@zanahoria13 said in Help with simple configuration:

How can I set routing from NAT subnet to the internet without hitting home network with the outgoing and incoming traffic?

You don't want to set a route for that. Instead set a block firewall rule on that interface in pfSense above any pass rules to deny access to the WAN subnet. That way clients will only be able to access either public IPs or other local subnets.

You can also simply omit a pass rule for it.

Steve

@johnpoz Thanks for responding. I was inquiring about MFA and not just 2FA. The admin password is secure and not the default or some variation of P@55w0rd. Switch ports on the Cisco switches are protected and therefore plugging in the laptop won't give necessary access. More than anything, I was just curious about pfSense & it's support for MFA/2FA.

Thanks
-r

You have two sites with two public IPs right? You can only have one VM at each so if you need pfSense to accept traffic on the IP the server is using currently it would easier to just put pfSense there and have it filter and forward requests to the other site where you can host the server.
It's not a great option but it's the only way I could see it working realistically.

Steve

Sadly it's my fault. I hit TEST on the Advanced>Notification screen but I never hit save... definitely works now when mail.php is called from the shell.

I did start using Node RED as my email middleman with curl being called from pfSense... that also worked well. However, generic mail.php is obviously much simpler.

This is the piece I'm trying to automate notifications for: https://forum.netgate.com/topic/118401/openvpn-server-notification-on-connect

Thanks for the input, thread can be closed...

@patelsaheb said in access local server via wan ip:

Is there any way that i can access wan ip from my local network

Why would you need to do that, just access the local IP.. setup a host override to resolve whatever fqdn you want to the local IP vs doing nat reflection.

If you insist on doing such nonsense - then you have to enable and setup nat reflection.

@Rico

yes working fine.
thank you.....

Your best bet is likely to open a ticket at https://go.netgate.com/

@stephenw10
I went ahead and checked the "disable hardware checksum offload" option, then rebooted the firewall. I was still unable to provision the phone after rebooting (phone never pulls the TFTP files) so I went ahead and reverted back to the original setting, then rebooted again. I think I may end up setting up a test FreePBX and PFsense box at my office to try and replicate the issue. At this point the client's phones are functioning; the only issue being I have to manually provision them (which really isnt a big deal since they only have a few phones).

Yeah I would put money on one of your neighbours having connected their router incorrectly and it's handing out 192.168.1.X IPs. Whoever is admin on that network should be looking for them with a big stick but... 😉

Steve

I also think that PGP signature for sums or ISO image are needed.
It will also allow to verify locally the integrity and authenticity of install images, stored in the environment without access to the Internet.
And I think that efforts required to implement this is not so high to discard this idea.
Many users who put security at the forefront, will be grateful.

For some reason the lastpfSbackup file wasn't appearing for some units. Somehow it's working now. I was banging my head and now it's suddenly working.

I did learn a bit about how it works in the process though and documented in my notes. If it comes back I have more information and I'll update this .

I would use a load-balance gateway group on a scheduled firewall rule. Maybe weighted towards the 2nd ISP. Set it to catch only the preferred clients. See how it goes. They will have to open new connections to see the new gateway when the schedule kicks in but it they're mostly web browsing that should be fine.

Steve

@toms88 said in OpenVPN issue connecting to controller:

Ive snooped around and asked on the QNAP forum but its not very lively.

How could i go about NATing as you decribe above? I cant find the interface options for the OpenVPN server :/

https://www.qnap.com/en/how-to/knowledge-base/article/why-cant-i-access-the-administration-page/

Item #2: “Please make sure that the NAS and the PC you are trying to connect from are connected to the same network switch and are on the same subnet. You may also try connecting them directly (crossover cable is not required).”

Ah, well you can do that too. Most people never want to set that as a port forward is applied to traffic from anywhere but you can set the source address in a port forward.
Confusingly that same setting in the 1:1NAT is Destination as it's used for outgoing connections too:

The 1:1 mapping will only be used for connections to or from the specified destination. Hint: this is usually "Any".

Steve

@rsaanon said in IPv6 Track Interface: unable to track muliple local interface:

@stephenw10 @jimp Thank you! I changed the the prefix back to /60 (something I tried in the past but didn't work) and it now automagically works 👏

Perhaps that's all they offer, which is 16 networks. You could try other sizes to see how much they offer. My ISP has /56s.

Checkout the hangout KOM linked above. Specifically from here onwards.

Steve

Yeah you should be able to use either HAProxy or reverse Squid to redirect requests based on the host headers to different internal servers. Or different ports on the same server.

https://docs.netgate.com/pfsense/en/latest/packages/haproxy-package.html

https://youtu.be/FJSHMyrd29E

Steve

@zemlik said in block access pfsense gui OPT1:

blocked on OPT1 any to OPT1 address and WAN address ports 22 80 443

Yes, do that. Though you can use the system alias 'This Firewall' as shown in that link and it will cover all IPs on the firewall itself.

Steve