• Terrapin SSH Attack

    Pinned
    33
    16 Votes
    33 Posts
    32k Views
    STLJonnyS
    @willowen100 It basically forces your ssh (on the Windows side) to utilize that encryption algorithm. You'll need to do that on any machine you ssh from. I'd have rather found a more elegant workaround (preferably on the pfSense side, so the mod only has to be done in one location), but this works in a pinch.
  • pfSense Hangouts are available on YouTube!

    Pinned Locked
    1
    5 Votes
    1 Posts
    11k Views
    No one has replied
  • Share your pfSense stories!

    Pinned Moved
    76
    0 Votes
    76 Posts
    65k Views
    V
    Mine may be typical, maybe not..... Took over a large sennior living facility with a pretty robust it infrastructure spread between 4 IT rooms, 23 access points, 12-14 switches, and 200 internal devices and 200 guest/resident devices, all being run by a Sonicwall TZ350. I had been wanting to reallign everything network wise for some time but the TZ had 2 ports that were failing. I had worked with ClearOS from back in the ClarkConnect days and started searching for something similar. I found PfSense and it just fit what I wanted to do. I tested it a bit on an old Athalon64x2 rig for proof of concept and had planned on installing on a mini pc or something, but I wanted 6 nics. Standing in my main IT room I looked down and in the bottom of the rack were 4 HP DL380s, 2 of which were decommissioned 2 years ago. It's such huge overkill for hardware that it's hard to explain, but who wouldn't want redundant power supplies, raid 60 with 25 drives and remote system monitoring through ILO? lol I spun one up and loaded PfSense and started tweaking. 2 weeks ago I switched over and have been working out gremlins since.. Overall it's gone well, just one snag that a couple members here have been very kind in helping me work out. Thank you to this page for all the help. [image: 1697753147328-pfsense1.png]
  • Troubleshooting WAN outage

    1
    0 Votes
    1 Posts
    94 Views
    No one has replied
  • if_pppoe ping works but dns doesn't?

    1
    0 Votes
    1 Posts
    23 Views
    No one has replied
  • ARPWatch typo in subject of email notifications

    8
    0 Votes
    8 Posts
    707 Views
    stephenw10S
    It's a one line patch so should be safe enough to add manually if anyone wants to try it: diff --git a/net-mgmt/pfSense-pkg-arpwatch/files/usr/local/pkg/arpwatch.inc b/net-mgmt/pfSense-pkg-arpwatch/files/usr/local/pkg/arpwatch.inc index 247cc3c4e1f4baf6325c22ab778d64c3bdf8afc2..e4c2f2b9e72d96a573c7ebb3ce52c01c278265ab 100644 --- a/net-mgmt/pfSense-pkg-arpwatch/files/usr/local/pkg/arpwatch.inc +++ b/net-mgmt/pfSense-pkg-arpwatch/files/usr/local/pkg/arpwatch.inc @@ -239,7 +239,7 @@ if ((false !== $message) && ((false === strpos($message, ': Cron ')) || $message = preg_replace('/^To: .*$/m', '', $message); $message = preg_replace('/^Subject: .*$/m', '', $message); $message = preg_replace("/^(\n){4}/", '', $message); - $send_subject = config_get_path('system/hostname') . config_get_path('system/domain') . " - Arpwatch Notification : {$subject[1]}"; + $send_subject = config_get_path('system/hostname') . "." . config_get_path('system/domain') . " - Arpwatch Notification : {$subject[1]}"; send_smtp_message($message, $send_subject); if (function_exists('notify_via_telegram')) { https://redmine.pfsense.org/issues/16410
  • SSH inaccessibleupdate to version 25.07

    Moved
    7
    0 Votes
    7 Posts
    379 Views
    stephenw10S
    Mmm, no known issue with SSH I'm aware of. I assume you can still login to the webgui with the same credentials?
  • Kernel panic related to BGP and IPv6 after upgrading to 2.8.0

    2
    0 Votes
    2 Posts
    475 Views
    JonathanLeeJ
    @EdoFede do you have the crash dump file ?
  • Switched to AT&T fiber, IPv6 tunnel broken

    39
    0 Votes
    39 Posts
    1k Views
    JonathanLeeJ
    @BiloxiGeek do you have a static ipv4? I pay extra for a static address it helps because my tunnel ipv4 address stays the same and my vpn also.
  • 0 Votes
    4 Posts
    467 Views
    M
    Reporting back, it doesn't work. It gets connected, pings go through, but upon more serious data transfer I get socket errors and after a while I get LCP errors and a disconnection. Frustrating, especially that it worked pretty OK with 2.7.2. Off to buy a 4G modem with ethernet adapter :)
  • 25.07 unbound - pfblocker - python - syslog

    56
    0 Votes
    56 Posts
    4k Views
    kmpK
    @stephenw10 I did not know about that. Thanks - implemented and it's working!
  • Port Forwarding stopped working after upgrading to 2.8.0

    126
    0 Votes
    126 Posts
    8k Views
    stephenw10S
    Ok so all clients are using pfSense for DNS. Both VPN and non-VPN clients. So that means to avoid a 'DNS leak' reported on vpn clients that Unbound must send all queries over the VPN. Either by resolving using the VPN interfaces only or by forwarding to the PIA DNS servers only. That does mean that if the VPN is down no clients will be able to resolve. Both vpn and non-vpn clients. I'm not sure why you have added the DNS servers to the VPN client config. Those should be passed to you by the server. But Unbound won't use them there either way. It can only forward to servers configured in general setup. A better setup here would be to put vpn clients on a separate interface. That way you can easily pass them different DNS servers to use etc.
  • Wireguard fails after reboot (2.8.0)

    28
    0 Votes
    28 Posts
    2k Views
    B
    @stephenw10 [image: 1756994395455-easeus_2025_09_-4_14_59_20.png]
  • High CPU usage from egrep in pfSense+ v25.07.1

    14
    0 Votes
    14 Posts
    675 Views
    stephenw10S
    Yup, I'm running on a 3100 too which is probably many times slower than your CPU. Either way it looks like it's probably the multiple process spawning causing the issue. Let's see if they start to multiply again over time.
  • 24.11 - KEA DHCP/DNS Logging customization?

    14
    0 Votes
    14 Posts
    3k Views
    AmarandA
    @keyser Fantastic, thank you! Yeah, I ended up getting to the JSON settings before I saw your reply, and I had DEBUG instead of just INFO and the logs were going crazy! I think, with as active as my network is, and as chatty as the DHCP devices are, I'm going to ignore the web GUI, and just tail the logs over SSH. That way I can grep and sed to my heart's content. I also set-up log rotation using the built-in method, so that's good. Every once in a while I have these bursts of pfSense learning.
  • IPv6 Link Local in Interface Status

    2
    0 Votes
    2 Posts
    112 Views
    tinfoilmattT
    @azalea You can read more about the specific notation you're asking about, the zone index, in this Wikipedia subsection of the "IPv6 address" article.
  • Update Clarity

    13
    0 Votes
    13 Posts
    710 Views
    stephenw10S
    You can choose to boot the old kernel at the bootloader menu. But that's only the kernel, it will still fail to boot if the rest of the system is broken. In ZFS you can create a snapshot boot environment before upgrading you can roll back to. Plus does that automatically.
  • 0 Votes
    3 Posts
    487 Views
    stephenw10S
    Yup, that's fixed in current versions.
  • 25.7.1 package issue

    3
    0 Votes
    3 Posts
    572 Views
    provelsP
    Browser cache need clearing?
  • CGNAT and IP Passthrough

    12
    0 Votes
    12 Posts
    692 Views
    M
    @tman222 I've got T-Mobile Home Internet (THMI) set up as my backup to Starlink in a pfSense failover gateway group. It is kept alive by a ping to 8.8.8.8 and my gateway always has the ipv4 address of 192.168.12.1. The pfSense interface gets .12 address, right now, .12.145. For science, I turned on ipv6 dhcp to get the one and only ipv6 address from the TMHI gateway and it did get an ipv6 address it couldn't really do much with, kept alive by pinging the ipv6 of 8.8.8.8. Until it didn't work. One day the ipv6 address and interface was just dead and the ipv6 address wouldn't come back with some usual efforts. Since it was just an experiment, I shut the ipv6 off. Since TMHI won't give a prefix, it's really not much use that I can tell to have the router interface have an ipv6 address with nothing else downstream. So it just uses ipv4. Note, I have shut off all the wifi on the box and just use it through the ethernet port. I used a great IOS app called HINT Control to shut off the wifi on the TMHI gateway. I have my own wifi, so I don't need it polluting the em spectrum with more. Since we live in the sticks, both our Starlink and TMHI use CGNAT of a sort but I don't have any problems with double-NAT with either. It just works.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.