several machines, some running pfsense 1.2.3, some just running freebsd. boot iso won't install, fails trying to write to ad4: TO FIX IT, I needed to boot a recovery cd and zero out the first 512 bytes of the drive.  not good. means upgrades will always fail. then, everything loaded fine from boot cd (but of course, I could not upgrade)

i have found some boot loader issues. try zeroing our the first 512 bytes of the drive, ie: /dev/ad4s (ls /dev/ad if ata, da* if not)

I don't know if it is related to this fix, but with today's (5th of march) snapshot I have issues with multicast and upnp detection and NAT.

Well, the kind of testing I'm talking about isn't about the functionality of the packages, but simply about the packages not bringing down the system, such that that one can get in with the web configurator and delete/reinstall/update things. I'm not expecting all permutations of functionality to be tested, but e.g. as you say that some packages are conflicting, that's something that needs to be taken care of on a fundamental level. e.g. if package A is installed, conflicting package B should be grayed out on the available package list. Now, after de-installing snort, and updating to the latest snapshot, the upgrade finished, seemingly, but on the console I have this beautiful message as part of the screen: /libexec/ld-elf.so.1: /usr/local/lib/libiconv.so.3: unsupported file format and the web config interface can no longer be started. Looks like I will have to re-install from scratch yet once more… So even without snort installed, there are issues with a working system being upgraded to another version of the system. Needless to say, I have no idea what installs this library and/or depends on it, if it's some package or the main system, etc. If I e.g. compare this with Cydia on my jailbroken iPhone: conflicting packages can't be installed or cause the deinstallation of the conflicting packages, dependencies are automatically selected (e.g. if this were pfSense, installing the Snort dashboard widget would also install Snort itself) Obviously this isn't going to happen for the 2.0 release, but I think it should find its way onto the road map, because it's key to a wider adoption of the system. At the very least, known package conflicts should be listed as text on the packages page. Some things are obvious, e.g. that the FreeSwitch and FreeSwitchDev packages are mutually exclusive, or Squid and Squid3, but beyond that it becomes a voodoo of trial and error... To have one test system with all non-conflicting packages installed, and have it updated every so often, and disabling packages that prevent a successful upgrade shouldn't be that much work. All I'm hoping for of such testing is the prevention of being locked out of the system by not being able to get into the web configuration tool and making changes to bring the system back to sanity in the case of an incompatibility.

@damur: Now, in pfsense 2.0 RC1, all the traffic goes to the default queue. I am not able to put a packet into a queue depending on it's source address. Filtering by other criterias, for example ports seems to work. :( Hi I had the same problem. Will try today's snapshot.

I don't have any problem with that, and never complained about the (few) bugs we've encountered on our half a dozen 2.0 deployments so far (as mentioned, for customers that had needs addressed only by the new version); my original reply above was just meant to offer an additional way to recover from the bug in this particular snapshot. I've been dealing with computers since the Apple II, and have to tell you: if every single piece of software on these past 30 years had been as reliable as pfSense, I'd certainly have fewer gray hairs today  :) Marcello Sao Paulo - SP - Brazil

ifconfig ath0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 2290 ether 00:80:c8:17:dd:4a media: IEEE 802.11 Wireless Ethernet autoselect mode 11g <hostap>status: running vr0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500 options=82808 <vlan_mtu,wol_ucast,wol_magic,linkstate>ether 00:30:18:b2:62:50 inet6 fe80::230:18ff:feb2:6250%vr0 prefixlen 64 scopeid 0x2 nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (100baseTX <full-duplex>) status: active plip0: flags=8810 <pointopoint,simplex,multicast>metric 0 mtu 1500 lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384 options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4 nd6 options=3 <performnud,accept_rtadv>pflog0: flags=100 <promisc>metric 0 mtu 33200 pfsync0: flags=0<> metric 0 mtu 1460 syncpeer: 224.0.0.240 maxupd: 128 enc0: flags=0<> metric 0 mtu 1536 ath0_wlan0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1480 ether 00:e0:a0:17:20:c1 inet6 fe80::280:c8ff:fe17:dd4a%ath0_wlan0 prefixlen 64 scopeid 0x9 inet 192.168.3.1 netmask 0xffffff00 broadcast 192.168.3.255 nd6 options=3 <performnud,accept_rtadv>media: IEEE 802.11 Wireless Ethernet autoselect mode 11g <hostap>status: running ssid ceshi channel 4 (2427 MHz 11g) bssid 00:80:c8:17:dd:4a regdomain FCC indoor ecm authmode OPEN privacy OFF txpower 27 scanvalid 60 protmode OFF burst -apbridge dtimperiod 1 -dfs pppoe0: flags=88d1 <up,pointopoint,running,noarp,simplex,multicast>metric 0 mtu 1492 inet 180.95.238.80 –> 180.95.238.1 netmask 0xffffffff inet6 fe80::280:c8ff:fe17:dd4a%pppoe0 prefixlen 64 scopeid 0x8 nd6 options=3 <performnud,accept_rtadv></performnud,accept_rtadv></up,pointopoint,running,noarp,simplex,multicast></hostap></performnud,accept_rtadv></up,broadcast,running,simplex,multicast></promisc></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></pointopoint,simplex,multicast></full-duplex></performnud,accept_rtadv></vlan_mtu,wol_ucast,wol_magic,linkstate></up,broadcast,running,simplex,multicast></hostap></up,broadcast,running,simplex,multicast>

Please post screenshots of what you are talking about. Including steps how to reproduce the above.

Never mind. Sorry, looks like I messed up when I imported an already existing CA cert and key. My Bad.

i just updated to the rc2.0 snapshot yesterday, snort doesn't seem to be blocking anything, the table is present, however snort2c im assuming there's a script that goes with it isn't present. snort's running, logging the alerts, there is pretty heavy traffic on the network and maybe 15 or so 1-3 priority alerts per hour, i've tried to find as much info as i can for the rc2 snort, but aside from barnyard2 not having the mysql db output plugin i can't find much else, is snort2c/blocking supposed to be working in the rc?

Here is the section I think you are looking for: in the interfaces: <wan><if>sis1</if> <mtu><blockpriv><media><mediaopt><spoofmac><use_rrd_gateway><ipaddr>pppoe</ipaddr></use_rrd_gateway></spoofmac></mediaopt></media></blockpriv></mtu></wan> There is another section for the pppoe: (I changed the username and password….) <pppoe><username>Changed@Whoknows.com</username> <password>Password1234</password></pppoe>

Thanks! Found a few entries for the package name and removed them.

Fix here: http://forum.pfsense.org/index.php/topic,33909.msg176091.html#msg176091

RESOLUTION for ssh login with PRIVAT KEY inclusive passphrase! (Offensive Security Certified Professional :) ) with PuttyGen! i have make a privat key with passphrase via ssl tool in debian-linux. you can also make it in windows^^ step two: load it into puttygen and copy the ssh-rsa output to the User Interface in pfsense User-Manager into Authorized-Key finish! now you can login over ssh into pfsense with your privakey structure thanks CLOSED!

I am agreeable. It so works on the bidirectional rules if it is indicated only Queue and queues with the identical names exist on the different interfaces. This error message a little it brings down to sense. Thanks!