@Pootle:

@cmb:

We have a fresh wiki install staged with all the good content brought over and some new content. This time we have it extremely locked down because we're tired of dealing with the spam. I don't think we're even going to allow people to sign up for accounts. We will be ditching the existing doc wiki within a week or two.

That's good news, I hope I'll still be able to contribute…  :D

Absolutely, even if I need to manually create accounts for those who want write access.

I think I'm getting this too. I get HUGE packet loss on the line behind their modem. Currently its setup so that pfSense is the DMZ system, so it NAT's all packets to the pfSense system. The performance is horrible.

It seems to run fine for awhile then eventually (6 hours) will start to drop packets. Also the states are very high so it must not be expiring connections ??

I'll try going into PPPoE mode.. if I can find it on that stupid Verizon Modem..

Forgot about this topic. I tested pfSense developer version (I think 1.0.1) and I couldn't get it to detect my printer or load the ulpt driver. However my printer worked fine the the version of FreeBSD I tested (6.1 and I think I also tested an older version). So I presume that the ulpt driver has been partially disabled in the standard pfSense kernel (which makes sense since it's unneeded). Therefore re-enabling support is probably going to require a kernel recompile and won't be easy.

Thanks to all for the help.  It has given me good direction.

Failover is only supported on outgoing LB.  We have updated the GUI to reflect this today.

Have you remembered to create a Virtual IP (Firewall -> Virtual IPs) ? It should be of type IP/other (if the target public IP is behind your firewall; i.e. routed through it) or Proxy ARP (if the target public IP is in the same subnet as your firewall external IP).

/Eirik

VIA 8235/8237 (Apollo KM400/KM400A) host to PCI bridge

you could try: http://www.monitorix.org/

@jahonix:

search the forum for 'FTP-Helper'

Chris

You my friend are a champ! Disable the ftp helper and away it goes ;D
Thanks mate. ;)

thats the resun that a isp gives you 2 dns servers
fails the first then the 2end will be asked

Thanks Chris.

Yep, I've seen that menu many times while attempting wan/lan/nic combinations.

Woke up after a few hours, tried it again, it works. I have no idea what the problem was but I know I was impatient last night, plugging and unplugging interfaces during the boot to get around the watchdog who seemed annoyed at only one live interface. (my LAN consisted of a laptop with a low battery, and it kept sleeping)

From what I can see so far, this is a VERY nice solution! Kudos to everyone involved.

@cmb:

Yeah, disabling autofill stops that from happening, I keep it disabled for that reason. I think you can just disable the field color change to yellow, and still leave autofill enabled if you want to use it.

Yup, there is an option to just disable the field colour change.  However as I don't use the Autofill feature, I've just disabled it, putting the colours back the way they should be.

thanks…
I knew I'd seen it before, but I couldn't find the thread.

For anyone who picks up this tread in the future, use root to login to winscp not admin.

I posted (and eventually deleted) a similar problem yesterday.  It looks like it takes OpenNTP quite some time to become a valid source of time.  It also rather strangely reports itself as 2 strata higher than it's time source, rather than the normal one.  This means you need to pay careful attention to the stratum of the time source you're using, otherwise you may still not have a valid time source :(

Yes, just replace the file from a vanilla installation.

It looks like hard disk corruption at first glance.  Voodoo.

@craigdrown:

Hi Aldo,
just local auth for now. Will get freeradius going once we get this sorted.
The auth is no problem. Client gets an ip in the specified range the the server ip address as the gateway, but the clients are getting a blank entry for a subnet (even though a submet is entered in pfsense)- this seems a problem, otherwise won't all ips be treated as local and not go via the gateway?
Thanks for your help
Cheers,
Craig

i dont really understand your question.

netmask should be 255.255.255.255 on pppoe clients with gateway of pppoe server ip.

No idea, but I'm missing exactly the same thing.

Did you have any luck with it yet?

You can disable the console menu on the advanced page. You can't require a login at this time.

Anyone that has physical access to your firewall can bypass even disabling the console menu (by removing hardware if nothing else), physical access is game over. Your firewall has to be in a secure physical environment to be secure.

Any HIDS on a firewall isn't going to be as useful as HIDS on actual accessible systems (like servers). Network IDS/IPS is much more important and relevant on a firewall. We may add some sort of HIDS package in the (maybe distant) future though.