Suppress the alerts or disable the rules on the Snort instance running on OPT2:
https://docs.netgate.com/pfsense/en/latest/packages/snort/setup.html#select-which-types-of-rules-will-protect-the-network
https://docs.netgate.com/pfsense/en/latest/packages/snort/setup.html#alert-thresholding-and-suppression

Steve

@stephenw10 Got 2% less... (77 to 75%)
Dont really know what to do more then the things you suggested.

There must be something that stores those 10GB's..

@stephenw10 Thanks Steve, I believe that this is the first place I will go.

-John

@stephenw10
Thank you for your beautiful answer
My exact problem is that this happened after adding a router between the firewall and the main switch, and in my opinion, this could be the problem.
thanks steve

@rcfa said in Notifications...:

each time the WAN interface's DHCP assigned IP address changes

I'm using a " Services > Dynamic DNS > RFC 2136 Clients" myself, and I receive a mail when it updates.

each time a DynDNS update fails

Fails ?
If it fails because WAN is down .... wonder how you want to receive the mail then.
Because the some other issue DynDNS server side ?
That needs some modifications here /etc/servcies.invc : function services_dnsupdate_process()
Add your own mail notification lines.

each time a package has an update/new version

Have that :

mer. 24 mai 07:01 Notifications in this message: 1 ================================ 7:01:19 An update to pfSense version 23.05 is available The following updates are available and can be installed using System > Package Manager: acme: 0.7.3_1 ==> 0.7.3_2 Netgate_Firmware_Upgrade: 0.56 ==> 23.05.00 pfBlockerNG-devel: 3.2.0_4 ==> 3.2.0_5 Some packages are part of the base system and will not show up in Package Manager. If any such updates are listed below, run `pkg upgrade` from the shell to install them: 7-zip: 21.07_2 -> 22.01 [pfSense] bash: 5.2.2_1 -> 5.2.15 [pfSense] bind-tools: 9.18.8 -> 9.18.13 [pfSense] ca_root_nss: 3.83 -> 3.89 [pfSense] ccid: 1.5.0 -> 1.5.1 [pfSense] check_reload_status: 0.0.14 -> 0.0.15 [pfSense] .....

There is a script on the forum that does this.

each time a new package becomes available

You mean : when something gets added or changed here : System > Package Manager > Available Packages ?
AFAIK : that doesn't exist yet.
But is very possible to create.

each time a VPN link goes down

Google : "notification when VPN goes down", I'm sure you'll find a script that can be adapted for your needs.

Btw, with VPN you mean the OpenVPN client I guess. Not the OpenVPN server.
Normally, when you really needs the OpenVPN client, you'll know that it is down, as all traffic is routed over that connection : when it breaks, your LAN has no Internet anymore. That doesn't goes unnoticed for very long time ;)

@stephenw10 I have it working now, made a simple mistake, testing too many VLAN ID, I used the wrong one. It is all working as expect now.

Thanks for the assist! :)

@johnpoz

The default was to use the same serial number which is what, I think, I left selected

Will test that again just because, why not

Puzzling

Release Candidates of pfSense CE 2.7.0 and pfSense Plus 23.05.1 Software Now Available

The Release Candidate (RC) builds of pfSense® CE software version 2.7.0, and pfSense® Plus software version 23.05.1, are now available. As we prepare for their final release (currently planned for June 29) we invite you to try out the release candidates and share your feedback with us.

Your speedtests are against different servers. One is much closer than the other. Or is detected as such at least.

@gbn1987 not sure what your trying to do, clients don't normally use dot, ie 853 - clients normally use doh so not sure what your trying to do..

if you want clients to ask pfsense for dns over normal 53, and then have it forward to clouldflare over tls (dot 853).. That would be setup like this.

https://docs.netgate.com/pfsense/en/latest/recipes/dns-over-tls.html

@stephenkwabena yeah that would mean its working - if you can not resolve www.google.com for example then no you would never create a state..

When you can not browse - validate that you can resolve the fqdn your trying to go to. If not then no its never going to work, if you get an IP for the fqdn your trying to go to. Then check you states.. If you see say syn sent, but no answer then were you trying to go didn't answer and problem is upstream, etc.

@ChrisLynch This thread was specifically about a bug in pfBlocker that is long since fixed.

I’d suggest a new thread and look at the output of Diagnostics/System Activity or “top” at a command line to see what’s using CPU.

@viragomann
so how my home assistant works is

pfsense === >dhcp ===> (main server)unraid server(HA VM) gets 192.168.0.12 and has the hostname homeassistant inside the software
pfsense === >dhcp ===> (backup server)unraid server(HA VM) gets 192.168.0.10 and has the hostname homeassistant2 inside the software

i dont do host override etc
and thats how i access home assistant
http://192.168.0.12:8123 or http://homeassistant:8123

ok i set the host over ride to homeassistant.home in the dns resolver
issure1.JPG

Hmm, you might try adjusting the dhcp protocol timing options in the advanced DHCP config options. We have seen edge cases where a modems boot time hit's pfSense's still booting WAN and the client ignores it.

Steve

@kn4thx this might help with the DoH:
https://github.com/jpgpi250/piholemanual/blob/master/doc/Block%20DOH%20with%20pfsense.pdf

@nanoken said in Is pfSense blocking Outlook login (TPM)?:

may as well blame pfsense for Covid it’s that unrelated.

I wouldn't be surprised to be honest that someone prob has blamed it ;) It was routing their 5G connection and brought it into the house - what is the good of firewall that can't filter out the covid from the 5G signal.. hehehehe

@stephenw10 Yes, using 2 different models of CyberPower UPSs (SL700U & CP425SLG) and have been experiencing this flapping since the 2100s were new with v22.05 - 6mo ago. I removed the Nut package shortly after the install when these disconnects were causing the instability of Nut. They are both HID compliant and I was using the usbhid-ups driver with Nut, but it still was flapping. As mentioned, I have them connected to a Raspberry PI with Nut and usbhid-ups driver and it is working great (see pic).

Screenshot 2023-06-22 152945.jpg

In case you're interested, I saved this output. When it disconnected, the UPS device didn't show in a usbconfig listing.

[23.05-RELEASE][jonsmall@pfSense-rider.home.lan]/home/jonsmall: sudo usbconfig ugen0.1: <Generic XHCI root HUB> at usbus0, cfg=0 md=HOST spd=SUPER (5.0Gbps) pwr=SAVE (0mA) ugen1.1: <Marvell EHCI root HUB> at usbus1, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=SAVE (0mA) ugen1.2: <CPS ST Series> at usbus1, cfg=0 md=HOST spd=LOW (1.5Mbps) pwr=ON (50mA) [23.05-RELEASE][jonsmall@pfSense-rider.home.lan]/home/jonsmall: sudo usbconfig -vd ugen1.2 ugen1.2: <CPS ST Series> at usbus1, cfg=0 md=HOST spd=LOW (1.5Mbps) pwr=ON (50mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0110 bDeviceClass = 0x0000 <Probed by interface class> bDeviceSubClass = 0x0000 bDeviceProtocol = 0x0000 bMaxPacketSize0 = 0x0008 idVendor = 0x0764 idProduct = 0x0501 bcdDevice = 0x0001 iManufacturer = 0x0003 <CPS> iProduct = 0x0001 <ST Series> iSerialNumber = 0x0000 <no string> bNumConfigurations = 0x0001 Configuration index 0 bLength = 0x0009 bDescriptorType = 0x0002 wTotalLength = 0x0022 bNumInterfaces = 0x0001 bConfigurationValue = 0x0001 iConfiguration = 0x0000 <no string> bmAttributes = 0x00a0 bMaxPower = 0x0019 Interface 0 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0000 bAlternateSetting = 0x0000 bNumEndpoints = 0x0001 bInterfaceClass = 0x0003 <HID device> bInterfaceSubClass = 0x0000 bInterfaceProtocol = 0x0000 iInterface = 0x0000 <no string> Additional Descriptor bLength = 0x09 bDescriptorType = 0x21 bDescriptorSubType = 0x10 RAW dump: 0x00 | 0x09, 0x21, 0x10, 0x01, 0x21, 0x01, 0x22, 0x5f, 0x08 | 0x02 Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0081 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0008 bInterval = 0x000a bRefresh = 0x0000 bSynchAddress = 0x0000

@stephenw10 Thanks for reply. I was also informed on redline last night.

Hmm, bizarre! Glad it was solved.

Mmm, is that in line with what you get when connected directly?

I agree WAN1 and WAN2 should be identical. I would still test using one of the igc NICs as WAN if you can. If there's some low level issue with the ix NIC/driver the igc NIC may not hit that.

Steve