• Terrapin SSH Attack

    Pinned
    33
    16 Votes
    33 Posts
    29k Views
    STLJonnyS
    @willowen100 It basically forces your ssh (on the Windows side) to utilize that encryption algorithm. You'll need to do that on any machine you ssh from. I'd have rather found a more elegant workaround (preferably on the pfSense side, so the mod only has to be done in one location), but this works in a pinch.
  • pfSense Hangouts are available on YouTube!

    Pinned Locked
    1
    5 Votes
    1 Posts
    11k Views
    No one has replied
  • Share your pfSense stories!

    Pinned Moved
    76
    0 Votes
    76 Posts
    63k Views
    V
    Mine may be typical, maybe not..... Took over a large sennior living facility with a pretty robust it infrastructure spread between 4 IT rooms, 23 access points, 12-14 switches, and 200 internal devices and 200 guest/resident devices, all being run by a Sonicwall TZ350. I had been wanting to reallign everything network wise for some time but the TZ had 2 ports that were failing. I had worked with ClearOS from back in the ClarkConnect days and started searching for something similar. I found PfSense and it just fit what I wanted to do. I tested it a bit on an old Athalon64x2 rig for proof of concept and had planned on installing on a mini pc or something, but I wanted 6 nics. Standing in my main IT room I looked down and in the bottom of the rack were 4 HP DL380s, 2 of which were decommissioned 2 years ago. It's such huge overkill for hardware that it's hard to explain, but who wouldn't want redundant power supplies, raid 60 with 25 drives and remote system monitoring through ILO? lol I spun one up and loaded PfSense and started tweaking. 2 weeks ago I switched over and have been working out gremlins since.. Overall it's gone well, just one snag that a couple members here have been very kind in helping me work out. Thank you to this page for all the help. [image: 1697753147328-pfsense1.png]
  • OpenVPN bad encapsulated packet length question

    11
    0 Votes
    11 Posts
    172 Views
    C
    @amrogers3 said in OpenVPN bad encapsulated packet length question: max-mss headers This reply seems to be the first post you made clear you also control the server. I dont recall saying to put 'max-mss headers' as a line in the config. 'mssfix 1400 mtu' does not change the mtu, the mtu part just affects how it calculates what size mss to use. Since you have access to the server it is easy for you to verify the MTU configured on both ends of the tunnel. This is basic nix commands to check MTU size, ifconfig on BSD and ip on linux.
  • Listen queue overflow

    4
    0 Votes
    4 Posts
    87 Views
    C
    @ipguy Some services dont max out to the OS limit and have their own internal limit, but if it is the case then I dont know how you would raise it, I think a VPN hitting the listen queue limit is highly unlikely unless you running a public VPN server that has gone viral or something. So it seems odd to me you have this problem in the first place. 'netstat -L' shows listen queues, looks like OpenVPN has a limit of 1. My OpenVPN processes are running in client mode though. There is nothing in the manpage to tune it, and I found a very old dev post from people asking for the limit to be raised, it very likely is compiled in to the binary.
  • PHP Fatal error after adding port forward

    5
    0 Votes
    5 Posts
    119 Views
    A
    I removed the NAT rule and the router restarted cleanly. All working ok now. I will be upgrading to a Netgate 4200 in the next weeks.
  • If you move pfSense ssd to another pc, will it work in new pc?

    3
    0 Votes
    3 Posts
    82 Views
    C
    @provels Thanks. I suspected this, but still wanted to hear it from someone else. This would be for an emergency situation.
  • Strange DNS Issue

    8
    0 Votes
    8 Posts
    144 Views
    J
    @johnpoz said in Strange DNS Issue: Could be a peering problem your isp currently having.. But yeah if you are resolving and can not talk to the owning NS for a domain, your not going to be able to resolve anything from them. I came to the same conclusion as it's now miraculously working! I knew I dotted all my i's and crossed my t's and coming up with nothing on my end lead to me to believe it was something upstream. Thanks to everyone that chimed in!
  • Port Forwarding stopped working after upgrading to 2.8.0

    73
    0 Votes
    73 Posts
    2k Views
    C
    i think cuz my internet so slow and if it gets bogged down where pages dont load etc that it triggers something in pfsense like a flag and doesnt let internet to work properly again as my internet is only 3mbps and 500k upload and thats if i lucky just bad internet now a days for rural areas.. but i am getting fiber sometime this year they doing projects.... so i figure my slow internet triggers something in pfsense to disable things and restore fixes it now im probably wrong.. but that is what i thinking is going on. from what i experiencing
  • pfSense Plus 25.03 release question

    26
    1 Votes
    26 Posts
    2k Views
    C
    okay, i`m still waiting for the release of july... ;-)
  • OpenSSL Library Error when Creating New Certificate

    20
    0 Votes
    20 Posts
    2k Views
    T
    I ran into this same problem and ended up in this thread. Having since solved the problem, I wanted to return to report my findings. I had to dig into the PHP source code for the PFSense Web Configurator as well as the C source code for OpenSSL to figure this out. What I found is that these error messages indicate errors when parsing something in the config file, and since it is complaining about an empty or null name, I had some idea what to look for. In my OpenSSL configuration file, I found an empty SAN entry on line 14: /etc/ssl/openssl.cnf # pfSense: default SAN value if $ENV::SAN is not defined # SAN = /etc/ssl/openssl.cnf (after change) # pfSense: default SAN value if $ENV::SAN is not defined # SAN = DNS:myname This simple change solves the issue.
  • Changing My Netgate Contact Information

    1
    0 Votes
    1 Posts
    32 Views
    No one has replied
  • pfSsh.php playback script to change username

    1
    0 Votes
    1 Posts
    17 Views
    No one has replied
  • Frequent Crashing (Page Fault) After Upgrade to 2.8.0 From Latest 2.7

    60
    0 Votes
    60 Posts
    877 Views
    N
    @rfranzke Its waaaay too difficult to blame faulty installation for random crashes. If something like that happens (say, a faulty drive) then crashes are immediate and repeatable. The bsd bug that Steven has found is a better candidate. Obviously its rare, if it wasn't there would be plenty of reports here about it. Now you are able to catch full crash dumps. A debug kernel is the next thing. This is deep waters and you know it. Give it some time.
  • Restore backup file from the console CLI

    8
    0 Votes
    8 Posts
    295 Views
    luckman212L
    @patient0 just a quick note, I updated that script to operate correctly on newer versions of pfSense (2.8/25.07). Let me know if you run into any issues.
  • List or toggle rules on/off via CLI

    11
    5 Votes
    11 Posts
    2k Views
    luckman212L
    Just a quick note, I updated my script to operate correctly on newer versions of pfSense (2.8/25.07). Let me know if you encounter any issues.
  • How to block spotify on pfsense?

    7
    0 Votes
    7 Posts
    11k Views
    keyserK
    @ser There is still the IP block option which really BLOCK's it, but is maybe also a little cumbersome. You could look into using the package pfBlockerNG and then select one of two paths: 1: If you can force all clients to only use your pfSense as DNS you could block all DNS lookups that relates to Spotify. That would effectively either require a some good google-foo to find those names, or alternatively setup at test and have your DNS server log all queries when Spotify opens. 2: If Actual blocking is needed rather than just preventing nameresolution, then pfBlockerNG can also be configured to import lists that contains IP addresses. I'm sure there is some site somewhere that maintains Spotify's IP in a list - alternatively you could attempt to fetch the ASN ownership of IP blocks that Spotify owns, ,but that might not cut it (CDN's and such...) Option 1 I ususally the easiest and best working model even though it only prevents nameresolution rather than actual blocking.
  • pimd

    8
    1 Votes
    8 Posts
    321 Views
    M
    @louis2 Hello ! Thank you for your work with pimd ! I have been able to test your pimd binary, it seem to work but I still have the same bug I discribed here When starting PIMD, after a few seconds it works as it should, seeing multicast sources and routing it if needed. But after about 3 minutes, PIMD is "loosing" multicast sources even if pfSense still receive this multicast traffic (packet capures, and network traffic). PIMD does not "receive" multicast source anymore. Restarting PIMD makes it see again multicast sources until it looses it again after about 3 minutes. @louis2 do you have the same problem ? I really do not understand why I have this
  • How to Forward mDNS/Bonjour (UDP 5353) Across IPsec Tunnel?

    3
    0 Votes
    3 Posts
    101 Views
    A
    @dennypage Thanks for the info. Yeah, it appears somewhat complicated with IPSEC. ARD works over IPSEC but without live status and system information, which is what we had hoped to get working over our old IPSEC tunnels. ARD works fully with OPENVPN for us. Has anybody else had some successes here? Thanks, Alfredo
  • Freeing disk space on very old routers (disk space accumulates over time)

    3
    0 Votes
    3 Posts
    85 Views
    stephenw10S
    Indeed, not an easy way I'm aware of. I'd just reinstall clean to be honest. However you may need to wait for the 1.1 installer that has a 'low resource' mode to allow writing to a 4G eMMC.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.