Nothing fixed yet for a release.

Currently it's using 23.7:
https://github.com/pfsense/pfsense/blob/master/src/etc/inc/globals.inc#L85

@stephenw10 ok thanks will schedule the update once I’ve backed up some files and got a copy of the firmware from TAC support.

You're only seeing that because you're running the custom package notification script. Most users don't see that and don't need to. The pfSense-upgrade package updates itself when it's run at upgrade.

But you can update that anytime without issues. It's only used at upgrade.

@CatSpecial202 said in Allow only ssh login for admin:

Is it possible to enable SSH login via public key for the admin user?

Not only possible. Its imho pretty mandatory.

Any every server device you use, rent, buy create, uses initially a SSH connection, and the admin (mostly root) + password is send to you.
Or you created these when installing the OS.

Os soon as you enter the first time, you create cert. Export the public part to yoruself, so you can use it with your SSH client, for example Putty.

The 'admin' user on pfSense should have this part :

f6007dfb-5168-45c3-94ac-6a40cb5ad49d-image.png

and then you select (again : pfSense) :

7afdc234-f7df-4035-8ef6-381c4dc4708e-image.png

and from now on, your SSH client will be needing the exported cert to be able to connect to pfSense :

69e4ee4d-b341-4809-a487-237a2f376f0a-image.png

and I have to type in the password == passphrase of the cert, not the admin password.

Do this with pfSense, and any other device you can connect to over SSH - if possible.

edit : don't even bother grating other users access to pfSense with non admin accounts.
pfSense is a router, not some multi media file server.
I always recommend severely creating an ssh admin pfSense so you can have access, when needed.
Some will then never really use it afterwards.
Other - like me - use it several times a day. As I use the same connection with for example WinSCP, so I can explore the file system, and look at things like using Windows explorer. Don't ask me why ^^

If needed, block the SSH port TCP 22 to some known LAN IPs.
Lock your own devices, the ones you can use to connect to pfSense, with a DHCP MAC lease, so from now on they will always have the same IP.
Throws these IPs in a Alias.*Use this Alias to create a LAN firewall rule.
From now on, only these IPs can use the pfSense SSH port.

Read security nerds will use a dedicates admin LAN, and connect to this LAN with their device to access pfSense SSH.
Now lock your pfSense into a safe. Lock the safe. Done. Now you're close to what they use at Langley.

Hmm, that output looks as expected. There is no significant CPU load shown.

Does it only appear when checking the dashboard in the GUI?

@Gertjan
Well, thanks. That did work:

[2.7.2-RELEASE][root@router.somesite.com]/root: fetch --ca-cert=/var/etc/cert.crt https://router.somesite.com/android-chrome-192x192.png android-chrome-192x192.png

@erfggi 👍 Thanks.

The size and usage are shown on the dashboard in the Disks widget.

Screenshot from 2025-01-15 13-05-33.png

@jimp say you use a second drive for logging should it be gpt and ufs what would be the newfs?

@Mushvan said in Why is my pfSense Firewall Lagging and Giving 504 Gateway Timeout Errors?:

But should pinging 60 interfaces really be this difficult for pfSense?

Wow .. 60.
A small script file that send a ping packet every ... not sure, 250 ms or so, and even 60 of them, that's no big deal.
But when one, or more of them get triggered because the interface and/or isn't there anymore ... dpinger will take action : it will reset (like pull down == destroy and pull up == recreate) the connection.
And now for the fun part : this will have a cascade effect on other processes, like nginx and unbound, just to name two of them, that will also get restarted. I've this 'feeling' that the 'mess' this creates goes up exponentially.
Your router is lagging, spikes to 100 % core usage etc ? I'm not very surprised.

I don't have the hands on experience, as I'm just a "2 WAN and 4 LAN ports guy", but If I had to 60 interconnections , 60 interfaces to manage, I wouldn't take that "Swiss Army Knife" firewall router called pfSense, but something more bare bone like TNSR ?

@stephenw10

yes I believe I believe it's stopping at the loader prompt.

I will test it further again with it unplugged, change of cable and so forth.

I have a couple of the RJ45 to USB cables including an office Cisco cable.

@Gertjan said in Console connection halts reboot:

@stephenw10

Nice catch !
The issue looks like this : 24.03 no auto boot.

I'll have a read, thank you.

@stephenw10 said in 4100: pkg: An error occured while fetching package:

Looks like there were some backend issues earlier today but that should be resolved now.

We noticed 😊

Nice. Significant!

Yeah we are looking at how best to handle this going forward.

NICE!

If your ISP requires VLAN7 for DSL then it needs to be configured correctly. On the 1100 that means configuring the PPPoE session on mvneta0.7 and passing that tagged through the built-in switch.

But also check if the router/modem is doing that for you in pass-through mode because double tagging would likely also break it.

@Luca-De-Andreis said in PHP ERROR: Type: 1:

But is not included in patch 2.2.20 ?

Look at the list below :

9ea6961b-6665-46e5-be14-fecf558e7c26-image.png

You can believe your iwn eyes : if it isn't there ... it isn't there 😊

A little bit to late to be included in 2.2.20, or it isn't an an 'important' patch as this issue can't happen, as humans shouldn't enter the portal URL manually. And if they do, they shouldn't make errors when typing it in (I know, they will make errors).
Portal user have to enter the URL them selves on your portal ?

@JonathanLee said in Differentiated Services (DiffServ) Identifiers:

What TOS would constitute full bandwidth use on pfSense?

pfSense doesn't use those values at all by default. You can use them in rules for shaper queues if you want to or set that for use in other devices the connection is going through.

@johnpoz I have it broke up like this

# This file is automatically generated by pfSense # Do not edit manually ! http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=100MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=100MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=100MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE icp_port 0 digest_generation off dns_v4_first on pid_filename /var/run/squid/squid.pid cache_effective_user squid cache_effective_group proxy error_default_language en icon_directory /usr/local/etc/squid/icons visible_hostname Lee_Family.home.arpa cache_mgr jonathanlee571@gmail.com access_log /nvme/LOGS_Optane/Squid_Logs/access.log cache_log /nvme/LOGS_Optane/Squid_Logs/cache.log cache_store_log none netdb_filename /nvme/LOGS_Optane/Squid_Logs/netdb.state pinger_enable on pinger_program /usr/local/libexec/squid/pinger sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048 tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt tls_outgoing_options capath=/usr/local/share/certs/ tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS sslcrtd_children 50 logfile_rotate 10 debug_options rotate=10 shutdown_lifetime 3 seconds # Allow local network(s) on interface(s) acl localnet src 192.168.1.0/27 forwarded_for delete via off httpd_suppress_version_string on uri_whitespace strip acl block_hours time 00:30-05:00 ssl_bump terminate all block_hours http_access deny all block_hours icp_port 0 htcp_port 0 snmp_port 0 icp_access deny all htcp_access deny all snmp_access deny all acl getmethod method GET acl to_ipv6 dst ipv6 acl from_ipv6 src ipv6 #tls_outgoing_options cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls_outgoing_options options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1,NO_TICKET,SINGLE_DH_USE,SINGLE_ECDH_USE #tls_outgoing_options default-ca=on acl HttpAccess dstdomain '/usr/local/pkg/http.access' acl windowsupdate dstdomain '/usr/local/pkg/windowsupdate' #acl rewritedoms dstdomain '/usr/local/pkg/desdom' #store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt #store_id_children 10 startup=5 idle=1 concurrency=0 #always_direct allow all #store_id_access deny connect #store_id_access deny !getmethod #store_id_access allow rewritedoms #store_id_access deny all refresh_all_ims on reload_into_ims on max_stale 20 years minimum_expiry_time 0 refresh_pattern -i windowsupdate.com/.*.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims refresh_pattern -i microsoft.com/.*.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims refresh_pattern -i windows.com/.*.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims refresh_pattern -i microsoft.com.akadns.net/.*.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims refresh_pattern -i deploy.akamaitechnologies.com/.*.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims refresh_pattern -i windowsupdate.com/..(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200 refresh-ims acl https_login url_regex -i ^https.*(login|Login).* cache deny https_login range_offset_limit 512 MB windowsupdate range_offset_limit 0 !windowsupdate quick_abort_min -1 KB cache_mem 256 MB maximum_object_size_in_memory 512 KB memory_replacement_policy lru cache_replacement_policy lru minimum_object_size 0 KB maximum_object_size 512 MB cache_dir diskd /nvme/LOGS_Optane/Squid_Cache 32000 16 256 offline_mode off cache_swap_low 90 cache_swap_high 95 acl donotcache dstdomain '/var/squid/acl/donotcache.acl' cache deny donotcache cache allow all # Add any of your own refresh_pattern entries above these. refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|?) 0 0% 0 refresh_pattern . 0 20% 4320 #Remote proxies # Setup some default acls # ACLs all, manager, localhost, and to_localhost are predefined. acl allsrc src all acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535 acl sslports port 443 563 8080 5223 2197 acl purge method PURGE acl connect method CONNECT # Define protocols used for redirects acl HTTP proto HTTP acl HTTPS proto HTTPS # SslBump Peek and Splice # http://wiki.squid-cache.org/Features/SslPeekAndSplice # http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit # Match against the current step during ssl_bump evaluation [fast] # Never matches and should not be used outside the ssl_bump context. # # At each SslBump step, Squid evaluates ssl_bump directives to find # the next bumping action (e.g., peek or splice). Valid SslBump step # values and the corresponding ssl_bump evaluation moments are: # SslBump1: After getting TCP-level and HTTP CONNECT info. # SslBump2: After getting TLS Client Hello info. # SslBump3: After getting TLS Server Hello info. # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that # they can be used there for custom configuration. acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 acl banned_hosts src '/var/squid/acl/banned_hosts.acl' acl blacklist dstdom_regex -i '/var/squid/acl/blacklist.acl' http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !safeports http_access deny CONNECT !sslports # Always allow localhost connections http_access allow localhost quick_abort_min 0 KB quick_abort_max 0 KB quick_abort_pct 95 request_body_max_size 0 KB delay_pools 1 delay_class 1 2 delay_parameters 1 -1/-1 -1/-1 delay_initial_bucket_level 100 delay_access 1 allow allsrc # Reverse Proxy settings deny_info TCP_RESET allsrc # Package Integration url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf url_rewrite_bypass off url_rewrite_children 100 startup=50 idle=50 concurrency=0 # Custom options before auth host_verify_strict on # These hosts are banned http_access deny banned_hosts # Block access to blacklist domains http_access deny blacklist # List of domains allowed to logging in to Google services request_header_access X-GoogApps-Allowed-Domains deny all request_header_add X-GoogApps-Allowed-Domains consumer_accounts # Set YouTube safesearch restriction acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com request_header_access YouTube-Restrict deny all request_header_add YouTube-Restrict none youtubedst # Custom SSL/MITM options before auth acl wpad urlpath_regex ^/wpad.dat$ acl wpad urlpath_regex ^/proxy.pac$ acl wpad urlpath_regex ^/wpad.da$ deny_info TCP_RESET wpad #deny_info 200:/etc/squid/wpad.dat wpad reply_header_access Content-Type deny wpad http_access deny wpad http_access deny !safeports http_access deny CONNECT !sslports #http_access allow localhost manager #http_access deny manager cachemgr_passwd disable offline_toggle reconfigure shutdown cachemgr_passwd redacted all eui_lookup on acl no_miss url_regex -i gateway.facebook.com/ws/realtime? acl no_miss url_regex -i web-chat-e2ee.facebook.com/ws/chat acl CONNECT method CONNECT acl wuCONNECT dstdomain www.update.microsoft.com acl wuCONNECT dstdomain sls.microsoft.com http_access allow CONNECT wuCONNECT localnet http_access allow CONNECT wuCONNECT localhost http_access allow CONNECT windowsupdate localnet http_access allow CONNECT windowsupdate localhost http_access allow CONNECT HttpAccess localnet http_access allow CONNECT HttpAccess localhost #http_access deny manager http_access deny to_ipv6 http_access deny from_ipv6 acl deny_rep_mime_doh rep_mime_type application/dns-message acl deny_rep_mime_doh rep_mime_type text/dns acl deny_rep_mime_doh rep_mime_type application/dns+json http_access deny deny_rep_mime_doh http_reply_access deny deny_rep_mime_doh acl BrokenButTrustedServers dstdomain '/usr/local/pkg/dstdom.broken' acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch sslproxy_cert_error deny all acl splice_only_ip src 192.168.1.8 acl splice_only_ip src 192.168.1.10 acl splice_only_ip src 192.168.1.11 acl splice_only_ip src 192.168.1.15 acl splice_only_ip src 192.168.1.16 acl splice_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl splice_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl splice_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl splice_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl splice_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl NoSSLIntercept ssl::server_name_regex -i '/usr/local/pkg/reg.url.nobump' acl NoBumpDNS dstdomain -n '/usr/local/pkg/dns.nobump' acl SSL_Intercept_Terminate dstdomain -n '/usr/local/pkg/url.bump' acl active_use annotate_client active=true acl bump_only_ip src 192.168.1.3 acl bump_only_ip src 192.168.1.4 acl bump_only_ip src 192.168.1.5 #acl bump_only_ip src 192.168.1.6 acl bump_only_ip src 192.168.1.9 acl bump_only_ip src 192.168.1.13 acl bump_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl bump_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl bump_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS #acl bump_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl bump_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS acl bump_only_mac arp :RE:DA:CT:ED:MAC:ADDRESS #collapsed_forwarding on #negative_dns_ttl 5 minutes coredump_dir /nvme/LOGS_Optane/Squid_Dump #read_ahead_gap 64 KB #pipeline_prefetch 6 #happy_eyeballs_connect_timeout 10 #memory_pools on acl splice_group any-of https_login NoBumpDNS NoSSLIntercept acl splice_only_local_group all-of splice_only_mac splice_only_ip acl splice_main any-of splice_group splice_only_local_group acl bump_main all-of bump_only_mac bump_only_ip ssl_bump peek step1 ssl_bump terminate SSL_Intercept_Terminate miss_access deny no_miss active_use ssl_bump splice splice_main active_use ssl_bump bump bump_main active_use acl activated note active_use true ssl_bump terminate !activated # Setup allowed ACLs # Allow local network(s) on interface(s) http_access allow localnet # Default block all to be sure http_access deny allsrc

Peek first check the request
terminate everything that goes to DoH list wackamole
miss access is when it caches items so do not store login or chat stuff.
splice the splice devices phones etc stuff I can not ssl intecept on and some always splice websites banks etc, bypass intercept list

bump the bump only lists
mark the active use acl true with note directive
terminate anything that does not follow this just in case, I do not think anything ever gets to this acl.

so it is broken up into a dual use set up

ssl_bump peek step1
ssl_bump terminate SSL_Intercept_Terminate
miss_access deny no_miss active_use
ssl_bump splice splice_main active_use
ssl_bump bump bump_main active_use
acl activated note active_use true
ssl_bump terminate !activated