1. Home
  2. pfSense® Software

Subcategories

  • Announcements and information about pfSense software posted by the project team


    Topics

    Posts

    S

    @mwatch Wow the new ZFS upgrade + restart is fast. That’s going to save us a bunch of time updating clients.

  • Discussions about pfSense software that do not fit into one of the more specific categories below.


    Topics

    Posts

    JonathanLeeJ

    That fixed it the Gateway change did not transfer over to the floating traffic shaper access control lists so I had to resave them after that error is gone.

  • Discussions about installing or upgrading pfSense software


    Topics

    Posts

    UnoptanioU

    @SteveITS @jimp
    Ok thanks, I applied all the patches and performed the normal system reboot. Everything seems to be working fine.

  • Discussions about firewalling functionality in pfSense software


    Topics

    Posts

    johnpozJ

    @pastic yeah those should work.. Common practice has been to create an alias with all the rfc1918 space in it.. So if you don't wan a specific vlan to get to any of your other networks vs creating rules for each network you can just block them with 1 rule blocking access to rfc1918, this helps in blocking access to new networks you might add, etc.

    Also unless this a transit network, its also good practice to set the source to the network, ie if you making the rules on vlanX the source would be vlanX subnets, because there should never be any non vlanX source IPs hitting this interface.

  • Discussions about Network Address Translation (NAT)


    Topics

    Posts

    D

    @Gertjan It was standard sutiations, ISP support didn't understood pfsense so they told me that i must make port forward like on ptlink 😭 but issue was that they forgotten disable firewall on router. Since it was on bridge mode but firewall blocked input.

  • Discussions about High Availability, CARP, and utilizing additional IP addresses


    Topics

    Posts

    planedropP

    And it's been updated on the docs now, woohoo!

    719c5db7-c517-438b-9539-1604521bbd28-image.png

  • Discussions about Layer 2 Networking, including switching and VLANs


    Topics

    Posts

    Dobby_D

    @NogBadTheBad said in BOND Interfaces:

    @Dobby_ The OP mentioned a LAG.

    You can’t create a LAG to two different switches, you could have two different links and route.

    One LAG to the switch 1 and a second one to the switch 2 would be able to realize
    in my eyes

  • Discussions about routing and Multiple WAN uplinks (WAN Failover, WAN Load Balancing, etc.)


    Topics

    Posts

    H

    @The-Party-of-Hell-No

    No outbound NAT, only LAN rules.

    rules.jpg

  • Discussions about traffic shaping and limiters


    Topics

    Posts

    S

    @jc1976 Netgate has a recipe at: https://docs.netgate.com/pfsense/en/latest/recipes/codel-limiters.html

    I was trying it out a bit myself, following the above, and on my home 2100 the download speed drops from ~525 with PRIQ to ~430 with FQ_CODEL. I have not dug into it much other than switching back after a day. I would guess maybe a CPU limitation of the 2100's ARM CPU?

  • Discussions about DHCP, DNS Resolver (Unbound), DNS Forwarder (dnsmasq), and general DNS issues


    Topics

    Posts

    A

    @Gertjan

    Thanks for that wonderful suggestion.
    I did not notice that icon.

    Actually, the icon was already lit up on device that has active lease, which i all are black until i scroll down to see other status, I just need to get the list of active one's. tried to put "online" query on Search term and voila!

    Reason why i need to get numbers of active device daily for a period of time to see how many are connected for a particular project.

    Thanks you very much!

    Screenshot 2024-05-02 at 7.30.01 AM.png
    Screenshot 2024-05-02 at 7.29.40 AM.png

  • Discussions about IPv6 connectivity and services


    Topics

    Posts

    johnpozJ

    @michelv I don't recall ever seeing that in my logs, but then again I block a lot of multicast at the switch level, but if I had to guess it would be this

    https://docs.netgate.com/pfsense/en/latest/firewall/configure.html#ip-options

    TCP options should only ever be in SYN packets.. That clearly isn't a SYN. when sent to broadcast ff02::fb

    I would sniff and look at those that are blocked.. If you don't want those logged you could set a non log rule with ip options checked.

    options.jpg

  • Discussions about IPsec VPNs


    Topics

    Posts

    C

    Good day avery body, i have a problem with mi conection VPN, recently we want configure some devices AccessPoint Omada of Tp-link in different places with a server controller located in one only place.
    We uses Site to site Openvpn normarly with multiple pfsense located at each site.
    As problem is when success connect the vpn , we realy can do ping to various devices, can see their web portals, for example of printers or scanners o one dvr, but cant see web portal of that Tp-link Access Points, can do ping but not see their web portals.
    The same thing ocure when we use Vpn Ipsec Site to Site or use like a test OpenVpn server SSL/TLS and User Authentication in a Windows Client.
    Can you help us?
    May be we forget some rule or route, and now we remember what in other case, in other pfsense , we have a problem similar but are not realy urgence, we do ping tu us Vmware Esxi but can see their portal web.
    Can you help us?
    May be we forget some rule or route And now we remember what in other case, in other pfsense , we have'd a problem similar but did not realy urgence, we can'd ping to one Vmware Esxi but we no can'd see their portal web.

    I'm sorry by mi english if you have problems to understanding me <3

  • Discussions about OpenVPN


    Topics

    Posts

    S

    @viragomann Yes I have added allow 1194 on the network security group inbound & outbound rule. But still getting the request timed out.

  • Discussions about Captive Portal, vouchers, and related topics


    Topics

    Posts

    T

    @Gertjan - This is the solution! Thank you very much.

  • Anything that does not fit in other categories related to the webGUI


    Topics

    Posts

    juanzelliJ

    @jrey Yep. The 3.2.0_10 update resolved the PHP error for me 👍

  • Discussions about wireless networks, interfaces, and clients


    Topics

    Posts

    M

    Hi.
    I'm aware of this article (Authenticating Users with Google Cloud Identity), but is there also a way to have WiFi Users (WPA2 Enterprise) authenticate agains Azure Entra (MFA not required)? I couldn't find anything.

  • Discussions about monitoring via SNMP


    Topics

    Posts

    C

    MRTG cfgmaker gave this result for devices such as gif, lo, ovpnc, ovpns:

    gif or gif0 :

    ### The following interface is commented out because: * has no ifSpeed property

    ovpns devices:

    ### The following interface is commented out because: ### * has no ifSpeed property

    ovpnc devices:

    ### The following interface is commented out because: ### * has no ifSpeed property

    No effect for administratively DOWN or operationally DOWN interfaces, or softwareLoopback devices: e.g.:

    enc or enc0 :

    ### * it is administratively DOWN ### * it is operationally DOWN ### * has no ifSpeed property

    lo or lo0 :

    ### * it is a Software Loopback interface ### * has no ifSpeed property

    pflog or pflog0 :

    ### * it is administratively DOWN ### * it is operationally DOWN ### * has no ifSpeed property

    pfsync or pfsync0 :

    ### * it is administratively DOWN ### * it is operationally DOWN ### * has no ifSpeed property

    The solution was to change cfgmaker arguments:

    /usr/bin/cfgmaker --zero-speed=10000000 -o outfile.cfg community@object

    Additionally, --ifdesc=descr changed the Title to start with device or device.vlan where appropriate.

    Here is the site that gave me the hint:
    https://aacable.wordpress.com/2014/07/07/mrtg-monitoring-with-esxi-hosted-guest-return-interface-is-commented-has-no-ifspeed-property/

    https://oss.oetiker.ch/mrtg/doc/cfgmaker.en.html

    However, cfgmaker does not have an argument for enabling monitoring of loopback devices, though there is a more complicated method to work around that using something such as '--if-filter=($default_iftype && $if_admin)' with type 24, softwareLoopback as documented at the website above or something like below:

    "--if-filter=($default || $if_type==24)"

    The positional order is important, all flags need to precede community@router. --if-filter carries a caveat:

    --if-filter=f Test every interface against filter f to decide wether or not to include that interface into the collection. Currently f is being evaluated as a Perl expression and it's truth value is used to reject or accept the interface. (Experimental, under development, might change)

    The resulting command line argument contains double quotes:

    /usr/bin/cfgmaker --ifdesc=descr --zero-speed=10000000 "--if-filter=($default || $if_type==24)" -o outfile.cfg community@router

    If you run into an issue with the shell interpreting the contents, switch to the double quotes to single quotes.

    Now lo0 is monitored by MRTG using bsnmpd. To monitor lo0 and everything ethernet:

    /usr/bin/cfgmaker --ifdesc=descr --zero-speed=10000000 "--if-filter=($default || $if_type==24 || $if_type==6)" -o outfile.cfg community@router

  • Discussions about pfSense documentation, including the book


    Topics

    Posts

    rcfaR

    I submitted a few related bug reports and enhancement requests, in case anyone is going to track this or suggest solutions:

    https://redmine.pfsense.org/issues/15199
    https://redmine.pfsense.org/issues/15200
    https://redmine.pfsense.org/issues/15203
    https://redmine.pfsense.org/issues/15209

  • Topics related to developing pfSense: coding styles, skills, questions etc.
    Plus 24.07 Development Snapshots CE 2.8.0 Development Snapshots

    Topics

    Posts

  • Discussions about playing network-based games behind pfSense from consoles, PCs, etc.


    Topics

    Posts

    C

    "Normal traffic" typically refers to the regular data flow on a network, including web browsing, email, streaming, and other everyday internet activities. This traffic is often characterized by a mix of different types of data, such as HTTP (web), HTTPS (secure web), SMTP (email), and various application-specific protocols.

    "Gaming traffic" specifically refers to data generated by online gaming activities. This can include game downloads, updates, multiplayer gameplay, voice chat, and video streaming within games. Gaming traffic often requires low latency (minimal delay) and consistent performance to ensure smooth gameplay and communication between players.

    Here are some key differences between normal traffic and gaming traffic:

    Latency sensitivity: Gaming traffic is highly sensitive to latency because even small delays can affect gameplay, leading to lag and poor user experience. Normal traffic like web browsing or email may not be as sensitive to latency.
    Bandwidth requirements: Gaming traffic can vary in terms of bandwidth usage depending on factors like the game being played, the number of players, and the intensity of the gameplay. Normal traffic, on the other hand, may have more predictable bandwidth requirements based on typical internet usage patterns.
    Protocol usage: While normal traffic utilizes a variety of protocols depending on the application (e.g., HTTP for web browsing, SMTP for email), gaming traffic often involves specific gaming protocols and communication methods optimized for real-time interaction and multiplayer gameplay.
    Peer-to-peer connections: Some gaming traffic involves peer-to-peer connections between players for activities like multiplayer gaming or voice chat. This can require additional network configuration to ensure proper connectivity and security.
    Quality of Service (QoS): Due to the latency sensitivity of gaming traffic, network administrators may implement Quality of Service (QoS) policies to prioritize gaming traffic over other types of traffic on the network, ensuring a better gaming experience for users.
    Understanding the differences between normal traffic and gaming traffic can help network administrators optimize network performance and prioritize traffic accordingly to meet the needs of both casual internet users and online gamers.

  • Discussions about virtualizing pfSense in hypervisors such as AWS, VMware, Hyper-V, Xen, KVM, qemu, etc


    Topics

    Posts

    M

    The pfsense version "2.7.2" will be.
    Pfsense will run on a virtual machine (vmware workstation pro).
    What kind of network card will work without "bugs \ glitches", preferably with a QoS function. The network card will be pushed to the virtual machine.

  • Discussions about pfSense hardware support


    Topics

    Posts

    Dobby_D

    @VerticalTechnik

    I was wondering if anyone can recommend a good no-name Firewall
    Hardware which supports pfSense?

    What version of pfSense you want to run on that hardware pfSense+ or CE?

    Use case:
    Small business up to 20 workdesks
    Network 100MBPs DL / 50MBPs UL
    LAN, WAN, DMZ connected

    Intel N100
    Glovary Firewall Mini PC Quad Core N100, DDR5 16GB RAM 256GB NVMe SSD, 6 x 2.5GbE i226V LAN
    325 € @ amazon.de

    Pentium Gold 8505
    HUNSN Intel Pentium Gold 8505, RJ24, AES-NI, 6 x 2.5GbE I226-V, HDMI, DP, USB3.2, Type-C, TF, 16G RAM, 256G SSD
    383 € @ amazon.de

    Pentium Gold 8505 w/ 10 GBit/s ports
    ROUAFWIT Mini PC 10Gbe Firewall Pentium 8505, DDR5 16GB RAM M.2 NVMe 256GB SSD, 2 x 10 Gigabit Ethernet SFP Micro Router Lüfter Gerät Computer, 4 x i226V 2.5GbE LAN
    485 € @ amazon.de

    pfSense supported

    pfSense+ and CE will run on them.

    Netgate is no option, therefore I am searching for any other FW and looking for any experience feedback of other pfSense users running no-name Firewalls.

    Why? If you run pfSense+ on it you may need to pay for a TAC on top!

  • Discussions about collaboratively raising money for a feature. To start a thread you must offer a starting price and be very specific on the feature you would like to see.

    Completed Bounties Expired/Withdrawn Bounties

    Topics

    Posts

    A

    While researching ways to enhance our retail operations, I came across a source that shed light on the importance of choosing the retail software development services. It emphasized how critical it is to partner with developers who understand the unique needs of retail businesses. This advice was incredibly valuable, guiding us towards making informed decisions that have since improved our inventory management and customer service. It's clear that having the right technology partner can make a significant difference in the retail landscape.


  • Topics

    Posts

    jimpJ

    Set Debug in the DHCP6 Client Configuration on WAN as well, then check the logs (main system log, routing log, etc) to see what shows up.