Questions tagged [pfsense]
pfsense is a customized FreeBSD+pf distribution designed for use as a firewall. It wraps many of the features of the pf firewall code in an easy-to-use web interface.
846
questions
1
vote
1
answer
342
views
Danger of leaked PSK (password) in IPsec tunnel
Let us say I have a IPSEC tunnel between a Pfsense firewall and a Cisco firewall. In the Pfsense panel, when configuring a Site-to-site VPN between them, there is a PSK which is common in both ends, ...
1
vote
1
answer
4k
views
Where are the logs for pfSense's dynamic DNS client?
In the pfSense web interface, under Services -> Dynamic DNS -> Dynamic DNS Clients -> Edit, there is a checkbox labeled "Enable verbose logging", which the pfSense docs claims to &...
3
votes
2
answers
3k
views
OPNsense WAN failover causes disruption when non-active WAN is down
I have the latest version of OPNsense set up in a VM on ESXi 7. OPNsense is very similar to pfSense, and I suspect the solution would apply to both. All the NICs are PCI passthrough devices:
A ...
0
votes
1
answer
3k
views
pfSense view allowed/permitted log
I've just installed pfSense and noticed that it only log "blocked" traffic.
*Image taken from https://docs.netgate.com/pfsense/en/latest/monitoring/logs/firewall.html
How do I enable "...
0
votes
1
answer
2k
views
HAProxy send-proxy to Nginx
I am trying to reverse proxy clients to a web server through HAProxy and Nginx with SSL traffic using SNI. With the standard configuration, the web server sees the HAProxy IP and connects. When ...
3
votes
0
answers
574
views
Need help configuring BIND on Pfsense as an authoritative DNS Server
For a few weeks now I've tried configuring BIND Server on my Pfsense Router as an authoritative DNS Server.
I own a domain bought from RoTLD, I've set my nameservers to my external static ip, and they ...
0
votes
2
answers
285
views
Isolate high risk terminals from the rest of a subnet
I have a secure subnet 172.20.40.0/24 but I have terminals where security can't be guaranteed and I have no control over protocol (Exam rooms, external user access). I'd like to set these up on a ...
0
votes
0
answers
192
views
How to implement firewall to grant network access for VPN users as-needed (per-user principle of least privilege, OpenVPN)
How can I setup OpenVPN in conjunction with my firewall in such a way that my VPN users' traffic is DROPed by default to all network resources, and only ACCEPTed through the firewall if that user ...
1
vote
2
answers
5k
views
Offloading PPPoE from an OPNsense router
I'm running opnSense, a FreeBSD-based firewall and router similar to pfSense, in a virtual machine under VMware ESXi 7 on a Dell PowerEdge R230, as a router for my home network. No other VMs are ...
0
votes
1
answer
767
views
pfSense OpenVPN on AWS VPC
We are in the process of migrating our office servers to AWS to finally decommission. Since we are familiar with pfSense, we are using a mix of AWS services but want to use pfSense as a the OpenVPC ...
0
votes
1
answer
417
views
Is IP Forwarding possible for OpenVPN using pfSense on Google Cloud Platform?
I have a scenario with a pfSense machine (subnet x.x.0.0) on GCP, IPSEC vpn with 10 Site-to-Site is working normal but OpenVPN is not, the struggle resides in routing the packets through OpenVPN ...
0
votes
1
answer
675
views
Pfsense OpenVPN : Why is a client IP used as a gateway?
I am wondering why a client IP (172.21.0.2) is used as a Gateway for the OpenVPN subnet (172.21.0.0/20) ? This IP is attributed to the first client connected.
Note that I did not encounter any issue ...
0
votes
1
answer
28
views
deploy a vpn from an appliance
I have a client (for our SOC) whos home is protected by a PAN 200 firewall (palto alto) but doesnt have a static ip address. The issue Im facing is how to send all the logs to our vps without having ...
-2
votes
1
answer
359
views
Firewall rules does not apply to pfsense hosted machine [closed]
I am using pfsense as my home firewall and configured multi-wan setup.
In addition, I have installed package 'Telegraf ' package for exporting my pfsense stats into InfluxDB, also in 'Telegraf' ...
0
votes
1
answer
245
views
xinetd doesn't read "included directory"
I want to monitor my pfSense-Box with check_mk. Therefore I need access to a certain port via xinetd. I found a descripton for that in:
https://forum.netgate.com/topic/99612/pfsense-2-3-check_mk-...
1
vote
0
answers
961
views
IPSec tunnel with pfSense networking issues
I'm having networking issues with a pfSense appliance launched from AWS market place. The network looks something like this:
We connect to our customer checkpoint appliance. They require that we ...
1
vote
0
answers
90
views
How can I configure outer and inner PFSense boxes to allow specific traffic to pass, and so devices can ping each other?
I have the following infrastructure currently set up, with colors for what I would like to achieve:
The outer pfsense (EDGE) is currently providing a DMZ to the public and OpenVPN to our road ...
0
votes
0
answers
545
views
bbb behind pfsense/firewall/nat
I have a virtualized server with 5 vm, and I have one domain and only 2 public IP (can not buy more IP).
vm1: pfsense, eth1: public IP x.x.x.x, eth2: local IP: 10.0.0.1
vm2, vm3, vm4, vm5 (is empty)
...
0
votes
1
answer
361
views
Pfsense open port to internet connection
I switched from Ubuntu to pfsense. Which ports and how to open the internet to work?
If I do any (the last rule works) but that's not what I want. i just want to open (53,80,443)
Pfsense
Ubuntu ...
1
vote
1
answer
380
views
Forest trust relationship between WAN and LAN through Pfsense
I'm using Pfsense with 3 interfaces : LAN, DMZ and WAN. The LAN contains my Domain Controller and my main forest of course (abc.com), the DMZ contains some web servers. The other forest is located ...
0
votes
0
answers
265
views
IPSec Phase 2 Configuration For Translated Subnets?
I have two networks with the 10.0.0.0/8 subnet I'm trying to connect via IPSec tunnels. I have the phase 1 configurations working but am a bit stuck on the phase 2 configurations. Each firewall used ...
0
votes
1
answer
298
views
Openvpn site-to-site: cannot access remote network, remote network can access local
I have poured over so many suggestions and spent so many hours (upon hours) on this and simply cannot come up with why a specific vpn connection is only one-sided.
I have a centos aws ec2 server (...
0
votes
1
answer
2k
views
pfSense - Port forward through site-to-site VPN
I'm trying to solve a problem on my setup, and kindly ask your help.
This is the scenario.
Site 1
Internet connection via 4G/LTE provider, with natted connection
pfSense firewall
172.20.0.0/25 LAN ...
0
votes
0
answers
155
views
How to connect 2 IPSec sites with each other via the "main site"
First of all, i'm originally a software engineer with some network knowledge so no network specialist. At my current job i'm also responsable for the network. I say this because it may be a bit stupid ...
0
votes
1
answer
2k
views
Pfsense DNS port-forwarding
I've encountered a problem when port-forwarding a DNS server using PFSense. I've pf'd many services on this same firewall, only am I unable to port forward a DNS server.
DIG dns using local address:
...
1
vote
1
answer
400
views
kernel message, who knows what this means
kernel: [2427107.300793] traps: ATA-0 [27274] trap int3 ip:7f2c48115064 sp:7f2c22e9ad90 error:0 in VBoxDD.so[7f2c480ec000+155000]
the message is recorded in the virtualbox host system
when this comes ...
0
votes
1
answer
60
views
Give internet Access to my local network users
I have local network 10.10.10.0/24 and have pfsense. I use the pfsense for OpenVPN. Users connecting servers via vpn but users server ip addresses from local area network (ex. 10.10.10.30) that is why ...
0
votes
1
answer
603
views
How to specify an IP range representing "any IP" within a Pfsense alias?
I've restricted the source IP of many rules to some alias, say Trusted_Sources.
Now, for some reason, I want to open all these rules to the world without manually modifying each individual rule.
How ...
0
votes
1
answer
5k
views
How to allow traffic only to the internet in pfSense?
Given the following network diagram:
internet
|
|
+--------+--------+
| |
dmz2 ----+ ...
-2
votes
1
answer
155
views
VMware ESXI - External PCI Ethernet Card [closed]
I have a beast of a home server and don’t fancy purchasing another device just to learn PFSense on my network. My server only has 1 Ethernet port, I have an external PCI card I bought off from amazon ...
1
vote
0
answers
452
views
pfSense: unable to configure 1:1 NAT to a remote IPSec
I'm having a hard time figuring out how to configure 1:1 NAT between my local LAN and a remote subnet connected through IPSec.
I have a fresh install of pfSense-2.4.5p1, with a public IPv4 on WAN and ...
6
votes
1
answer
4k
views
Rearrange pfSense interface order
I want to organize a pfSense firewall that I got already running and the first thing is the interface order.
I know that pfSense is a little bit harsh when coming to rearrange things, but I would like ...
0
votes
1
answer
726
views
Cannot ping a certain IP address from machine within certain IP range?
I am a bit new to networking so I have probably done something wrong that is a simple oversight. I used to use an normal TP-Link router/switch combo jobs and an internal network range of 10.0.0.0/22. ...
1
vote
1
answer
740
views
hetzner private network, 1 docker host, 1 pfsense, I keep getting "TCP Previous segment not captured" from my containers
this is the network design
https://imagebin.ca/v/5NNDpuDwq9PT
it's hosted on hetzner, 1 firewall with a public facing interface, pfsense.
1 docker host with two interfaces, one connected to the ...
1
vote
0
answers
293
views
PFSense HAProxy DNS Rebind
I have installed PFSense and HAProxy Package behind Provider router with On Public IP, when trying to redirect all HTTP/HTTPS traffic to ip assigned to PFSense,
I am getting HAProxy Front Ends ...
2
votes
2
answers
7k
views
Haproxy log file with pfsense
I am trying to read the /var/log/haproxy.log file with the command: clog -f haproxy.log but nothing happens. No window opens. How do I see my error log? I’m on pfsense.
0
votes
1
answer
2k
views
How should certificates for multiple separate sub-domain servers be issued/renewed with Let's Encrypt?
Upgrading my home infrastructure to learn as well as be more secure, I have not been able to find out how best to get certificate(s) issues and installed across my servers, which comprise:
Firewall (...
0
votes
1
answer
682
views
pfsense OpenVPN client address issue
First VPN client works like a charm (tunnel is 192.168.104.0/24 -> 192.168.104.2 assigned).
But once another client logs on an identical IP is assigned.
It looks there is no address pool to be defined!...
0
votes
1
answer
376
views
BIND9/DNS lookups stopped working after upgrading our Comcast modem/gateway
OK here's our setup, we're running pfSense as our firewall/router. We have a dual-WAN with a Comcast Business Gateway and another local ISP. We're running Samba as the domain controller & Bind9/...
0
votes
1
answer
472
views
ESXi vmkernel web gui issue
I have ESXi 6.7 running with pfSense on it as a virtualised router.
pfSense, ESXi and other devices are on management VLAN 10. User devices are on different VLANs (lets assume 20 for now).
pfSense ...
0
votes
1
answer
2k
views
Pfsense and Dns Resolver - SSL/TLS for internal access?
I have a Pfsense box that is able to issue/renew acme certificates, with haproxy installed, that has two backend servers that use the generated acme certificate that works fine.
(email and nextcloud ...
1
vote
1
answer
885
views
pfSense on ESXi VLAN and interface definition dilemma
I'm trying to set up a virtualised pfSense router in ESXi on a Dell server. After many hours of reading, experimenting, watching Youtube videos etc, I'm close to pulling my hairs out...
The setup:
- ...
1
vote
1
answer
378
views
How large does site-to-site VPN subnet need to be?
Users on the data VLAN in our HQ and future remote office(s) will need to access files, floating network licenses etc. from distant servers, so we will need a site-to-site VPN for the data network(s). ...
0
votes
1
answer
114
views
freebsd packet filter match last digit of IP address
On my freebsd system I want to use port forwarding to distribute incoming traffic, based on the last digit of the source IP.
The following works on linux with iptables:
iptables -t nat -A ...
4
votes
1
answer
28k
views
What do the following mean: TCP:RA, TCP:FA ,TCP:PA, TCP:S, TCP:SEC
I'm specifically looking for a definition of what the following mean: TCP:RA, TCP:FA ,TCP:PA, TCP:S, TCP:SEC
The context is that I'm looking at some pfSense logs which are showing rejected packets by ...
0
votes
1
answer
561
views
Reverse proxy using haproxy redirection of node-red dashboard
I have multiple node-red servers running behind a HAProxy reverse proxy which runs as apart of a pfSense box.
I want to access different node-red instances by accessing the pfSense box at different ...
0
votes
0
answers
233
views
OpenVPN Server/Client Setup - Clients on both sides can't reach each other
I am hoping that someone can assist me with this issue, as it's kinda boggling my mind. The base-level issue is that clients on both side of an OpenVPN tunnel cannot talk to eachother. The goal is ...
3
votes
1
answer
4k
views
Kubernetes + Rancher: multiple VLANs
I intend to deploy a k8s + Rancher cluster on my local network, but my environment has several VLANs, with pfsense acting as a firewal and router between such VLANs.
My cluster resides in XCP-NG as a ...
4
votes
1
answer
2k
views
SSH Client freeze connect to SSH server with multiple network interface
Case 1: SSH host has ONE network interface
Routing table for host SSH:
[SSH] $ ip route
default via 192.168.211.1 dev eth0
192.168.211.0/24 dev eth0 proto kernel scope link src 192.168.211.119
...
1
vote
3
answers
1k
views
Is it possible to apply firewall on LAN to LAN packets with just PfSense and a layer 2 switch?
Is it possible to apply firewall rules on LAN to LAN packets?
Imagine the following architecture:
To get a valid IP, the clients must authenticate to PfSense LAN network using 802.1x against the ...