@djtech2k yeah I was going to say - a reject on local would make sense as default..

If device on your network wants to go to somethingblocked, might as well reject it - or he just going to retrans multiple times wanting an answer back from where he wanted to go.

If you tell him right away - hey you not going there, then it shouldn't spend any time doing retrans.

@viragomann said in CARP VIPs or Other:

@mcury
No, you need an interface IP and a CARP VIP in each VLAN.

So the VLANs are defined on the lagg and you have to assign an interface and an IP to each on the primary and secondary.
Then define the CARP VIP on each VLAN.

Thanks for clarifying things for me viragomann 👍

@stephenw10
This is not pfsense specific, just a general NLB query.

NLB > Unix vm's

@stephenw10 said in Multiple issues, firewall freezes and whole network goes down.:

Are you able to check the physical local console?

Not right now. Only when I get back.

If it stop responding at the console it's not that surprising to me that it also stops passing traffic. It's more surprising that it appears to keep running and logging.

I honestly cannot tell. Maybe if I can physically connect, it will respond but due to IPMI video console, it somehow has a gimmick where it cannot register the user inputs through IPMI console web interface.

Mmm, that does look like it in that case if the last config change was removing a P1. That doesn't seem to be the case for OP here though.

Yup it's in the recommended patches list in the new patches package update.

@LaUs3r

Strange.

I've created a "a;conf" with :

( No !, and I've added the ~ )
and restated the syslog daemon.
No more

a120a7e2-fd52-4575-a76d-9a05447f4ce2-image.png

for me.

If you send me your NDI in chat I can check it.

Indeed! Even in that situation the gateway should not actually be on the LAN interface, just in the LAN subnet.

Just add the following line to your DNS Resolver Custom options:

local-zone: "duckduckgo.com" redirect

7122c48a-ec9a-4c84-891f-223556326f35-image.png

@Gertjan said in Can't login to GUI:

The Johnpoz story

He posted his 'story' just a couple of minutes ago : https://forum.netgate.com/topic/195900/ssl-certifications-not-trusted-on-my-system/41?_=1736352508256

Mmm, nothing terribly exciting there.

@coffeecup25 switching the monitor off and on may help.

Or connecting a keyboard to pfSense and then press a key (not the reboot or shutdown key ;)).

@Gblenn said in pfSense behind ISP modem (Double NAT) trouble:

I kind of looks ok, although it's confusing to see that VID is listed as untagged for ports 1 - 10, which includes port 2. Perhaps it's a limitation of the UI, and I would have expected it to read 1, 3-10. Sicne you don't want any VID 1 traffic ending up on port 2... Are you sure you are actually seeing the devices picking up DHCP from pfsense or is it from the modem?

I set port 2 to PVID 10 so the traffic from this port always falls into VLAN 10, I will try to disable this port for ID 1 however.

Also I will do a pcap and report my results later.

We hope to have something sooner than that. But, as always, it depends how the development/testing goes.

When I did it I used a USB2 drive in the USB2 slot because when both drives are present it tries to boot from the USB3 slot first. You should be able to move it afterwards.

It should at least recognise both drives in the boot messages if it is booting.

Yes you should be able to access it be just assigning the VLAN parent interface and setting it in the same subnet as the modem admin page. As long as that doesn't conflict with any existing subnet on the firewall.

@stephenw10 said in Awfully slow transfer speeds from remote NAS over ZeroTier:

Yup good to know that about zerotier, I wouldn't have thought it was required.

According to the documentation, it is not required for holepunching, but they do refer to challenges with symmetric NAT.
https://docs.zerotier.com/corporate-firewalls/#:~:text=Default%20zerotier%2Done%20listening%20ports,ZeroTier%20hole%20punching%20to%20work))

@rheuer22 Perhaps try to set Static Port (Hybrid outbound rules), to see if that has a similar effect?

@patient0 said in /mnt folder question:

@Gertjan a bit further up stephenw10 wrote:

I'm pretty sure the efi partition is mounted there to test at upgrade for example.

... that's why.

That's why I replied ... it wouldn't mount in /mnt but somewhere in /mnt/somewhere/
That is, that is what I hope.
Because, if not .... dono, that feels pretty dirty to me.
What if I have a USB drive mounted (also) with my config.xml ?
Anyway, just thinking out loud here.