@eagle61 said in Wireguard Tunnel vom LAN nicht erreichbar:

Tja, das kann dir mit den bisher von dir gelieferten Infos niemand sagen. Hast uns ja nicht mitgeteilt, was du bisher wo und wie konfigurert hast, also z.B. Statische Routen, Firewall-Regeln, Portweiterleitungen, etc.

Eban das. Keine Config, keine Details. Immerhin ein Netzplan, großes Plus dafür, aber keinerlei Info was eigentlich wo wie nicht funktioniert mit welcher Config und was wo reinkonfiguriert ist. Wie kann man da sagen, woran es wo genau klemmt?

Cheers :)

@stephenw10 I might have to reformat the micro HDD it’s one big zfs parition

Figured it out!!

It was a docker container problem. Docker container was set to use ipvlan, so changed to macvlan.

And changed host access to custom networks to enabled.

Now I can post from my docker container.

Ok.. now trying to figure out how to access emby from wan.

@stephenw10
My only thinking is you don't want to bridge any pfsense interfaces, use layer 3 routing in a larger network between interfaces. Layer 2 has a lot of baggage. The same if you are using slow communication lines. Route over them, layer 3 instead of bridging them, layer 2. At least it was that way 20 years ago with a network of 4000 Windows clients. I would think the principles would still apply for the fastest speeds on large networks.

Yeah that^. Is it only the pfSense webgui you can't access? Connecting to external site still works?

@jimp Thank you for investigating. However, I cannot provide the results. I've replaced the unit with another system for other testing. I'll circle back around to provide the results you requested eventually.

That was too easy! And it worked! thanks.

@viragomann
Hi viragomann,

thank you very much for your time and investigation. Your answer was very important bringing me back to the correct path for debugging. The reason, why clients can't reach the internet was an inconsistent configuration of pfBlockNG between the two HA members. I've ignored erros like this:

/rc.filter_configure_sync: New alert found: Unresolvable source alias 'pfB_BinaryDefense_v4' for rule 'NAT Allow HTTPS_2_xxxxxxxx'
Dec 14 16:17:17 svrfw02 php-fpm[32037]: /rc.filter_configure_sync: New alert found: Unresolvable source alias 'pfB_DNSBLIP_v4' for rule 'NAT Allow HTTP_2_xxxxxxxx'
Dec 14 16:17:17 svrfw02 php-fpm[32037]: /rc.filter_configure_sync: New alert found: Unresolvable source alias 'pfB_DNSBLIP_v4' for rule 'NAT Allow HTTPS_2_xxxxxxxx'
Dec 14 16:17:18 svrfw02 php-fpm[32037]: /rc.filter_configure_sync: New alert found: There were error(s) loading the rules: /tmp/rules.debug:299: syntax error - The line in question reads [299]: rdr on lagg1.808 inet proto tcp from ! to 83.x.x.54 port 443 -> $SERVER_xxxxxxxx

After fixing this, switching between carps members works correctly.
Again, thank you for your assistance !!!!!

I use the SafeXcel and disable the IPsec-MB Crypto, it is much faster with OpenVPN connections that way for my 2100. I use to have both enabled but it caused a slower connection for some reason. The way I look at it, if you have a dedicated crypto chip use it and deactivate the other.

@viragomann
Vielen Dank!
Super es funktioniert bestens.

Redirect Gateway war bei mir gesetzt. So brauchte ich im VPN-Server nichts mehr einzutragen.

Noch mal vielen Dank für die Hilfe und viele Weihnachtsgrüße an all die lieben ehrenamtlichen Helferlein!

Ich finde leider keie "gelöst"-Funktion.
Von daher gelost.

@Gertjan Just a friendly poke -- I took your post as "funny, as it is meant to be" - others it appears, assumed you were serious about avoiding it because it is "free". I'm a "paid free" user as well, with real netgate gear, but that wasn't the point. The person raising the question has a configuration (or other issue) it has nothing to do with it being product or list being "free" or "spam".

@stephenw10
Just asked my daughter yesterday to shut down the PS5 completely, states remains up, this is today:
a7ad3d10-465f-4d5b-ad9b-c79713de2034-image.jpeg

Here the log:
d33c310f-7ba7-497a-9a20-9316364ea61b-image.png
Seems it failed to remove the state.
I will try with other console we have at home, PS4 and Nintendos to see more.
Where can I set the port expiration value?

@bmeeks Thanks, that makes perfect sense. Sorting timestamps in that month-first format would be a mess!

My responses are being held for administrator approval since I just signed up to post this thread. Hopefully they still make sense being out of order. I had already found the setting you pointed me to, and also a timestamp format setting to make alpha sorting work properly.

Keep in mind you will have to install an SSL certificate on the Raspberry PI to download the GIT hub file and program. You have to copy the SSL file over to the pi by way of a USB drive and reconfigure your ca certificates for that, or just connect the pi to a non-proxied system to get your files after set it back. If you are like me you just add the certificate so you can access the proxy.

To add the firewalls certificate used with the proxy first download it directly from the firewall so you know it is yours.
after

sudo mkdir /media/usb sudo mount /dev/sda2 /media/usb -o umask=000 cd /media/usb #find your file from the flash drive lets call it CA-Cert.crt #copy it to the locations is it needed at sudo cp CA-Cert.crt /etc/ssl/certs sudo cp CA-Cert.crt /usr/share/ca-certificates/ sudo cp CA-Cert.crt /usr/local/share/ca-certificates/ sudo update-ca-certificates

This should fix your certificate issue to use wget while in the proxy.

Final step we need to make sure that once inside the proxy that you can't call the wpad, meaning that the WPAD is a one-way ticket that the proxy or it's cache cannot access it for added security.

Add this to custom options on the Squid configuration, it is not really needed I add this for fear of container issues,

acl wpad urlpath_regex ^/wpad.dat$ acl wpad urlpath_regex ^/proxy.pac$ acl wpad urlpath_regex ^/wpad.da$ #deny_info 200:/etc/squid/wpad.dat wpad # this is if you manage wpad from squid not needed here reply_header_access Content-Type deny wpad

I understand, thank you for the details and fast reply.

@mer it’s on a external drive so if someone grabs it and takes it my credit card etc is not on the drive, it’s not internal that was FreeBSD recommendation to use Eli for external usb swaps

TIL about the System Patches package and path strips. Thanks for your help @stephenw10 . We're back in business.

Our solution at this point :

Automatically :

Remove unwanted boot environnements Update the train to the stable version Check upgrade availability (pfSense-upgrade -d -c) Prefetch all packages (pkg fetch -u -d -y)

So we want finally launch the upgrade (pfSense-upgrade -4 -d -y) it's faster !

@AJ847-63 said in Setup and add PFSense router to existing network:

trying to figure out why disabling WPS on a router solved speakers not being detectable in the app (despite everyone including the product designer telling me that's not possible)

Ha, I know that feeling! And, yes, hard to see how that would have any effect. Yet....

But, yes, I imagine the Asus router is connected to one of the LAN ports on the Telstra CPE?

In which case you should be able to connect pfSense to one of the other LAN ports on the Telstra without affecting any of the existing network. Just make sure there are no overlapping subnets.

Then you can experiment with pfSense and move things across to it when it's ready.

Thank you. It turned out that I had a faulty interface setting that kicked in when the unit was rebooted. I had to revert to reset the device, restore previous settings and delete the faulty setting to get all working again.

A learning process indeed.

Thank you for the suggestion!