practical step up from 1GB. If the firewall runs applications that use a lot of RAM (snort is reportedly one of those) then additional RAM could be useful.

  • Any way to preserve source address instead of NAT'ing?

    Locked
    3
    0 Votes
    3 Posts
    1k Views
    S

    Thanks - I'll give that a try… sounds like it work work perfectly.

  • Official Software RAID Support

    Locked
    12
    0 Votes
    12 Posts
    6k Views
    jimpJ

    I'm not familiar with NRPE, but if it's anything like the main install of Nagios, you should be able to write a custom shell script for it to call.

    To check the mirror status, execute: /sbin/gmirror status

    And then parse the output from that. Should be fairly simple, if you see COMPLETE, it's ok, if not, it's broken in some way. (you can get fancier than that if you want)

  • Backup with Bacula

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    GruensFroeschliG

    There is a FreeBSD port of bacula.
    Install away…. On your own risk.
    (No official support, you're on your own)

  • MOVED: [SOLVED] Poor performance with IGB Driver -> Known BUG

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Local root exploit

    Locked
    5
    0 Votes
    5 Posts
    3k Views
    ?

    Yep, and the 1.2.3 release is actively being rolled.

  • Question on pfSense and new DNS/Mail/web Server

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    Cry HavokC

    I don't think there's enough there for anybody to answer that question.

    Are you replacing an existing box with a pfSense host?

    Are you using pfSense as a primary or secondary DNS server?

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.