• Patch for 8.3 IPsec to better scale up to large SPD / SADB

    Locked
    5
    0 Votes
    5 Posts
    4k Views
    G

    I think O(n) means a gradual degradation (linear) so a statement that >100 items in one or other DB "causing" problems is a bit misleading - it depends on your horsepower and traffic.

    A quick look at one of my pfSense VMs shows 136 odd items in the SAD.  Can't say things are unusable by any stretch of the imagination.

    However a better algo is always a good idea in any area of IT - the bloody things are cut n paste out of many textbooks!  Amazing something as old as IPSEC has only just received this treatment.

    Cheers
    Jon

  • HE Dynamic Tunnelbroker DNS is not auto updating the endpoint

    Locked
    6
    0 Votes
    6 Posts
    5k Views
    V

    Actual problem was a Realtek 8111E (on Asus C60M1-I motherboard) causing numerous problems, including pfSense restarts. One of the WANs, the problematic one, was on this interface. Besides Intel dual gigabit LAN in PCIe slot.

    Temporarily installed a USB LAN for Nintendo Wii, disabled Realtek in BIOS and all problems are gone now. Will add a Cisco smart switch with VLANs as a permanent solution instead of USB LAN once it arrives.

  • 0 Votes
    3 Posts
    4k Views
    jimpJ

    DHCPv6 does not support failover, not sure why the options were in the GUI, but aside from the one that broken the backup config, they were not in the backend.

    Current recommendation is to run them independently with separate pools.

    We're considering maybe having the DHCPv6 daemon shut down in a failover config if the interface is in a CARP backup status, but that isn't quite so easy.

  • Rule matching with "WAN address" for IPv6 is broken?

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    jimpJ

    Your last note may be correct there, if it can't determine the IP for that it may not know it for use in firewall rules.

    I ran a test here with a static config and it does properly form the expected rule.

  • WebUI ARP table header

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • [SOLVED] webConfigurator do not answer IPv6 requests

    Locked
    27
    0 Votes
    27 Posts
    11k Views
    K

    Ahhhh-  Good.  Getting ready for IPV9 are they?

  • Gitsync flushes states, as of a few days ago

    Locked
    11
    0 Votes
    11 Posts
    5k Views
    D

    WFM now, sanity restored. :D

  • Wishlist item for 2.2: Global Server Load Balancing like feature

    Locked
    1
    0 Votes
    1 Posts
    3k Views
    No one has replied
  • RFC 2136 clients wildcard

    Locked
    7
    0 Votes
    7 Posts
    4k Views
    S

    Hmm… Wouldn't it be better to have a wildcard CNAME and the register the name that CNAME points to using dyndns?

    Allowing * in the record to be registered makes the assumption that DNS servers would support it. I think out of the box most DNS servers do not support it.

  • 4th sept snapshot borken

    Locked
    6
    0 Votes
    6 Posts
    4k Views
    X

    yes my current ip is 92.99. but check from 86.xxx as my ip isnt static but if possible check reports from Dubai, UAE ip range

    around 5-6 hours back

  • Cann't open /dev/cuaU1.3

    Locked
    4
    0 Votes
    4 Posts
    3k Views
    jimpJ

    Something is preventing the port from being opened, then. Either it isn't accessible for one reason or another, or some other process already has a hold on it.

    Does the node actually exist in /dev/? Can you hit it with cu or tip and get a proper AT command response? (you can kill the mpd process trying to latch onto it, if that helps)

  • Multi-WAN "default gateway" sticks even when unchecked.

    Locked
    10
    0 Votes
    10 Posts
    3k Views
    E

    @bkraptor:

    Also, you're completely disregarding any such scenarios where one disables pf and only uses the box as a router.

    That is a valid scenario.
    But for 2.1 really there is not really an easy way to avoid that especially if you have dynamic interfaces(DHCP/PPP types/etc).

    You can enter a feature request in redmine so this does not get forgotten and taken into consideration in the future.

  • Changing a Lan rule causing errors

    6
    0 Votes
    6 Posts
    5k Views
    D

    Thanks everyone
    Seems like it's be easier to just disable it on my two outgoing interfaces.  According to dashboard it is sitting at 81% memory used now with that feature on.

  • Traffic Shaper Queues stats are strange

    2
    0 Votes
    2 Posts
    2k Views
    M

    I'll second this issue.  Sometimes I load the Queue's graph and the numbers look reasonable even though smoothing looks too aggressive.  And other times my Wan says it has 200Mbps when the provision is for 5Mbps.  No way to reset the numbers.

    Be helpful to know the file that defines the averaging of values in the graph columns.  I'd like the Bandwidth column to average over maybe 3 to 5 samples since the interval is 5 seconds.

    Appreciate the help…

  • IPv6

    3
    0 Votes
    3 Posts
    2k Views
    jimpJ

    I have two tunnels from he.net to two different tunnel servers, one on my DSL, one on Cable, and they both work fine independently or at the same time (NPt helps there).

    If they all went down at the same time then one of a few things had to have happened:

    Your monitor IP pings were not going over the interface you thought they were Upstream connectivity to the tunnel servers died (Happens a lot when someone decides to DDoS he.net) Something else along the path caused the tunnels to drop

    With quite a lot more information about your setup, it may be possible to speculate more accurately about the cause, but there isn't enough to go on there.

  • Trigger custom event when wan ip changes

    9
    0 Votes
    9 Posts
    3k Views
    X

    the reason i need this is because of another issue not related to this thread, when u create a dyndns entry with interface as wan failover group, sometimes when the wans switch the dns doesnt get updated at all

  • Phantom OpenVPN client session

    5
    0 Votes
    5 Posts
    6k Views
    E

    @phil.davis:

    We (a friend at my workplace and myself) are working on some rc.bootup changes to handle low-memory systems better - giving the option to slow down the boot process, checking free memory after each significant process is started and waiting until it stabilises before moving on. We are also thinking about moving the OpenVPN startup until later, as OpenVPN process startups are memory hogs, and it might be best to have all the other essential things up and running before OpenVPN.
    Hopefully there will be a proposed code solution later in the week.
    If you have any ideas to share to improve the boot process, let us all know.

    As i said in the other thread its not openvpn the issue its the php.

    If you want to be smart enough you should optimize check_reload_status to check memory conditions or even not fire an similar even if its running.
    The simple hack to make all things work on lowmem systems would be to tell check_reload_status to serialize the events and wait for one to finish before starting another.

    That will give you predictable behviour on lowmem systems.

  • Alias issue

    2
    0 Votes
    2 Posts
    1k Views
    P

    Do you mean Firewall Alias?
    Firewall Aliases are used in Firewall Rules and other places in the pfSense code. The Firewall Alias name and its associated IP addresses are not added to the DNS hosts file.
    (That would be quite difficult to implement generally, because aliases can have other aliases, FQDNs, networks… in them as well as simple IP addresses.)

    To get name/IP-address into /etc/hosts, add them to DNS Forwarder, Host Overrides.

  • 404 error on OpenVPN Client Export and Shared Key Export pages

    3
    0 Votes
    3 Posts
    2k Views
    M

    @phil.davis:

    That code is part of the OpenVPN Client Export package. It sounds like the package did not reinstall after the last firmware update. Look in System->Packages.

    You are right! For some reason the last upgrade did not reinstall the packages and had to reinstall them manually, but I completely forgot that the Client Export is a package and not part of the normal install.

    Thanks.

  • Ipv6 not working on comcast

    36
    0 Votes
    36 Posts
    20k Views
    R

    Also, pull request has been accepted, so the switch should turn up in the next snapshot.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.