There's no way to do that in pfSense currently. You could add a feature requests if there isn't onbe already: https://redmine.pfsense.org/

It would be quite a significant new feature though as it would need to be tied into quite a number things.

Steve

Although for that value it probably could be either:

[22.05-RELEASE][admin@cedev-3.stevew.lan]/root: sysctl dev.vmx.0.iflib.override_ntxds="0,4096" dev.vmx.0.iflib.override_ntxds: 0,2048 -> 0,4096

Adding it as a loader variable works past that.

Steve

The PAM error is usually from it just not matching the key. Either because the correct key isn't present, or what's in the file isn't valid.

The keys are on disk on the firewall in the expected location for a user, if you login with a password they would be in ~/.ssh/authorized_keys. If you login as admin or root, then use ~<username>/.ssh/authorized_keys, or look under /home/<username>/.ssh/authorized_keys.

The firewall will manage the content of that file and its permissions so those are not likely to be concerns.

These issues almost always boil down to a problem with the formatting of the key, either line breaks in the key, extraneous whitespace, or the wrong string pasted in (For example we've seen people paste in the fingerprint, not the public key)

There is also a slight chance that ssh-keygen in Cygwin is generating a bad key somehow. Using a more modern format like ssh-keygen -t ed25519 may help instead of using RSA format.

Is it a link-local address? fe80❌x:x?

Those are generated locally and are non-routable. So you would not be able to ping it from a client behind pfSense but pfSense itself may be able to ping it. The ISP can use that to route a prefix delegation across in a setup where they provide only that.

Steve

Either would probably be fine but it has always been called 'DHCP/BOOTP Options' in the v4 server and changing it now may cause confusion.

@dhimanvimal

As said, I do not use squid stuff - as it is way complicated for me, and I don't need proxies or AV scanners.

What about asking / posting in the correct place ? Like here Home pfSense Packages Cache/Proxy

It's a known issue but it's only cosmetic. The duplicate entries don't hurt anything.

Steve

@stewart glad you got it sorted.. I don't really do sudo much on pfsense. But I do it it on other linux boxes and my nas.. I hate having to type my user password all the time on my nas when I want to su up to root.. Its lazy sure - but there are no hostiles on my network, its on an isolated vlan, etc. So I just let that account su up without having to reauth.

Ok, that should work. What sort of bandwidth do you need to pass?

@johnpoz said in Problems with Certificate Generation:

@guardian said in Problems with Certificate Generation:

Is it normal practice to install the intermediate CA along with the server certificate on the server?

Its normal practice to install the full chain.. But if the CA is public trusted then you don't - the server will hand out the intermediate CA to the client, who since he trusts that signing CA of that intermediate will trust it.

OK, so that is clearly what I have been missing. I need to find out how to install the chain in TrueNAS. There appears to be a Certificate Authority Section which is similar to the one in pfSense. Maybe if I just import them there things might work.

@johnpoz said in Problems with Certificate Generation:

There is nothing wrong with the CA manager in pfsense.
@guardian said in Problems with Certificate Generation:

I was expecting to see the entire chain of trust when displaying the certificate.

You did - see the cert info I show for the cert in my browser - shows the full chain.

Yes, I saw that.... it's how that chain got generated that I didn't understand. IIUC the server is assembling the trust bundle on demand from the component parts, not from a prebuilt certificate bundle.

When you say it's 'super slow' what are you actually seeing?

If you ping the server across the tunnel what are the ping times?

Steve

@stephenw10 Thanks Stephen! That fixed it. I put my WAN Upstream Gateway to 192.168.1.1 and WAN subnet to /24. I am able to connect to the internet now. I did have to perform an ipconfig /release and ipconfig /renew towards the ends before it started working for me.

@rcoleman-netgate said in Edited console on video, full console on serial on 22.05:

@vollans What hardware is this on?

It's a little 4-port no-name Intel N5105 special from Aliexpress.

You could setup a ramdisk and mount it at the console for some other purpose.

You can't set /tmp and/or /var to be ramdisks without rebooting.

Steve

Why do you have a static route there at all?

The routing should be dynamic from BGP. Does BGP show both neighbours as up and valid? At both ends?

Steve

@lohphat your more then welcome to implement a package ;) if you feel something like this should run on your firewall..

If there was such driving want for such a thing on pfsense, and it was so easy to implement - curious why it already hasn't been done..

Maybe because its normally not worth it to open up a burger joint next to a wendys and burger king and McDonald.

Like I said this cat has already been skinned long time ago.. I don't see how adding such a feature would bring all the boys to the pfsense yard - but hey if you can make the best milkshake ;)

@stephenw10 correct i dont need any of these and my internet works. i just wanted to learn from you in case something like that happens here in Hawaii.
Thank you again for everything and for the knowledge you taught me in this case.

Thx, that worked.

09ce9608-39b9-4d67-a970-078bb743482f-image.png

@stephenw10 hello, we once again checked the BGP settings on cisco, noticed a couple of parameters related to the announcing the default route, transferred these parameters to pfsense and everything worked, thanks for trying to help me.

@rcoleman-netgate
I just finished the reinstall a few minutes ago but still having the same issues. The HA sync is not working and it's required to restart the php-fpm in the backup node every 20-25 minutes

I found information in the following link
https://redmine.pfsense.org/issues/11583

I'm going to check and let you know how it goes