Questions tagged [pfsense]

pfsense is a customized FreeBSD+pf distribution designed for use as a firewall. It wraps many of the features of the pf firewall code in an easy-to-use web interface.

Filter by
Sorted by
Tagged with
1 vote
1 answer
342 views

Danger of leaked PSK (password) in IPsec tunnel

Let us say I have a IPSEC tunnel between a Pfsense firewall and a Cisco firewall. In the Pfsense panel, when configuring a Site-to-site VPN between them, there is a PSK which is common in both ends, ...
Ricardo Ruiz's user avatar
1 vote
1 answer
4k views

Where are the logs for pfSense's dynamic DNS client?

In the pfSense web interface, under Services -> Dynamic DNS -> Dynamic DNS Clients -> Edit, there is a checkbox labeled "Enable verbose logging", which the pfSense docs claims to &...
Ajedi32's user avatar
  • 177
3 votes
2 answers
3k views

OPNsense WAN failover causes disruption when non-active WAN is down

I have the latest version of OPNsense set up in a VM on ESXi 7. OPNsense is very similar to pfSense, and I suspect the solution would apply to both. All the NICs are PCI passthrough devices: A ...
user3466413's user avatar
0 votes
1 answer
3k views

pfSense view allowed/permitted log

I've just installed pfSense and noticed that it only log "blocked" traffic. *Image taken from https://docs.netgate.com/pfsense/en/latest/monitoring/logs/firewall.html How do I enable "...
Wolf's user avatar
  • 211
0 votes
1 answer
2k views

HAProxy send-proxy to Nginx

I am trying to reverse proxy clients to a web server through HAProxy and Nginx with SSL traffic using SNI. With the standard configuration, the web server sees the HAProxy IP and connects. When ...
Brailyn's user avatar
3 votes
0 answers
574 views

Need help configuring BIND on Pfsense as an authoritative DNS Server

For a few weeks now I've tried configuring BIND Server on my Pfsense Router as an authoritative DNS Server. I own a domain bought from RoTLD, I've set my nameservers to my external static ip, and they ...
Andrei Nicola's user avatar
0 votes
2 answers
285 views

Isolate high risk terminals from the rest of a subnet

I have a secure subnet 172.20.40.0/24 but I have terminals where security can't be guaranteed and I have no control over protocol (Exam rooms, external user access). I'd like to set these up on a ...
bumble_bee_tuna's user avatar
0 votes
0 answers
192 views

How to implement firewall to grant network access for VPN users as-needed (per-user principle of least privilege, OpenVPN)

How can I setup OpenVPN in conjunction with my firewall in such a way that my VPN users' traffic is DROPed by default to all network resources, and only ACCEPTed through the firewall if that user ...
Michael Altfield's user avatar
1 vote
2 answers
5k views

Offloading PPPoE from an OPNsense router

I'm running opnSense, a FreeBSD-based firewall and router similar to pfSense, in a virtual machine under VMware ESXi 7 on a Dell PowerEdge R230, as a router for my home network. No other VMs are ...
user3466413's user avatar
0 votes
1 answer
767 views

pfSense OpenVPN on AWS VPC

We are in the process of migrating our office servers to AWS to finally decommission. Since we are familiar with pfSense, we are using a mix of AWS services but want to use pfSense as a the OpenVPC ...
pgb's user avatar
  • 455
0 votes
1 answer
417 views

Is IP Forwarding possible for OpenVPN using pfSense on Google Cloud Platform?

I have a scenario with a pfSense machine (subnet x.x.0.0) on GCP, IPSEC vpn with 10 Site-to-Site is working normal but OpenVPN is not, the struggle resides in routing the packets through OpenVPN ...
DR. Congo's user avatar
0 votes
1 answer
675 views

Pfsense OpenVPN : Why is a client IP used as a gateway?

I am wondering why a client IP (172.21.0.2) is used as a Gateway for the OpenVPN subnet (172.21.0.0/20) ? This IP is attributed to the first client connected. Note that I did not encounter any issue ...
cyberhippo's user avatar
0 votes
1 answer
28 views

deploy a vpn from an appliance

I have a client (for our SOC) whos home is protected by a PAN 200 firewall (palto alto) but doesnt have a static ip address. The issue Im facing is how to send all the logs to our vps without having ...
David's user avatar
  • 11
-2 votes
1 answer
359 views

Firewall rules does not apply to pfsense hosted machine [closed]

I am using pfsense as my home firewall and configured multi-wan setup. In addition, I have installed package 'Telegraf ' package for exporting my pfsense stats into InfluxDB, also in 'Telegraf' ...
JavaMachine's user avatar
0 votes
1 answer
245 views

xinetd doesn't read "included directory"

I want to monitor my pfSense-Box with check_mk. Therefore I need access to a certain port via xinetd. I found a descripton for that in: https://forum.netgate.com/topic/99612/pfsense-2-3-check_mk-...
karls0's user avatar
  • 1
1 vote
0 answers
961 views

IPSec tunnel with pfSense networking issues

I'm having networking issues with a pfSense appliance launched from AWS market place. The network looks something like this: We connect to our customer checkpoint appliance. They require that we ...
JuanXarg's user avatar
  • 123
1 vote
0 answers
90 views

How can I configure outer and inner PFSense boxes to allow specific traffic to pass, and so devices can ping each other?

I have the following infrastructure currently set up, with colors for what I would like to achieve: The outer pfsense (EDGE) is currently providing a DMZ to the public and OpenVPN to our road ...
Ole Aldric's user avatar
0 votes
0 answers
545 views

bbb behind pfsense/firewall/nat

I have a virtualized server with 5 vm, and I have one domain and only 2 public IP (can not buy more IP). vm1: pfsense, eth1: public IP x.x.x.x, eth2: local IP: 10.0.0.1 vm2, vm3, vm4, vm5 (is empty) ...
m.Azadi's user avatar
0 votes
1 answer
361 views

Pfsense open port to internet connection

I switched from Ubuntu to pfsense. Which ports and how to open the internet to work? If I do any (the last rule works) but that's not what I want. i just want to open (53,80,443) Pfsense Ubuntu ...
Mantykora 7's user avatar
1 vote
1 answer
380 views

Forest trust relationship between WAN and LAN through Pfsense

I'm using Pfsense with 3 interfaces : LAN, DMZ and WAN. The LAN contains my Domain Controller and my main forest of course (abc.com), the DMZ contains some web servers. The other forest is located ...
Milorn Ovivias's user avatar
0 votes
0 answers
265 views

IPSec Phase 2 Configuration For Translated Subnets?

I have two networks with the 10.0.0.0/8 subnet I'm trying to connect via IPSec tunnels. I have the phase 1 configurations working but am a bit stuck on the phase 2 configurations. Each firewall used ...
CoryG's user avatar
  • 101
0 votes
1 answer
298 views

Openvpn site-to-site: cannot access remote network, remote network can access local

I have poured over so many suggestions and spent so many hours (upon hours) on this and simply cannot come up with why a specific vpn connection is only one-sided. I have a centos aws ec2 server (...
scape's user avatar
  • 365
0 votes
1 answer
2k views

pfSense - Port forward through site-to-site VPN

I'm trying to solve a problem on my setup, and kindly ask your help. This is the scenario. Site 1 Internet connection via 4G/LTE provider, with natted connection pfSense firewall 172.20.0.0/25 LAN ...
Edo's user avatar
  • 1
0 votes
0 answers
155 views

How to connect 2 IPSec sites with each other via the "main site"

First of all, i'm originally a software engineer with some network knowledge so no network specialist. At my current job i'm also responsable for the network. I say this because it may be a bit stupid ...
CodeNinja's user avatar
  • 325
0 votes
1 answer
2k views

Pfsense DNS port-forwarding

I've encountered a problem when port-forwarding a DNS server using PFSense. I've pf'd many services on this same firewall, only am I unable to port forward a DNS server. DIG dns using local address: ...
Koen Vuurens's user avatar
1 vote
1 answer
400 views

kernel message, who knows what this means

kernel: [2427107.300793] traps: ATA-0 [27274] trap int3 ip:7f2c48115064 sp:7f2c22e9ad90 error:0 in VBoxDD.so[7f2c480ec000+155000] the message is recorded in the virtualbox host system when this comes ...
RvL's user avatar
  • 21
0 votes
1 answer
60 views

Give internet Access to my local network users

I have local network 10.10.10.0/24 and have pfsense. I use the pfsense for OpenVPN. Users connecting servers via vpn but users server ip addresses from local area network (ex. 10.10.10.30) that is why ...
user3406957's user avatar
0 votes
1 answer
603 views

How to specify an IP range representing "any IP" within a Pfsense alias?

I've restricted the source IP of many rules to some alias, say Trusted_Sources. Now, for some reason, I want to open all these rules to the world without manually modifying each individual rule. How ...
user2798081's user avatar
0 votes
1 answer
5k views

How to allow traffic only to the internet in pfSense?

Given the following network diagram: internet | | +--------+--------+ | | dmz2 ----+ ...
Georg Schölly's user avatar
-2 votes
1 answer
155 views

VMware ESXI - External PCI Ethernet Card [closed]

I have a beast of a home server and don’t fancy purchasing another device just to learn PFSense on my network. My server only has 1 Ethernet port, I have an external PCI card I bought off from amazon ...
LConner1997's user avatar
1 vote
0 answers
452 views

pfSense: unable to configure 1:1 NAT to a remote IPSec

I'm having a hard time figuring out how to configure 1:1 NAT between my local LAN and a remote subnet connected through IPSec. I have a fresh install of pfSense-2.4.5p1, with a public IPv4 on WAN and ...
Luke404's user avatar
  • 5,886
6 votes
1 answer
4k views

Rearrange pfSense interface order

I want to organize a pfSense firewall that I got already running and the first thing is the interface order. I know that pfSense is a little bit harsh when coming to rearrange things, but I would like ...
Vinícius Ferrão's user avatar
0 votes
1 answer
726 views

Cannot ping a certain IP address from machine within certain IP range?

I am a bit new to networking so I have probably done something wrong that is a simple oversight. I used to use an normal TP-Link router/switch combo jobs and an internal network range of 10.0.0.0/22. ...
LTWood's user avatar
  • 25
1 vote
1 answer
740 views

hetzner private network, 1 docker host, 1 pfsense, I keep getting "TCP Previous segment not captured" from my containers

this is the network design https://imagebin.ca/v/5NNDpuDwq9PT it's hosted on hetzner, 1 firewall with a public facing interface, pfsense. 1 docker host with two interfaces, one connected to the ...
dada216's user avatar
  • 33
1 vote
0 answers
293 views

PFSense HAProxy DNS Rebind

I have installed PFSense and HAProxy Package behind Provider router with On Public IP, when trying to redirect all HTTP/HTTPS traffic to ip assigned to PFSense, I am getting HAProxy Front Ends ...
Sirra Ali's user avatar
2 votes
2 answers
7k views

Haproxy log file with pfsense

I am trying to read the /var/log/haproxy.log file with the command: clog -f haproxy.log but nothing happens. No window opens. How do I see my error log? I’m on pfsense.
Jean Mark Orfali's user avatar
0 votes
1 answer
2k views

How should certificates for multiple separate sub-domain servers be issued/renewed with Let's Encrypt?

Upgrading my home infrastructure to learn as well as be more secure, I have not been able to find out how best to get certificate(s) issues and installed across my servers, which comprise: Firewall (...
andybjackson's user avatar
0 votes
1 answer
682 views

pfsense OpenVPN client address issue

First VPN client works like a charm (tunnel is 192.168.104.0/24 -> 192.168.104.2 assigned). But once another client logs on an identical IP is assigned. It looks there is no address pool to be defined!...
Reiny's user avatar
  • 1
0 votes
1 answer
376 views

BIND9/DNS lookups stopped working after upgrading our Comcast modem/gateway

OK here's our setup, we're running pfSense as our firewall/router. We have a dual-WAN with a Comcast Business Gateway and another local ISP. We're running Samba as the domain controller & Bind9/...
Barry Ralphs's user avatar
0 votes
1 answer
472 views

ESXi vmkernel web gui issue

I have ESXi 6.7 running with pfSense on it as a virtualised router. pfSense, ESXi and other devices are on management VLAN 10. User devices are on different VLANs (lets assume 20 for now). pfSense ...
wlamers's user avatar
  • 23
0 votes
1 answer
2k views

Pfsense and Dns Resolver - SSL/TLS for internal access?

I have a Pfsense box that is able to issue/renew acme certificates, with haproxy installed, that has two backend servers that use the generated acme certificate that works fine. (email and nextcloud ...
JCTechie's user avatar
  • 101
1 vote
1 answer
885 views

pfSense on ESXi VLAN and interface definition dilemma

I'm trying to set up a virtualised pfSense router in ESXi on a Dell server. After many hours of reading, experimenting, watching Youtube videos etc, I'm close to pulling my hairs out... The setup: - ...
wlamers's user avatar
  • 23
1 vote
1 answer
378 views

How large does site-to-site VPN subnet need to be?

Users on the data VLAN in our HQ and future remote office(s) will need to access files, floating network licenses etc. from distant servers, so we will need a site-to-site VPN for the data network(s). ...
Rhydgaled's user avatar
0 votes
1 answer
114 views

freebsd packet filter match last digit of IP address

On my freebsd system I want to use port forwarding to distribute incoming traffic, based on the last digit of the source IP. The following works on linux with iptables: iptables -t nat -A ...
memyself's user avatar
  • 345
4 votes
1 answer
28k views

What do the following mean: TCP:RA, TCP:FA ,TCP:PA, TCP:S, TCP:SEC

I'm specifically looking for a definition of what the following mean: TCP:RA, TCP:FA ,TCP:PA, TCP:S, TCP:SEC The context is that I'm looking at some pfSense logs which are showing rejected packets by ...
Walt Stoneburner's user avatar
0 votes
1 answer
561 views

Reverse proxy using haproxy redirection of node-red dashboard

I have multiple node-red servers running behind a HAProxy reverse proxy which runs as apart of a pfSense box. I want to access different node-red instances by accessing the pfSense box at different ...
Lefteris's user avatar
  • 121
0 votes
0 answers
233 views

OpenVPN Server/Client Setup - Clients on both sides can't reach each other

I am hoping that someone can assist me with this issue, as it's kinda boggling my mind. The base-level issue is that clients on both side of an OpenVPN tunnel cannot talk to eachother. The goal is ...
TPCoMatt's user avatar
3 votes
1 answer
4k views

Kubernetes + Rancher: multiple VLANs

I intend to deploy a k8s + Rancher cluster on my local network, but my environment has several VLANs, with pfsense acting as a firewal and router between such VLANs. My cluster resides in XCP-NG as a ...
user562397's user avatar
4 votes
1 answer
2k views

SSH Client freeze connect to SSH server with multiple network interface

Case 1: SSH host has ONE network interface Routing table for host SSH: [SSH] $ ip route default via 192.168.211.1 dev eth0 192.168.211.0/24 dev eth0 proto kernel scope link src 192.168.211.119 ...
Chau Chee Yang's user avatar
1 vote
3 answers
1k views

Is it possible to apply firewall on LAN to LAN packets with just PfSense and a layer 2 switch?

Is it possible to apply firewall rules on LAN to LAN packets? Imagine the following architecture: To get a valid IP, the clients must authenticate to PfSense LAN network using 802.1x against the ...
Tiago Stapenhorst's user avatar

1 2
3
4 5
17