@stephenw10 Oh I see. Yep PCAP was on the VM (172.16.0.202). Yep I don't get it. I see what you're saying and all just can't wrap my head around what is going on here.

Those are the changes you made? Can't you just set a static IP to regain access and revert that? Steve

@stephenw10 that worked, thank you so much!

Never used VSCode but it's just xml. What changes do you need to make though? Usually a config move between hardware should only require re-assigning the interfaces (renaming them in the config). I assume this is a more extensive network change? Steve

Hmm, maybe it's failing to rotate the logs at all then. sshguard is enabled for webgui logins whether or not SSH is enabled. Steve

It doesn't look like the error checking includes a 30 character limit there. But even if it did entering a value in the config directly bypasses that. You can open a feature request to include a custom options field: https://redmine.pfsense.org/ Steve

Yes, that would change it from 01.01 to 12.01.

Also see: https://docs.netgate.com/pfsense/en/latest/firewall/additional-ip-addresses.html Steve

@stephenw10 Steve, thanks for the input. I guess I'll have to wait for things to go south and your suggestions.

Both are forms of NAT, translating IP addresses/ports. pfSense just uses the term port forwarding for inbound. Steve

@johnpoz said in Unknown servers on VLAN: @lewis yeah arp scanning is very fast, and most anything is going to answer an arp, even if firewall blocking all protocols and ping, etc. Only problem with that sort of scan is you have to be on the same L2.. But for what your looking for its prob more in line with what your looking to do.. Yes, basically just wanting to make sure I have my own relatively secure LAN (VLAN) network. I'll do it again once everything is up.

@stephenw10 Ahh, I see, good to know, thanks!

@zzkazu said in Helium Miner - Port Forwarding Issue: outlined by "Lawrence Systems" on you tube He says to block the whole planet - normally they put out pretty good info.. I would be disappointed if they said to setup what you had to be honest..

Now it seems back online. thank you Max

@maliaga See if this thread helps.

There is no way to submit them automatically anymore. They could potentially contain sensitive information, so it's best not to post them without reviewing the content. The textdump.tar files are the ones with the useful information. You can expand them with 7-zip or similar though you may have to rename them first (for example, rename textdump.tar.0 to textdump0.tar), and the most important files inside each are ddb.txt and msgbuf.txt. ddb.txt contains the panic backtrace which may point toward a specific cause, while msgbuf.txt contains the kernel message buffer which may have additional clues if the backtrace alone isn't sufficient. You can post the tar files here on the forum, or just the txt files, but review the content first to make sure you aren't posting anything identifiable that you aren't comfortable sharing with the world. For example in your screenshot it has your hostname.

Sorry, I typo'd that. I meant that not a load balancing group! Each WAN in a different tier like that creates a failover group. Steve

@stephenw10 Thank you for your insight. In our case that was the only modification to the configuration after noticing the issue and it resolved it. Hopefuly others will able to try should the encounter the issue.

@stephenw10 Great tip, thanks!! It was set there to 150000000. Deleted, saved, now got the expected 500 in pfSense.conf. cat /var/etc/newsyslog.conf.d/pfSense.conf | egrep filter /var/log/filter.log root:wheel 600 7 500 * C

That's already the case. If you try you see: The following input errors were detected: This LAGG interface cannot be deleted because it is still being used. Steve