@markdudov so you want to generate a key for the ntp server on pfsense so your clients can auth?

Not sure pfsense has support for that option, pretty sure the ntp auth they have available is for pfsense to auth to some ntp server as a client.

"Authentication allows the NTP client to confirm it is communicating with the intended server, which protects against man-in-the-middle attacks."

And I don't believe they allow for talking to more than 1 ntp server with different keys either.. Maybe in 24.03 or I know there is some patch or working on a patch for ntp auth.

Personally I don't understand the use case for auth for local ntp.. You concerned that there will be some rogue ntp server on your network and you need to make sure your talking to the correct one via auth? Or that only your own clients on your own network are validated via auth to your server?

Seems like extra work/config/setup for like zero benefit other than a complexity that could cause issues.. In what scenario on your own local secure network does this added complexity provide added anything? Is someone going to get on your own local network and fire up some ntp server to do mitm on your ntp traffic? For what purpose exactly? And how would they go about such a thing without having physical access or already compromised your wifi?

@skogs windows added ssh many years ago.. But they always seem to be behind last I looked.

I always just install this openssh version

https://www.mls-software.com/opensshd.html

@anotherguy82 Tons of people run pfsense virtualized on Proxmox and I think the most common setup is to have dedicated NIC's for both WAN and LAN. And the preferred setup is to do passthru (IOMMU) of those NICs so that pfsense is the only machine accessing them (giving optimal performance).

So you assign two out of your four NIC's to pfsense and the others will be available to Proxmox and your VM's. Nothing other than pfsense WAN is exposed to the internet.

You have to make sure virtualization is enabled in the Optiplex BIOS to make this work though.

On the topic of VLAN's, yes your TP-Link Layer 2 switch will support that perfectly fine.

But also if you have set the webgui to run on a different port, say 43434, it will redirect to that.

http://pfsenseip => https://pfsenseip:43434

True. I guess I should specify, when using the default values or DHCP. 😉

My test setup has more hosts than that and is served by a 3100. I never see any DNS issues.

Both those things should be a feature request in redmine if there is not something existing: https://redmine.pfsense.org/

I'm down to the one problem that IPV6 doesn't work. I can see the DHCP6 request sent over the WAN interface and the /60 PA returned. However, these neer get assigned to interfaces. Also, the router sends a seperate DHCP6 requst for the WAN interface (because the instructions do not selecet "Request only an IPv6 prefix"). ATT assigns an IP address that is completly different than the PA assigned and regardless it is not assigned to the WAN interface.
We should be taking the first prefix ID (for example prefix ID 0) and using it for the WAN interface IPV6 address.

Any further ideas. I suspect there is more configuration required for IPV6 that is not in the guide. IPV4 and everything else seems to work.

Have WAN DHCP6 PCAP.

I don't recall the exact command but it was something like

usbconfig -i ugen0.2 detach_kernel_driver

Yes, it needs improvement. There is currently no way to configure what triggers a notice though.

There are open feature requests you can add a comment to. https://redmine.pfsense.org/

Steve

Opened bug report: https://redmine.pfsense.org/issues/15547

Appears to be mostly cosmetic though.

Ok so like it says there:

To allow logins with RADIUS credentials, equivalent local users with the expected privileges must be created first.

So the local user must exist.

From that many versions back I would just reinstall to 2.7.2 and restore the config.

But what IP does it get? A private IP from the modem?

You can set the dhcp client to reject leases from the modem server IP to prevent that. Cable modems will comonly hand out their own leases until the line syncs.

Steve

I expect it to be in the Hyper-V setup. Though the NIC itself would probably need to be in promiscuous mode to pass tagged and untagged traffic. The Guest VM shouldn't see the VLAN tagging at all. Though you could probably set that up in a few different ways.

I don't run Hyper-V so I can't help you with it directly.

You can see that data in /var/db/support.json. That should get updated every 24hrs.

@Ratfink Connecting two sites with Wireguard VPN is absolutely doable, and you don't even need fixed IP's for it to work.

When you say you have 5 fixed IP's from your ISP, I'm kind of assuming you have your office at your house? Meaning they are both connected to the same fibre? Otherwise, if they are at very different locations, is it still the same ISP?
In terms of getting the IP's on the respective pfsense machines, I assume you know how or have instructions from the ISP to do this. Might be MAC based if DHCP for example...

Anyway, running pfsense on repurposed HW is very common and can be done "barebone" or virtualized. So you shouldn't have any problems getting to to work on your rack servers, hopefully.

So step one is of course getting both machines up and running. And since they will be for different sites and connected via VPN you must make sure to use different LAN subnets on them. Like 192.168.1.0/24 on one and 192.168.2.0/24 on the other.

Once you have them up and running you can follow a guide like one of these to set up wireguard.
Even though you have fixed IP's it might be a good idea to get two domains, unless you already have that.

https://www.youtube.com/watch?v=2oe7rTMFmqc
Youtube Video

Nice. 👍