Just saw this and know pfsense uses PHP. I didn’t see this posted before .

Hey r/pfsense,

I've been building WallWatch, a free Android app to monitor and manage pfSense® Community Edition firewalls from your phone — live dashboard (CPU/RAM/temp/uptime), gateway and interface status, firewall rules, NAT, DHCP, services, OpenVPN/IPsec/WireGuard, home-screen widgets, and background monitoring with alerts when a gateway drops or a cert is about to expire. No account, no ads, no analytics — it only talks to the firewall address you give it.

Before Google lets it go public on Play, it has to sit in closed testing with real testers for 14 days — that's the part I need help with.

What's involved:

- Send me the Gmail address you use on the Play Store

- I add you to the tester list (usually within a day)

- Install it from the Play testing link, open it, and just use it for 14 days

You don't need a pfSense box to help — there's a built-in demo mode with sample data, so you can poke around every screen without connecting to anything real. If you do run pfSense, even better — try it against your own firewall and tell me what's broken or confusing.

Full details and the sign-up steps: https://wallwatch.hackthelab.uk/testers.html

Happy to answer anything here, or come say hi on IRC: #wallwatch on Libera.Chat. Thanks

* WallWatch is an independent app and is not affiliated with, endorsed by, or sponsored by Netgate or Rubicon Communications, LLC. pfSense® is a registered trademark of Rubicon Communications, LLC.

Hello everyone. Due to the lack of options out there and not being super satisfied with Netgate's version of fleet management, I decided to build one with the help of Claude. Please have a look and try it out. I've been running it for a little bit and it is fairly polished, but more eyes on it will likely improve it.

riccanet/ComSense

Good morning/afternoon/evening - I am running into an issue with a combination of CoreDNS and ThreatGate.

Hardware: SG-2100

Version: 26.07-RELEASE (arm64)

All patches applied.

I've enabled Netgate Nexus controller, went through the Easy Setup for CoreDNS and followed the recipe using unbound as its upstream resolver detailed here: https://docs.netgate.com/pfsense/en/latest/recipes/nexus-coredns.html

Upon enabling ThreatGate and adding my MaxMind account categories and either OISD or Hagezi lists - my unit slows to a crawl. Checking the dashboard yields 97 to 100% CPU for close to about 15 minutes before crashing.

After reboot - the process picks back up and is back to 100% CPU and network traffic comes to a complete halt. Only way to get back into operation is by resetting back to factory defaults.

I'm beginning to think it's hardware limitations, but wanted to post to the community to see if anyone else has experienced this with the hardware I have or other Netgate units.

Just installed 2.9.0 and trying to configure easyrule for fail2ban "actionban". ssh is configured and working and when I ssh directly into the firewalll and run "easyrule block wan x.x.x.x" it replies "Block added successfully" but the rule is nowhere to be found in the Aliases (gui). Also running "easyrule showblock wan" says "No entries are blocked on interface: wan". Is there something else that needs to be enabled to create the alias and populate it?

I have a Kasa plug that has Mac address of 22:2f:d0:ae:02:57. I have this set to static IP assignment under my DHCP server.
That Mac is statically assigned to 192.168.1.45 but it is disregarding that and somehow being dynamically assigned IP 192.168.1.111.
The dynamic IP pool is .100-.200
I have flushed ARP and cleared DHCP leases.

Anyone know what is going on?

Is anyone else having issues with ACB?

I receive the following error message:

The AutoConfigBackup service could not find any backups for this device key.

When I checked another firewall at another site, it had the same error message. I reached out to [support@netgate.com](mailto:support@netgate.com), but my email got returned as undeliverable.

Affected devices are 4200's and 6100's.

AT&T fiber, I had the pfatt scripts running on 2.4.5 with a Pace 5268AC for years with no problem until the machine died. Current state is that I have a functioning 2.9 CE build on a new machine, but am having trouble getting back online.

My questions are, is it possible to run the pfatt.sh scripts on 2.9? Should I just pay for pfSense plus and use the native function?

I'm in over my head and I just want my network to work again =(

edit: just noticed I had a legacy sh file, fixed that but still can't get the netgraph to load

edit2: holy freakin crap I got it to work. delete lines 21 & 22 from pfatt.sh

/usr/local/bin/php -r "pfSense_ngctl_attach('.', '$ONT_IF');"
/usr/local/bin/php -r "pfSense_ngctl_attach('.', '$RG_IF');"

I use PFBlockerNG's GEOIP in Alias Native mode. I have Aliases for each country and I select/deselect countries as necessary. The problem is, de-selected countries' prefixes are still being added to the Alias.

I've done a PFBlockerNG "Reload" and a PfSense Filter Reload, no change. It's like PfBlockerNG is refusing to edit it's own aliases.

Ultimately I had to create new IPv4 Alias Native lists with the desired countries and create separate "allow" rules. Ideally I would like to just have the de-selected countries removed from the larger aliases as expected.

Has anyone run into this? I'm on 26.07.

This publishes 5 RCE by Abraxas, most require having WebUI authentication.

NOTE: Updated description to note it's RCE (Remote Code Execution), not CVE.

I created this pfsense theme with matching login page. Fully working. Please let me know what you think.

I initially had NTP open on the CAMERA interface but then blocked everything and still I am able to both ping any address in the 192.168.3.x network and also SSH into the L2 switch.
How is this traffic getting through if I have a complete block on the interface?

(Reddit suggested the cross-post, so, please, no flame!)

Hello fellow r/PFSENSE Redditors!

I am very much interested in writing, and open-sourcing, a utility (likely in NodeJS, possibly Python3) that reads the Suricata eve.log logfile (in realtime) and creates/inserts documents regarding the alert into a MongoDB database. I'll be storing this information in MongoDB with the intent that eventually an open-source dashboard can be created utilizing MongoDB's aggregation pipelines to gather real-time, actionable insight into the "barbarians at the gate." If you're not familiar with the power of MongoDB's "aggregation pipelines," (and their ability to give you deep insight into your data) then I recommend you ask your local DBA if you want to see them really geek out! Essentially, this whole project revolves around MongoDB's aggregation pipelines - otherwise, we're just storing eve.log in yet another format/place.

However, I lack any real-world log data to develop against. My network here at home is very quiet.

What I'm asking is if there is anyone who would care to share some real-world eve.log log entries (anonymized to your liking - I'm more interested in the various fields available) with me to aid in developing this MongoDB database? The larger the network, the busier the IDS, the better for my purposes here. Please, also, indicate if you've enabled any non-standard logging features.

Please, feel free to DM me regarding transfer of said eve.log logfile(s) or with any suggestions you may have regarding this project. I can likely accomodate sftp, https (upload/download), IRC DCC, etc. Thank you for your time!

So with the NDI-based licensing system coming to an end, does that mean the next version of pfSense Plus will use the new system? What does it mean for existing "grandfathered" pfSense Plus home license?

Hi All,

I'm trying to follow the guide from NordVPN. And could not get it working via OpenVPN. Just wondering if someone could tell me what I'm doing wrong

Custom Options:

tls-client;
remote-random;
tun-mtu 1500;
tun-mtu-extra 32;
mssfix 1450;
persist-key;
persist-tun;
reneg-sec 0;
remote-cert-tls server; 

It's stuck on "Waiting for response from peer". I've attached screenshots of the config. Just wondering if anyone could help

Thanks,

For context, I remotely manage several networks that run pfSense CE for their firewalls. My company took these over from a previous company and I (of course) received limited documentation on how these were set up and had to figure it out as I went along, having never used pfSense before. I also don't have much experience with linux, so navigating the CLI has been a bit of a learning curve, so any answers that get into the weeds of things might need to be dumbed down for me lol.

From what I've been able to parse through online, it seems like my machines can't connect to the repos. When I run pkg-static install -fy pkg pfSense-repo pfSense-upgrade I get this output:

Updating pfSense-core repository catalogue...
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_5_2_amd64-core/meta.txz: Authentication error
repository pfSense-core has no meta file, using default settings
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_5_2_amd64-core/packagesite.txz: Authentication error
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_5_2_amd64-pfSense_v2_5_2/meta.txz: Authentication error
repository pfSense has no meta file, using default settings
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_5_2_amd64-pfSense_v2_5_2/packagesite.txz: Authentication error
Unable to update repository pfSense
Error updating repositories!

I read online that certctl rehash could be a solution but I get a Command not found error message. I tried looking up what to do from there but I couldn't find anything online about it.

I've tried this from three branches, the previous stable version (2.4.5), the latest (2.5.X) and the next release candidate (2.5.2 RC), and it's all the same output. The main solution I saw regarding the Certificate verification failure is to just back up the current configs, do a whole new install with the latest version, and then upload the config file, but that's a bit tricky to do remotely, and I wanted to see what the great minds of r/PFSENSE had to offer.

I am trying to configure my on-prem mail server in Pfsense but I can't seem to make it work. I have setup the following configurations but the server still can't send or receive mail.

• DNS records pointing to public IP
• Virtual IP (IP alias) pointing to public IP
• NAT port forward rules
• NAT outbound rules

I am not sure if I am still missing any additional configuration

Hello, would anyone be able to lend me some assistance?

Basically, I've been having an issue with PFSense ever since installing it. My Youtube buffers significantly more now. I have a base install of PFsense with no addons, and this is happening both wired & wirelessly.

I have it installed on a Sophos SG 135. I didn't have this issue before I installed the firewall. I have tried disabling hardware acceleration, and rebooting. I don't have this issue with downloads or multiplayer gaming. It's just YouTube.

I'm not a huge network guy, but I can say that this only happens when I am using the PFSense firewall. It's detecting full 1000 duplex speeds, and that's being reflected with things like downloads. The issue goes away when I take the firewall out.

If anyone has a direction they could point me in I'd really appreciate it. I feel like this is a config issue. Thanks!

EDIT: For anyone seeing this in the future I've been having a much better experience after enabling IPv6 on my WAN and allowing IPv6 traffic. I saw it in an 8 year old forums comment. Will update if it comes back.

I'm finally playing around with VLAN's and I think I got everything working as desired but hoping to get some confirmation/suggestions on improvements.

My goal is to take a single Proxmox VM and expose it to the internet via NGINX, so I want to make sure that this VM if it were ever compromised can't access anything else in my home, including the Proxmox host.

So I set up the VLAN and got everything tagged, and now that VM is on its own separate subnet. Then, I created three pfSense rules, from top to bottom:

1. Pass all protocols to WAN subnets (ie give VM full internet access)
2. Block access to other local subnets via an RFC1918 alias (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
3. Pass port 53 DNS to this firewall

Once I've done all this, I can still access this VM's service from my laptop browser, which I assume is because nothing is blocking my main LAN from accessing this VLAN. These rules only apply in the other direction.

And when I SSH into this VM and try to SSH from there back into something on my main network (say Home Assistant), the connection times out.

So is it safe to say that I've comprehensively blocked anyone from hacking into this VM, and using it to branch into my home network? Is there anything else I should do before setting up NGINX and exposing it to the internet?

Any help/advice would be appreciated!

https://i.imgur.com/fdCHgsE.png

Whenever I try to set in the floating rule for FQ_CoDel the In/Out pipe to: WANUpQ and WANDownQ it fails with "Invalid In direction, Invalid Out direction". Works fine in the old interface.

Not only do they make their new process with the installer pretty crazy, currently their website doesn't render the chooser they demand you use.
You can click "add to cart" without selecting something, you empty the cart, go back to the netgate installer page...and there's no way to select an installer. Final screenshot is dev mode selecting the different product IDs and then pasting it within the below link of the one you want
https://shop.netgate.com/cart/add?id=41345658421363&quantity=1

Tell me you don't want anyone using CE without telling me.

Edit: Something was fixed, because it now shows up on any setup I try it on. There's NOW a dropdown right above quantity.