PFSense+ on FREEBSD16 does not work with CROWDSEC
-
Moving from PFSense CE to PFSense+ edition, I have lost ability to install Crowdsec because Crowdsec has no candidate for FreeBSD 16.
Is there any plan to solve that ? -
Sounds like a Crowdsec problem.
Maybe post an issue on their GH repo
-
I agree, but Netgate does not at all warn CE users of possible issues when upgrading to PF+.
Freebsd 14 to 16 is not a small step.
-
Is Crowdsec a Netgate officially supported package in CE or Plus?
If the answer is no, then how can you expect Netgate to provide a warning for stuff installed outside of official pfSense packages?
pfSense is an appliance distribution, same as TrueNAS. It is not a general purpose distribution you can install anything you want.
https://docs.netgate.com/pfsense/en/latest/recipes/freebsd-pkg-repo.html
-
Indeed, we don't test or support 3rd party packages. I wasn't aware of this limitation.
-
Community users are encouraged to switch to Plus edition when they need specific improvements like using a QAT crypto accelerator board, this is fair from my point of view
BUT these users are not informed clearly that Plus edition has a shift of TWO FreeBSD releases !Knowing that before, I did not move at all or I'll go to a previous Plus release, with the same FreeBSD level.
-
What you're essentially complaining about is well documented. Were you expecting a personalized letter sent certified?
-
Mmm, 2.8.(1) is built on FreeBSD 15 too.
-
@stephenw10 and 2.8.0-RELEASE occurred in May 2025
-
@laurentm There is a workaround to get Crowdsec running despite not having FreeBSD 16. This is described at: https://github.com/crowdsecurity/pfSense-pkg-crowdsec/issues/121
The solution is to perform the installation in the FreeBSD 15 context:
[25.11-RELEASE][admin@routeme.local.lan]/root: sh install-crowdsec.sh --release v0.1.6-1.7.4-33 --freebsd 15
Checking pfSense package dependencies...
done.
#----------------------------------------------------------------#This script is intended to be used only if the CrowdSec
package is not available in the official pfSense repositories,
or to test pre-release versions.
Please check the pfSense package manager before proceeding.
#----------------------------------------------------------------#
Do you want to continue? (y/N) y
Looking up https://api.github.com/repos/crowdsecurity/pfSense-pkg-crowdsec/releases/tags/v0.1.6-1.7.4-33
Selecting archive for FreeBSD 15/amd64The archive to be downloaded is: https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.6-1.7.4-33/freebsd-15-amd64.tar
Do you want to proceed with the download? (y/N) y
Downloading archive: https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.6-1.7.4-33/freebsd-15-amd64.tar
done.
Extracting archive to /tmp/tmp.PdGW3TJb4TThe following packages are ready for installation:
- crowdsec-firewall-bouncer-0.0.33.pkg
- crowdsec-1.7.4.pkg
- pfSense-pkg-crowdsec-0.1.6.pkg
Do you want to install them now? (y/N) y
Stopping crowdsec services...
crowdsec not running? (check /var/run/crowdsec_daemon.pid).
crowdsec_firewall is not running.
Checking for orphan processes...
No orphan process found.
Installing crowdsec-firewall-bouncer-0.0.33.pkg
pkg: wrong architecture: FreeBSD:15:amd64 instead of FreeBSD:16:amd64Message from crowdsec-firewall-bouncer-0.0.33:
--
crowdsec-firewall-bouncer is installed.Note: If you are using OPNsense or pfSense, ignore the following instructions and use the settings page of the
CrowdSec plugin.
If you are running crowdsec on this machine, the bouncer will register itself with
the Local API when it's started the first time.If the LAPI is on a different machine, you need to manually register the bouncer
and fill api_key and api_url in /usr/local/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml before
starting the service.This package depends on the Packet Filter service.
To make sure it's active:
service pf enable
pf enabled in /etc/rc.conf
service pf start
Enabling pf.
Add the following in /etc/pf.conf to create the firewall tables and rules. If the start
command complained about missing pf.conf, you'll have to run it again.
table <crowdsec-blacklists> persist
table <crowdsec6-blacklists> persist
block drop in quick from <crowdsec-blacklists> to any
block drop in quick from <crowdsec6-blacklists> to anyIf you already have any pass rule, you may want to put the block rules before them.
To apply the file:
pfctl -f /etc/pf.conf
Then activate the bouncer service and run it:
service crowdsec_firewall enable
crowdsec_firewall enabled in /etc/rc.conf
service crowdsec_firewall start
Installing crowdsec-1.7.4.pkg
pkg: wrong architecture: FreeBSD:15:amd64 instead of FreeBSD:16:amd64
Updating crowdsec hub data
Downloading /usr/local/etc/crowdsec/hub/.index.json
crowdsecurity/http-cve is outdated because of scenarios:crowdsecurity/vmware-vcenter-vmsa-2021-0027
crowdsecurity/http-cve is outdated because of scenarios:crowdsecurity/fortinet-cve-2018-13379
crowdsecurity/http-cve is outdated because of scenarios:crowdsecurity/pulse-secure-sslvpn-cve-2019-11510
crowdsecurity/http-cve is outdated because of scenarios:crowdsecurity/thinkphp-cve-2018-20062
crowdsecurity/http-cve is outdated because of scenarios:crowdsecurity/apache_log4j2_cve-2021-44228
crowdsecurity/http-cve is outdated because of scenarios:crowdsecurity/jira_cve-2021-26086
downloading scenarios:crowdsecurity/apache_log4j2_cve-2021-44228
downloading scenarios:crowdsecurity/fortinet-cve-2018-13379
downloading scenarios:crowdsecurity/jira_cve-2021-26086
downloading scenarios:crowdsecurity/pulse-secure-sslvpn-cve-2019-11510
downloading scenarios:crowdsecurity/thinkphp-cve-2018-20062
downloading scenarios:crowdsecurity/vmware-vcenter-vmsa-2021-0027
downloading collections:crowdsecurity/http-cveRun 'sudo service crowdsec reload' for the new configuration to be effective.
Message from crowdsec-1.7.4:
--
crowdsec is installed.Note: If you are using OPNsense or pfSense, ignore the following instructions and use the settings page of the
CrowdSec plugin.
You need to check/edit the following files in /usr/local/etc/crowdsec as described in https://doc.crowdsec.net/docs/configuration/crowdsec_configuration
- config.yaml: main configuration
- acquis.yaml, acquis.d: datasource configuration (this port does not include automatic discovery of the running services)
- profiles.yaml: remediation policies (ban, duration, etc)
Then you can enable the service and run it.
service crowdsec enable
crowdsec enabled in /etc/rc.conf
service crowdsec start
Installing pfSense-pkg-crowdsec-0.1.6.pkg
pkg: wrong architecture: FreeBSD:15:amd64 instead of FreeBSD:16:amd64
Saving updated package information...
done.
Loading package configuration... done.
Configuring package components...
Loading package instructions...
Custom commands...
Executing custom_php_install_command()...<pre style="white-space: pre-wrap;">PHP ERROR: Type: 1, File: /usr/local/pkg/crowdsec.inc, Line: 68, Message: Uncaught Error: Call to undefined function parse_config() in /usr/local/pkg/crowdsec.inc:68
Stack trace:
#0 /usr/local/pkg/crowdsec.inc(152): crowdsec_config_migrate()
#1 /etc/inc/pkg-utils.inc(800) : eval()'d code(1): crowdsec_install()
#2 /etc/inc/pkg-utils.inc(800): eval()
#3 /etc/inc/pkg-utils.inc(917): eval_once()
#4 /etc/rc.packages(76): install_package_xml()
#5 {main}
thrown</pre>pkg: POST-INSTALL script failed--------------
Installation complete.
You can configure and activate CrowdSec on your pfSense admin page (Package / Services: CrowdSec).During installation, you will initially encounter some errors (see the bold text).
The installation creates the file "crowdsec.inc" located in /usr/local/pkg, which I subsequently modified in three places using the vi editor:
[25.11-RELEASE][admin@routeme.local.lan]/root: ls -l /usr/local/pkg/crowdsec.inc
-rw-r--r-- 1 root wheel 21200 Dec 5 18:42 /usr/local/pkg/crowdsec.inc
[25.11-RELEASE][admin@routeme.local.lan]/root: vi /usr/local/pkg/crowdsec.incAs described in the post: https://github.com/crowdsecurity/pfSense-pkg-crowdsec/issues/121, I replaced parse_config(true) with: **if (function_exists('parse_config')) {
parse_config(true);
}**
Then I ran the post installation again: [25.11-RELEASE][admin@routeme.local.lan]/root: /usr/local/bin/php -f /etc/rc.packages pfSense-pkg-crowdsec POST-INSTALL
Saving updated package information...
overwrite!
Loading package configuration... done.
Configuring package components...
Loading package instructions...
Custom commands...
Executing custom_php_install_command()...done.
Executing custom_php_resync_config_command()...done.
Menu items... done.
Services...done.
Writing configuration... done.Now you just need to go to: Service->Crowdsec, open the dialog window, and press the save button to start the Crowdsec service:
Crowdsec now also runs with pfsense Plus version 25.11.
Privacy Policy · Cookie Policy