@ kpa
I do not want to run inetd, but xiinetd and I need it for check_mk.

@Gertjan

@Gertjan:

Hi,

What is your pfSense version ?

My version is:
2.4.2-RELEASE-p1 (amd64)
built on Tue Dec 12 13:45:26 CST 2017
FreeBSD 11.1-RELEASE-p6

@Gertjan:

Btw :

[2.4.2-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: ps ax | grep xinetd 16284  -  Is      0:00.08 /usr/local/sbin/xinetd -syslog daemon -f /var/etc/xi 78340  0  S+      0:00.00 grep xinetd [2.4.2-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: ps ax | grep xinetd 16284  -  Is      0:00.08 /usr/local/sbin/xinetd -syslog daemon -f /var/etc/xinetd.conf -pidfile /var/run/xinetd.pid 78733  0  S+      0:00.00 grep xinetd [2.4.2-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: cat /var/etc/xinetd.conf service 6969-udp {         type = unlisted         bind = 127.0.0.1         port = 6969         socket_type = dgram         protocol = udp         wait = yes         user = root         server = /usr/libexec/tftp-proxy         server_args = -v }

This xinetd service is only listening to localhost, not LAN.

Note : as far as I know, I never installed a package that includes "xinetd" - actually, I don't know what it is - what it does.
I know it is there by default.

From the output of your ps-command I can see, that your config is in /var/etc. I too have a file there, but it is empty and has size 0.

I agree with you, that xinetd seems to be installed by default, but on my box it is not running. :-((

Can you please tell me how xinetd can be started, which config files are needed and where these need to be?

TIA, Karl

As an update I've tested removing the 192 address from the reject list and I've also switched to the "FreeBSD" preset for DHCP options, so far this appears to have resolved my original issue of not switching the wan IP from a 192 to public IP on a cold boot of both, i'll have to wait and see if a power blip occurs again to test the true results.

thanks

No traffic shaping set yet.

A few weeks back I did try using CODEL for the second time but ran into problems after trying to disable it for testing. Caused the router and pfsense to become unresponsive. I had to reboot the router to get things up and running again. The first time I tried CODEL and then disabled it, it caused a lockup so bad that my pfsense router would not fully reboot and keyboard would not even work. The only solution was to reinstall pfsense and set everything back up again as I didn't save a recovery backup beforehand.

If anyone is interested (Or Searches for this in the future….)

Yes, it works. However, a few things I noted.

1. I couldn't get the PPPoE Server on pfSense to work as a VLAN interface. Instead, I had to set my management LAN to be a VLAN interface, and set the PPPoE Server as the untagged interface.

2. When you plug the router into the Mesh point, the Mesh point first sees if it can use the LAN to connect back to the controller, so will actually drop off the network temporarily. (So don't expect your router to make the PPPoE connection instantly)

3. When testing... use the aerials on the mesh points! I had them running without the aerials to begin with, and throughput was next to non existent!

So my setup is as follows -

System Lan - VLAN on Interface 1 (CloudKey lives here)
Mesh Lan - Untagged on Interface 1 (TCP Port 8080 - Inform & UDP Port 3478 - STUN open to CloudKey IP - No other rules. I.E. No internet access)

PPPoE set to run on the Mesh Lan.

With the later firmware(s) running on the CloudKey, you can cache firmware updates to the CloudKey, so the Mesh points don't need to see the internet directly.

Ad

I don't know. I assumed maybe PfBlocker put it in the BlockList Alias that I have, but I really don't know how fast I was hit or really when exactly it happened or really how it was put in the BlockList. That's kind of the idea behind having a notification. I never knew how or when it happened.

No I didn't mess with the cron job regarding sshlockouts, and never have. I've added cron jobs, like checking SMART and initiating a scrub, but that's it.

According to the IP description listed in the BlackList Alias they were added on 11-16. That's all I know, because I had no other notification.

On a side note!!! A resolution has been submitted by loonylion and has been submitted to an OP for submission to give a notification on the notification pop up and email (if applicable) upon a failed login.

As a side note, this will NOT create any additional noise if there isn't a problem and if no one is trying to log into your firewall.

So, No Noise (no login failures) = No notification
Failed Login = Notification of event

Solved: https://forum.pfsense.org/index.php?topic=144593.0

That's the frustrating part. Nothing, as the connection "freezes" briefly but doesn't close the session. I'm running pfSense (and Neorouter) in VMs. Hardware is kind of old by 2018 standards so I wonder if that has anything to do with it. I have a spare Hyper-V host with SSD storage that I should migrate the VMs to just to see if it makes a difference. I've considered OpenVPN too, which I might roll out for kicks, but I have like 40 hosts set up in NR and it worked so well up until October or so. I've been procrastinating doing anything about it as it's more of an irritant rather than a total loss of functionality. Maybe I should deploy a hardware pfsense install in the lab and see what happens. It's always nice to hope for a "change this value to X" and have a magical fix.

I had a similar success rate with NR for quite a while and would do the same kind of thing as you describe!

really hacky:
https://forum.pfsense.org/index.php?topic=65092.msg354840#msg354840

You should be able to change the tcpdump arguments for it to look for the frames you're interested in.

Same issue here. VM with 2.4.2-release-p1. No indication of shortage of RAM or HD space…

Or even a different IP on the same subnet ;)

Security reasons. Any script run like that should never have anything more than the trusted directories in its $PATH and those are by convention /sbin:/bin:/usr/sbin:/usr/bin. This means that when writing scripts the scripts should use full paths to executables located outside the trusted $PATH.

DDOS protection requires a certain level of expertise and specialization. You're going to need more info on the topic that what a general internet forum can provide. Unless you're working at my State Uni, which has over 1Tb/s of backbone connection, there's not much you can do.

My ISP has handled DDOS attacks by purchasing more bandwidth temporarily. I am not sure how large the attacks are, but even low end DDOS attacks are quire large these days.

OK - finally gave up on trying to solve this. Instead took an Alexandrian stroke and solved it like this:
We moved away from using unbound on pfsense and instead configured a VM running bind9 in the internal network.
Configured google's DNS:es as forwarders but added "edns no" statements for them:

server 8.8.8.8 {     edns no; };       server 8.8.4.4 {     edns no; };      

Why this works I don't know other than bind doesn't use EDNS at all. EDNS Buffer Size was set to 512 in unbound but this clearly didn't solve the problem.
DNSSEC is enabled in both configurations and we get AAAA responses from bind as well. For some reason the name resolution is now quicker in general.

@adoucette:

@Derelict:

reject TCP/UDP from any to any port 53

Unfortunately, that rule just stopped the other web browsers from working at all. (I put it after the DNS redirect rule)

OK then add a pass rule between those two rules that passes TCP/UDP from any to LAN address port 53.

Damn Invert match rules suck. Just say no.

Def not a browser issue….

So far to test, I tried using the SG1000 and worked with no issues w/ the same settings I have on my VM box (even isntalled a fresh copy)

Have a feeling its something between the VM ESXi and pfSense.

Once I restart the pfSense, everything works at first but once I am on the page surfing thru, it will get slower and slowe eventually timing out.... BUT if I go to another different website it will works but again same thing once I start either downloading or surfing through the pages after a few minutes it will slow down....

Try pinging that address and see if there's a response.  If so, check you ARP cache for the MAC address.  That address can then help to find the hardware.

Hey,

yes thats weird.

The Setup uses pfsense running bare metal on two Dell R330 (Intel Xeon CPU E3-1240 with intel server NICs) with a carp setup. Each R330 with 4 Interfaces trunked as LACP (2xWAN, 2x LAN) to the switching hardware. Here we use different juniper switches like ex2200.

In our testing we just had the server on the same switch as the pfsense but different VLAN as the client, Client is connected to another switch. Yes there is wifi but not involved in this issue, wifi is another vlan.

Already tried to disable all the offloading features.

Capture.PNG
Capture.PNG_thumb

Because a hop doesn't answer in a trace?  You assume they are broken?

Sorry but no… There are many a router on the net that does not answer a trace.. You could try using something other than windows, linux defaults to UDP vs icmp, and or you could use TCP in the trace, etc.  Sometimes that helps resolve a hop..