Questions tagged [pfsense]
pfSense is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is known for its reliability and high-grade features.
83 questions
0
votes
0
answers
86
views
ISC Bind9 with DNS over TLS (DOT) fails when strict tls auth is enabled
working I installed and setup Bind9 official package to test DNS forward zones based on source IP/subnets which unbound doesn't support
I properly set NAT forwards, changed listening ports on Bind9 ...
0
votes
0
answers
112
views
pfSense routing issues
Ive got a routing issue on my pfSense box that shows the response to a ping request being routed to a IP in a separate subnet/vlan.
10:25:13.239238 IP 10.2.0.2 > 8.8.8.8: ICMP echo request, id 9374,...
0
votes
0
answers
59
views
How to Allow all NATed traffic from iptables firewall via pfsense (gateway)
I have an iptables firewall (machine 1) and a centos 7 based gateway (machine 2), which is having 2 interfaces (machine-2:int-1) from WAN [/30] and (machine-2:int-2) is LAN [/28] one of the static IP ...
2
votes
1
answer
786
views
pfSense (FreeBSD 14.0) - Prometheus Node Exporter gives log errors - fix or suppress in log
On pfSense, I've enabled Prometheus Node Exporter, but it gives the following log errors each 15 seconds:
Feb 15 09:53:57 vault node_exporter[25559]: ts=2024-02-15T08:53:57.164Z caller=collector.go:...
1
vote
0
answers
37
views
pfSense (FreeBSD) - tail -f not showing entire log when filtering with cut or sed [duplicate]
I have a strange problem when trying to display logs on pfSense (and I can reproduce the same problem on Ubuntu server also).
The problem is this (with examples):
I'm trying to display a running dhcp ...
0
votes
0
answers
93
views
Need help with Wireguard allowedip/pre/post settings
I started playing with wireguard on a pfsense router to try to see if I could overcome a CG Nat on a hotspot I want to use when visiting my mother a couple hours from home. I stay in an RV when up ...
0
votes
0
answers
121
views
How is it possible that NAT doesn't back translate packets?
I have the following topology
and from myhost I can ping router2 but can't ping router1.
With tcpdump I can observe how my pings go and I see that both router1 and router2 reply. But only replies ...
1
vote
1
answer
3k
views
UEFI HTTP Boot clarity?
I'm interested in learning more about UEFI HTTPBoot and setting it up for my
LAN as a netboot option, but the details are notably sparse. The best docs I've
found are Suse Docs for
configuring an HTTP ...
1
vote
1
answer
1k
views
IPSec tunnel works until rekeying, then gets NO_PROPOSAL_CHOSEN
Context
I have set up a site-to-site IPSec tunnel between a Raspberry Pi located in an office and a pfSense firewall in the cloud. I am using Strongswan for the Raspberry Pi side.
Issue
My tunnel ...
0
votes
1
answer
46
views
What subsystem is responsible if I can connect via s2s VPN connection only in one direction?
I have configured the following s2s VPN (in pfSense) connection which is working in general.
Unfortunately, I can connect (ping, netcat, ssh) only from client to the server, but not back.
If I can ...
0
votes
1
answer
496
views
What hostname to put in main.cf for self-hosted postfix, behind HAProxy?
Pfsense (HAproxy as reverse proxy)—->Unraid
I run postfix on Debian Bullseye VM (under Unraid) on my home server. It is up and running. I can send the mail out but can’t receive any incoming mail. ...
0
votes
1
answer
2k
views
PXE boot problem using netboot.xyz "mounting tmpfs on /cdrom failed: Invalid argument"
I've set up my pfsense server with tftp to support PXE booting. I've configured it to boot the latest (as of posting) version of netboot.xyz. This works to a point, but I've tried loading a few Linux ...
2
votes
0
answers
582
views
Port Forwarding over VPN link cloud VPS (To bypass CG-NAT)
I have a radio setup on a 4G connection that utilises CG-NAT. This means I am unable to access the radio remotely using the supplied remote software.
To get around this I have setup a cloud VPS ...
0
votes
0
answers
157
views
Access to pfsense wan interface by ip public
I have this diagram.
I have a server(centos 7) with ip public and staic 1.2.3.4 on internet, I want when user send request to this public ip 1.2.3.4, this request pass my modem with not static ip ...
0
votes
1
answer
750
views
routing already in table when trying to add additional route to the same net
I have the following table
$ netstat -r -4 | grep 33.0
192.168.33.0/24 192.168.29.4 UGS ovpns5
I would like to add additional route to the same network and get
$ route add -net 192.168....
0
votes
1
answer
3k
views
What are the meaning of keys in OVPN file?
I have ovpn file, which allows me to connect to remote server successfully from desktop OpenVPN GUI. Now I want to copy content of this file to OpenVPN client of pfSense. The problem is that fields ...
1
vote
1
answer
1k
views
IPTables issue between proxmox and pfsense VM
I'm kind of desperate with an IPTables issue.
I started to setup my own dedicated server which is a proxmox server. I have a pfSense VM to which all traffic is routed. I secured the LAN access by ...
0
votes
0
answers
705
views
IPv6: Server can't ping gateway (pfSense) but gets IP
I have three servers which should now also get IPv6 connectivity besides the IPv4.
Servers:
Pi4 (Raspberry Pi OS)
Nextcloud (Debian 10; Nextcloud as snap)
Mailserver (Debian 10; mailcow as docker, ...
1
vote
1
answer
126
views
Would a Netgate 1100 with pfSense Plus Software support SquidGuard?
Would a Netgate 1100 with pfSense Plus Software support SquidGuard?
I'd like to be able to do web filtering using that software / hardware combination.
P.S. Apologies if I have posted this in an ...
0
votes
1
answer
805
views
Pfsense - Installing Latest 'speedtest-cli' ( v2.1.3) to overcome error 'ValueError: invalid literal for int() with base 10'
Anyone able to install the latest 'speedtest-cli' ( v2.1.3) in their pfsense box to overcome error;
ValueError: invalid literal for int() with base 10: ''
Apparently something changed upstream and ...
0
votes
2
answers
2k
views
for loop in FreeBSD (pfSense) doesn't work
I've just noticed that the same code for for loop in bash doesn't work in FreeBSD
wolf@linux:~$ echo $SHELL
/bin/bash
wolf@linux:~$
wolf@linux:~$ for i in {1..3}; do echo $i; done
1
2
3
wolf@linux:~$...
1
vote
0
answers
3k
views
Running pfsense inside a docker container
Is it possible to run Pfsense as a docker container?
0
votes
0
answers
369
views
Networking: Cannot ping across router in one direction (can ping in other direction)
Here's my network topology:
ISP: 192.168.0.1
pfSense: (ip dhcp) <-> 192.168.1.1
pfSense does outbound NAT such that all traffic passing out of interface (ip dhcp) is NAT to map all "...
1
vote
1
answer
967
views
Make "local startup" or "service start/enabled filebeat" command on pfSense (FreeBSD)
I just install the filebeat port v6.8.7 on pfSense 2.4.5 box (freeBSD 13). After that I want to start filebeat service with
service start filebeat
but it throw error:
start does not exist in /etc/rc....
0
votes
1
answer
810
views
QEMU error on pfSense instalation
I'm trying to install pfSense using QEMU on EVE-NG. I'm using the EVE-NG documentation for pfSense 2.4.x, i did all the steps, but in the installation part
/opt/qemu/bin/qemu-system-x86_64 -hda ...
5
votes
1
answer
4k
views
Increasing disk size on FreeBSD 11.2 (pfSense | ESXi)
I tried to use this link to solve my problem but to no avail;
Expanding the disk size on pfsense under VMWare ESXi.
I'm using pfSense and I wish to increase the disk drive from 11 GB to 200 GB.
Steps ...
2
votes
1
answer
1k
views
How to fix my partition after mistaken gpart bootcode?
I was trying to make my HDD bootable and did
gpart bootcode -b /boot/pmbr -p /boot/gptboot -i1 ada0s1
and now I got "Invalid partition" message on boot.
/boot was from USB drive, not from HDD (...
1
vote
0
answers
714
views
What can I do from not booting Freebsd box command line
I got a message
Can't load 'kernel'
And computer is not booting. I have simple commands like ls and lsdev, but I don't have cd or cat. How can I find kernel and check if it is ok with these commands?...
0
votes
1
answer
56
views
How to allow certain IP's accessing an IP:Port range?
So I have an ESXi server setup with pfSense acting as the DHCP Server for the VM's. I use VNC's to access each VM over the internet (For example with ports :5905,5906,5907 etc.) and I would like to ...
0
votes
1
answer
255
views
Centos7 Host, KVM pfSense domain, and Docker in a box
I am trying to get routing straight on my server.
From the pfSense domain, I can ping IPs in the management and DMZ networks.
From the virtual host, I can ping the same IPs
pfSense is the gateway for ...
1
vote
1
answer
294
views
ssh to docker container breaks after 45 seconds
I have docker running on a synology nas.
The nas has a private network (172.17.0.0/16) where docker places the containers.
It also has a public facing interface on my lan, call it 10.11.12.10/24.
...
2
votes
0
answers
122
views
how to re-spin usb .img file to use a different bootloader?
I have a bit of a strange use-case, and after searching for 3 days, I am no closer than I started.
So my goal is to install pfSense (freebsd based), onto a Beelink Z83-II. The only problem is that ...
2
votes
1
answer
2k
views
Can't connect to OpenVPN server (pfsense)
i have some problems connecting to openvpn server with pfsense.
For my tests i got 2 network interfaces both on my pfsense openvpn server and my windows 10 openvpn client.
On my pfsense i have 1 ...
0
votes
2
answers
2k
views
Iptables (port forwarding from vps openvpn server to vpn client)
I install openvpn server in Centos VPS. I can connect from my pfsense router. I forwrad rdp a port to my local pc, but can not forward rtp port.
iptables -t nat -A PREROUTING -p tcp -m tcp --dport ...
3
votes
2
answers
2k
views
How to find rule by number of pfctl output in FreeBSD?
I have the following excerpt from pfctl -vvss command:
re2 icmp 10.10.0.62:1 <- 192.168.10.56:1 0:0
age 00:08:30, expires in 00:00:05, 192:7 pkts, 14400:584 bytes, rule 117
id: ...
0
votes
1
answer
206
views
I have disabled all rules in firewall, but still can tracert from LAN
I have disabled all positive rules in firewall on my pfSense box, and I can't browse Web, but I still can
tracert 10.10.0.251
from LAN machine and receive 3 hops from my ISP (behind the router).
...
0
votes
0
answers
481
views
How can it be, that routing doesn't work?
I have connected with openvpn client to remote host and am able to ping it. Also route of this IP belongs correctly:
> ping 10.10.0.251
PING 10.10.0.251 (10.10.0.251): 56 data bytes
64 bytes from ...
1
vote
1
answer
300
views
OpenVPN clients flip status each 120 seconds
I am connecting to two OpenVPN servers with OpenVPN clients of pfSense.
Connections work, but each 120 seconds they turn from available to unavailable and back. I.e. ping works for 120 seconds, then ...
0
votes
2
answers
538
views
Static route all host and local KVM traffic via local pfSense KVM before routing to gw
Tying to logically force ALL laptop traffic (from local KVMs and host) through a local pfSense KVM before leaving the host (fedora). Still want DHCP from the router. I've made significant progress but ...
0
votes
1
answer
1k
views
Where to put information from `key` entry of OpenVPN config file in pfSense?
I have the following config file which works well with native OpenVPN client
client
dev tap
proto udp
port 1198
remote myhost.com 1194
persist-key
persist-tun
tls-client
ca my-ca.crt
cert my-...
1
vote
1
answer
5k
views
Installed incompatible pkg version, how to uninstall (or fix otherwise)?
While trying to upgrade a pfSense 2.2.6 to the latest version (as described here) and running pkg, I got:
The package management tool is not yet installed on your system.
Do you want to fetch and ...
0
votes
2
answers
2k
views
New MySQL Installation on pfSense returns 'Bad -c option' when started
this is my first time actually using FreeBSD so there's a chance I might have missed something big, but it's unlikely.
So I want to set up mysql on my pfSense server so I can enable historical ...
1
vote
1
answer
2k
views
How to compile a pfSense port for ARM?
How do I compile a pfSense port for ARM?
Do I need to be running FreeBSD to do it? How do I then transfer it to a USB drive, SD Card, or ISO so I can boot it?
I tried the usual compiling in Ubuntu ...
1
vote
1
answer
4k
views
SSH connection timeout after a couple of seconds when my second interface is up [closed]
So I'm so lost on what to do to debug right now. I've spent a couple of weeks on this issue without understanding what is happening.
I'm trying to have the ssh server to only work with connections ...
0
votes
1
answer
2k
views
How to prevent DHCP server from behind the router to answer to DHCP requests?
I found, that sometimes DHCP server from behind my main router answers DHCP request from clients in the LAN. Below is an example
Notebook is connected to LAN via access point. There is DHCP server ...
2
votes
0
answers
1k
views
Getting pkg data using repo URLs only (without a repo.conf file) - FreeBSD 10/11
This question is about using pkg on systems where the normal FreeBSD repos have been disabled, but may occasionally be needed. To make it concrete, I'm thinking about platforms like pfSense where the ...
3
votes
2
answers
4k
views
pfsense: blocking a 2nd DHCP server
In my LAN I am using a PFSense server with one DHCP server on it.
I need to block a second DHCP server showing up in my LAN. I think I can use the PfSense firewall to refuse the other DHCP server IP ...
9
votes
2
answers
12k
views
Invalid multicast interface
I am trying to use ping with specified interface with a command
ping -I re3 192.168.1.1
I know re3 exists from ifconfig
re3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu ...
1
vote
0
answers
1k
views
Can't ping 8.8.8.8 from router, but can ping it from LAN?
I have pfSense router with 2 WANs.
I noticed, that if one WAN is down, then I can't ping 8.8.8.8 from router. Simultaneously, I am able to ping this address from within LAN, i.e. it can pass through ...
0
votes
1
answer
2k
views
pfSense IPv6 Configuration
I'm running a virtual environment on a root server.
To connect all my maschines to the internet i got a pfSense setup up.
For the pfSense box it got let's say the 2a01:4f8:162:xxxx::/64-network.
...