@dennypage Thought I would share... I was able to track this down via packet inspection. Turns out, these errors are the result of prefix delegation requests. pfSense does not yet have support for delegation when using Kea.

FWIW, the prefix delegation requests are coming from Apple devices in the role of Matter hubs. There does not appear to be a way to turn it off.

@Bob-Dig Hmmm. 🤔 Not sure what would differ then. I can test again but would prefer to wait until the weekend, or maybe late at night.

I can set it up statically but per my other thread that you responded to, the route for the delegated subnet (pointing to the internal router) is lost if the ISP router restarts, either in that router or in my "outside"/building router.

@stephenw10 said in To do 24.11 or not? That's the question.:

Hmm, should be fine. We can only speculate though without more information. If you can I would boot back into 24.11 and look at the CPU usage and system logs to see what's happening.

I am physically don't have access to my psF bix now and hesitant to mess with it remotely.

Hope somebody else reports similar (or not) and I will try later and wait for a point update.

@Yoe777 To check if the IP address that ftp.ut-capitole.fr resolves to, 193.49.48.249, is listed anywhere:

grep "193.49.48.249" /var/db/pfblockerng/DNSBLIP_v4.txt /var/db/pfblockerng/deny/*.txt /var/db/pfblockerng/original/*.orig /var/unbound/pfb_py_ss.txt

If no output is returned, that means the IP is not potentially being filtered anywhere by pfBlockerNG. (The "No such file or directory" output should be ignored.)

I've also noticed just now that the domain heimdall.ut-capitole.fr is a CNAME of ftp.ut-capitole.fr. You should ensure that heimdall.ut-capitole.fr is also either not listed and/or whitelisted.

No, I do not have it activated. The image shows the CPU usage when the dashboard is not on screen. The high CPU usage is only when the dashboard is on screen.

@ekaiser said in OpenVPN SSH & RDP:

I have seen a few posts on this issue but unfortunately either the resolution is not posted or does not fit my scenario.

So maybe you should provide some more details about your setup and tell, what you tried yet.

Hello @bmeeks,

This was indeed exactly what happened.
I have rebooted my pfsense server in the past, which I would expect create same results, but either it didn't work, or it spinned another ghost process afterwards.

Anyways, I will monitor to see if it keeps happening.
I have seen other posts where other people have similar issue indeed, and will investigate from there if duplication happens again.

In any case, thank you very much for your kind help here.

@keyser

Put it in a new file

/boot/loader.conf.local

That way it will survive pfSense upgrades.

I personally install nano to make small file edits via SSH CLI

pkg install nano

@stephenw10

Yep starts up fine, no issues.

Unless i can reproduce it or others have a similar issue might have to throw this in the mystery box.

That is the error I'd expect when trying to authorise against radius but I'd expect some other code when trying to start the service If it fails to start.

@getcom
Thank you! That worked!

Unclear. By 'router' here you mean the gl.inet GL-MT6000? And that is connected to the pfSense LAN?

I can only imagine that device drops the link to the LAN when it reboots and the other device does not. However that should not affect the WAN. The other possibility is that during boot it comes up with a subnet that conflicts with the WAN causing the default to flip.

But however it's doing it you should definitely set WAN_DHCP as default to prevent it trying to use the VPN as default.

@Bambos
When stating an alternative hostname, pfSense generates a SAN certificate. There is no reasonable case for me to do this with a user certificate, however.

The CSO check verifies only one value, either the common name of the client certificate or the username, not both. As mentioned, which one to use can be set in the server settings.

@do3lk
Hast du die korrekte externe Domain beim Setup angegeben?
Falls nicht, kannst du hinterher die config.php editieren und die Domain bei 'trusted_domains' hinzufügen bzw. den vorhandenen Eintrag ersetzen.

Okay, ich sehe gerade, dass du AIO verwendest.
Aber auch da müsste man die Domain im Setup angeben können.

AIO möchte standardmäßig ein Lets Encrypt Zertifikat installieren. Das wird hinter HAproxy nicht möglich sein. Macht auch nicht viel Sinn.
Da sollte es andere Optionen geben. Vielleicht kannst du TLS deaktivieren oder ein eigenes Zertifikat dafür generieren.
Das habe ich auch so laufen, allerdings hinter OPNsense. Der Backendserver hat ein Zertifikat von einer internen CA und HAproxy verwendet ein LE Zertifikat, das er vom ACME Client bekommt.

Allerdings die Konfiguration dafür müsste im AIO Setup gemacht werden. Ob es diese Option bietet, weiß ich nicht.

@viragomann thank you very much it now works.

It was set as "My IP Address" but seems that it don't work when it is not explicitly set.

I spent some time yesterday learning how to build from ports, and I was able to create Zabbix 7.0.6 proxy and agent binaries using a fully updated FreeBSD 14.2 VM. I didn't use Poudriere jails or anything, just ran

cd /usr/ports/net-mgmt/zabbix7-server/ && make

I copied the binaries to a pfSense 24.11 box for testing and so far they work perfectly.
This is not a proper build and testing process, but it's a good indication that Zabbix 7.0 should work fine on pfSense 24.11.

I'm not a developer and don't have a Github repo, so I guess this doesn't help anyone unless I setup an account and submit a PR for my binaries to be included?

Also, is there a guide of what the statuses mean on Redmine? The Zabbix 7.0 package request is "Confirmed", "In Progress", and target is 25.01. Does this mean that Zabbix 7.0 will NEVER be released for 24.03 or 24.11? Is Netgate staff working on the packages to include with 25.01, or is it waiting on someone in the community to submit it?

If 24.11 is the currently supported version of pfSense, and assuming the Zabbix package doesn't require modifications to pfSense, then it should be possible for an official package to be released for 24.11, right? As far as I can tell, it can 7.0 behaves exactly the same as 6.4.

I think my test port uses different default paths for the config, log, and pid files than pfSense does, but the log and pid paths can be set in the config file, and the the config file path is given as a parameter to the binary. Or someone with more knowledge than me could just set those correctly in the build.

KvY6SmgB4s.png