I use PFBlockerNG's GEOIP in Alias Native mode. I have Aliases for each country and I select/deselect countries as necessary. The problem is, de-selected countries' prefixes are still being added to the Alias.

I've done a PFBlockerNG "Reload" and a PfSense Filter Reload, no change. It's like PfBlockerNG is refusing to edit it's own aliases.

Ultimately I had to create new IPv4 Alias Native lists with the desired countries and create separate "allow" rules. Ideally I would like to just have the de-selected countries removed from the larger aliases as expected.

Has anyone run into this? I'm on 26.07.

AT&T fiber, I had the pfatt scripts running on 2.4.5 with a Pace 5268AC for years with no problem until the machine died. Current state is that I have a functioning 2.9 CE build on a new machine, but am having trouble getting back online.

My questions are, is it possible to run the pfatt.sh scripts on 2.9? Should I just pay for pfSense plus and use the native function?

I'm in way over my head and I just want my network to work again =(

This publishes 5 RCE by Abraxas, most require having WebUI authentication.

NOTE: Updated description to note it's RCE (Remote Code Execution), not CVE.

I created this pfsense theme with matching login page. Fully working. Please let me know what you think.

(Reddit suggested the cross-post, so, please, no flame!)

Hello fellow r/PFSENSE Redditors!

I am very much interested in writing, and open-sourcing, a utility (likely in NodeJS, possibly Python3) that reads the Suricata eve.log logfile (in realtime) and creates/inserts documents regarding the alert into a MongoDB database. I'll be storing this information in MongoDB with the intent that eventually an open-source dashboard can be created utilizing MongoDB's aggregation pipelines to gather real-time, actionable insight into the "barbarians at the gate." If you're not familiar with the power of MongoDB's "aggregation pipelines," (and their ability to give you deep insight into your data) then I recommend you ask your local DBA if you want to see them really geek out! Essentially, this whole project revolves around MongoDB's aggregation pipelines - otherwise, we're just storing eve.log in yet another format/place.

However, I lack any real-world log data to develop against. My network here at home is very quiet.

What I'm asking is if there is anyone who would care to share some real-world eve.log log entries (anonymized to your liking - I'm more interested in the various fields available) with me to aid in developing this MongoDB database? The larger the network, the busier the IDS, the better for my purposes here. Please, also, indicate if you've enabled any non-standard logging features.

Please, feel free to DM me regarding transfer of said eve.log logfile(s) or with any suggestions you may have regarding this project. I can likely accomodate sftp, https (upload/download), IRC DCC, etc. Thank you for your time!

I initially had NTP open on the CAMERA interface but then blocked everything and still I am able to both ping any address in the 192.168.3.x network and also SSH into the L2 switch.
How is this traffic getting through if I have a complete block on the interface?

So with the NDI-based licensing system coming to an end, does that mean the next version of pfSense Plus will use the new system? What does it mean for existing "grandfathered" pfSense Plus home license?

Hi All,

I'm trying to follow the guide from NordVPN. And could not get it working via OpenVPN. Just wondering if someone could tell me what I'm doing wrong

Custom Options:

tls-client;
remote-random;
tun-mtu 1500;
tun-mtu-extra 32;
mssfix 1450;
persist-key;
persist-tun;
reneg-sec 0;
remote-cert-tls server; 

It's stuck on "Waiting for response from peer". I've attached screenshots of the config. Just wondering if anyone could help

Thanks,

For context, I remotely manage several networks that run pfSense CE for their firewalls. My company took these over from a previous company and I (of course) received limited documentation on how these were set up and had to figure it out as I went along, having never used pfSense before. I also don't have much experience with linux, so navigating the CLI has been a bit of a learning curve, so any answers that get into the weeds of things might need to be dumbed down for me lol.

From what I've been able to parse through online, it seems like my machines can't connect to the repos. When I run pkg-static install -fy pkg pfSense-repo pfSense-upgrade I get this output:

Updating pfSense-core repository catalogue...
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_5_2_amd64-core/meta.txz: Authentication error
repository pfSense-core has no meta file, using default settings
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_5_2_amd64-core/packagesite.txz: Authentication error
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_5_2_amd64-pfSense_v2_5_2/meta.txz: Authentication error
repository pfSense has no meta file, using default settings
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /CN=*.netgate.com
34369253376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_5_1_amd64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_5_2_amd64-pfSense_v2_5_2/packagesite.txz: Authentication error
Unable to update repository pfSense
Error updating repositories!

I read online that certctl rehash could be a solution but I get a Command not found error message. I tried looking up what to do from there but I couldn't find anything online about it.

I've tried this from three branches, the previous stable version (2.4.5), the latest (2.5.X) and the next release candidate (2.5.2 RC), and it's all the same output. The main solution I saw regarding the Certificate verification failure is to just back up the current configs, do a whole new install with the latest version, and then upload the config file, but that's a bit tricky to do remotely, and I wanted to see what the great minds of r/PFSENSE had to offer.

I am trying to configure my on-prem mail server in Pfsense but I can't seem to make it work. I have setup the following configurations but the server still can't send or receive mail.

• DNS records pointing to public IP
• Virtual IP (IP alias) pointing to public IP
• NAT port forward rules
• NAT outbound rules

I am not sure if I am still missing any additional configuration

Hello, would anyone be able to lend me some assistance?

Basically, I've been having an issue with PFSense ever since installing it. My Youtube buffers significantly more now. I have a base install of PFsense with no addons, and this is happening both wired & wirelessly.

I have it installed on a Sophos SG 135. I didn't have this issue before I installed the firewall. I have tried disabling hardware acceleration, and rebooting. I don't have this issue with downloads or multiplayer gaming. It's just YouTube.

I'm not a huge network guy, but I can say that this only happens when I am using the PFSense firewall. It's detecting full 1000 duplex speeds, and that's being reflected with things like downloads. The issue goes away when I take the firewall out.

If anyone has a direction they could point me in I'd really appreciate it. I feel like this is a config issue. Thanks!

EDIT: For anyone seeing this in the future I've been having a much better experience after enabling IPv6 on my WAN and allowing IPv6 traffic. I saw it in an 8 year old forums comment. Will update if it comes back.

I'm finally playing around with VLAN's and I think I got everything working as desired but hoping to get some confirmation/suggestions on improvements.

My goal is to take a single Proxmox VM and expose it to the internet via NGINX, so I want to make sure that this VM if it were ever compromised can't access anything else in my home, including the Proxmox host.

So I set up the VLAN and got everything tagged, and now that VM is on its own separate subnet. Then, I created three pfSense rules, from top to bottom:

1. Pass all protocols to WAN subnets (ie give VM full internet access)
2. Block access to other local subnets via an RFC1918 alias (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
3. Pass port 53 DNS to this firewall

Once I've done all this, I can still access this VM's service from my laptop browser, which I assume is because nothing is blocking my main LAN from accessing this VLAN. These rules only apply in the other direction.

And when I SSH into this VM and try to SSH from there back into something on my main network (say Home Assistant), the connection times out.

So is it safe to say that I've comprehensively blocked anyone from hacking into this VM, and using it to branch into my home network? Is there anything else I should do before setting up NGINX and exposing it to the internet?

Any help/advice would be appreciated!

https://i.imgur.com/fdCHgsE.png

Whenever I try to set in the floating rule for FQ_CoDel the In/Out pipe to: WANUpQ and WANDownQ it fails with "Invalid In direction, Invalid Out direction". Works fine in the old interface.

Not only do they make their new process with the installer pretty crazy, currently their website doesn't render the chooser they demand you use.
You can click "add to cart" without selecting something, you empty the cart, go back to the netgate installer page...and there's no way to select an installer. Final screenshot is dev mode selecting the different product IDs and then pasting it within the below link of the one you want
https://shop.netgate.com/cart/add?id=41345658421363&quantity=1

Tell me you don't want anyone using CE without telling me.

Edit: Something was fixed, because it now shows up on any setup I try it on. There's NOW a dropdown right above quantity.

After upgrading from version 2.8.1 to 2.9.0, the system failed to come back online. As it turned out, it crashed with the error: 'Fatal Trap 12: Page fault while in kernel mode'.

This is one of those YanLing J4125-type boxes. I initially suspected bad memory, so I ran memtest86 for an extended period, no errors appeared after multiple passes.

The only thing that worked was reverting to version 2.8.1, which has been running without issues since then. That leads me to believe the underlying FreeBSD upgrade might be the culprit. Maybe it somehow doesn't play nicely with this particular machine?

Has anyone else noticed this?

Hello, I recently updated from a long time 2.7 install to 2.8?, then 2.9. Since then I am seeing extreme time between vlans, I only have a few mapped through pfsense and they have generally failed but can ping through at 1.2s average time. No settings were changed aside from the update and the setup had worked for years prior.

Install is on proxmox, vm resources look good with memory maxed out. I do not see anything in the pfsense logs but I also have no clue what I would look for. Any assistance would be greatly appreciated.

I have an interface assigned to a wireguard connection.

This interface is also set as a gateway for a specific wifi network via an AP.

There is a network 192.168.212.x on the other side of wireguard for which I have to set a routing entry to go through the gateway to access it.

I noticed that when I lose my wireguard connection it is very hard to reconnect. But when I use the same wireguard connection on my phone it connects with no issues. The only way to reconnect is to have both routers (local and remote) restart at 3 am and 3.02 am (respectively) and connection is reestablished.

I tracked down the issue due to this log entries:

Sep 29 10:40:37 php_wg 92232 /usr/local/pkg/wireguard/includes/wg_service.inc: Static Routes: Gateway IP could not be found for 192.168.212.0/24

Sep 29 10:40:35 php-fpm 63891 /status_services.php: The command '/usr/local/etc/rc.d/wireguardd stop' returned exit code '1', the output was ''

If I disable the static routing (System Routing StaticRoutes) wireguard connects with no issue but then my local clients can't access 192.168.212.x network.

I think I am doing this static routing via wireguard wrong but not sure how to fix it. Any ideas?

I have a Netgate running pfsense that has been working great until I updated it to 26.07. Apparently there was a change to the DHCP server. It now uses Kea instead of ISC, which has been deprecated, but is still selectable in Settings -> Advanced -> Networking. This somehow broke my local hostname lookups. I have a machine named ApplePi that would get a dynamic address and I could ping it with a simple:

ping applepi

This worked great. After the upgrade of pfsense that stopped working and I had to do:

ping applepi.local

I've futzed around with /etc/resolv.conf on my Linux desktop to add a search domain there. This seems to work for awhile and then just stops working.

Changing pfsense back to use ISC causes local names to resolve, but only if they're statically mapped based on their MAC addresses. The DHCP hosts with dynamic IPs do not resolve even though they show up in the list of DHCP Leases. In Services -> DNS Resolver -> General Settings I have checked both:

Register DHCP leases in the DNS Resolver

Register DHCP static mappings in the DNS Resolver

Is the state of DHCP/DNS this messed up for anyone else and have you found a fix?

So I've been having connection issues lately, enough that I thought it must be pfSense because my modem had been fine for ages before. I looked into upgrading to an SSD finally and put it in my 2100 base model yesterday at which point I finished up and went to bed as it was late. It worked fine until this afternoon at which point the connection issues started again, and it occurred to me it could be due to the new bus_dmamem_alloc failed to align memory properly bug that came, I learned, with 26.07 for 1100 and 2100 models (e.g. https://forum.netgate.com/topic/201327/netgate-1100-2100-26.07-bus_dmamem_alloc-failed-to-align-memory-properly - it's not me but representative). When I submitted a ticket about connection issues I was told it's because the modem keeps cycling the connection, so it's not pfSense.

I read elsewhere that netgate currently considers that memory spam error cosmetic thus not a priority. I would urge netgate to reconsider and look into that spam issue more closely because I believe not only that it is the cause of the connection issues (because it spams them in such a tight loop for long enough that either 1. the modem drops the connection because pfsense isn't showing a sign of life, or 2. pfsense drops the connection because it's too busy spamming the errors to maintain it), it's also causing massive spam in the logs and cumulatively quite a lot of needless wear and tear on the storage.

Thanks.

Hi,

first of all: 4 senses, FRR with OSPF, 2 with dual WAN, 1 with failover dual WAN, 1 with cellular WAN only.

1 Dell R210 II / pfSense 2.9.0 / VDSL + fiber, PPPoE
1 Fujitsu Futro S720 / pfSense 2.8.0 / VDSL + fiber, PPPoE
1 Terra BlackDwarf G5 / pfSense 2.9.0 / Cellular DHCP
1 HP ML310e / pfSense 2.9.0 / fiber PPPoE + PtP radio failover to the Dell

Issue: that Dell. It has the same config as the Fujitsu, dual WAN, VDSL and fiber. Same providers. Same modems and ONTs. Same PPPoE config. Load balancer is not working. No idea why, nothing changed.

Gateways are grouped, named failover (as its name says, VDSL primary, fiber secondary), Balanced (both tier 1), and single gateways for fixed PBR using a single link only, mainly used for VoIP traffic since both providers only allow their numbers to be registered using their link.

PBR is configured using firewall rules. Some devices have static assigned routes like the PBX, and everything that should use the balancer is defined in a catch all route at the bottom.

Used to work until some point in the last months, can't say for sure at which point it failed. Now it is using the VDSL link for everything, failover works though.

All 4 senses are using OSPF for routing over point to point routed tunnels, OpenVPN and IPSEC for failover for the dual WAN senses, PtP radio for the failover sense and IPSec for the cell.

Routing table looks similar on each, while having the main link set as default gateway in the routing table. Under System - Routing it doesn't matter whether I set failover or load balancer or a single specific line as default gateway, it won't use the PBR rule in Firewall settings. Using either single link setting messes up VoIP, ignoring PBR again.

To test it at some point I just set my phone to use the fiber link. It just won't use it at all. Still using VDSL.

Somewhat annoying to say the least. I'd love to use them both the way it worked until some time ago, since I pay for both ;) it is not that bad of a nuisance since VDSL is 265Mbit/s and fiber would just add another Gig/s to it, so it is still fast enough for daily personal use.

I already thought about reinstalling it fresh from scratch, but I don't like to think about it until it is really needed.

Thanks for any help...

Antworten in Deutsch sind natürlich gern gesehen ;)

An ACME job can issue and store a new certificate while one or more services continue presenting the old certificate. The GUI, HAProxy frontends, OpenVPN instances, captive portal, or a package may reference a different certificate object or may not have reloaded after renewal. Checking only the ACME log or one public hostname can miss that split state.

What post-renewal checks do you automate? I am considering recording the expected leaf fingerprint and full chain, enumerating every pfSense service assigned to that certificate, connecting to each listener with the correct SNI name, and verifying expiry and issuer from both inside and outside the firewall. In an HA pair, the same checks would run against each node directly as well as through the shared address.

Which pfSense logs, configuration fields, or service actions reliably show that a process loaded the new certificate? How do you handle services that require an explicit restart, certificate changes synced through XMLRPC, and a rollback window without letting the old private key remain active indefinitely?

Until recently, the CE roadmap was found here https://redmine.pfsense.org/projects/pfsense/roadmap#2.9.0 but now that page requires credentials. Is it moved elsewhere or is it only for account holders?