Tag Info

Hot answers tagged

19

Just for the record, as this thread is often referred to concerning HAProxy + SSL, HAProxy does support native SSL on both sides since 1.5-dev12. So having X-Forwarded-For, HTTP keep-alive as well as a header telling the server that the connection was made over SSL is as simple as the following : listen front bind :80 bind :443 ssl crt ...


15

You dont need to drop it all, you could just use nginx in front of haproxy for SSL support, keeping all your load balancing config. You dont even need to use nginx for HTTP if you don't want to. Nginx can pass both X-Forwarded-For and a custom header indicating SSL is in use (and client cert information if you want). Nginx config snippet that sends required ...


15

I found the solution after spending roughly 40 hours on this problem. There is a setting in the switch that enables "Auto DoS" protection. Apparently it considers TCP or UDP traffic that has matching source or destination ports to be a blat attack and drops the packet. This is ridiculously short-sighted since SIP traffic often (always?) relies on source ...


13

What Wesley said... Plus a diagram: +----------------------------------+ | +----------+ +---------+ | +----+ +----+ +----+ | | pfSense | | Host OS | | | | | | | | | | | | | | | PC | | PC | | PC | | +----------+ ...


11

There are several different types of DDoS so any generic information about them may only be correct for one particular type. For instance, the idea that a DDoS always exhausts your bandwidth is incorrect. What you need to do is analyse (some of) the traffic, determine why it's breaking your site, find a way of identifying it and then decide on an action ...


11

After much research on this I discovered what the problem was. Both pfSense and FreeNAS provide SNMP support through the FreeBSD begemot SNMP daemon (bsnmpd). In order to provide memory usage, CPU usage, and Load Average information, the begemot SNMP daemon needs to have an additional module, snmp_ucd.so loaded. I found the following forum thread explaining ...


11

For anyone else who finds this question, I followed Ochoto's advice and used nginx. Here's the specific steps I used to make this work on my pfSense router: Using the pfsense web interface, I installed the pfsense PfJailctl package and the "jail_template" package under System > Packages so I could create a FreeBSD jail under which to compile and install ...


11

pfSense has all of that and more, plus you can scale up to whatever hardware you need: from a simple, 500MHz ALIX-based platform from PCEngines.ch (3 NICs as well, less than $300 all told with PSU, enclosure, and CompactFlash for storage), up to an Axiomtek barebones network appliance with 6 GbE interfaces, Intel Dual Core chipset, 2 GB DDR2 RAM, etc. for ...


10

If two hosts are on the same subnet, the traffic has no reason to go through the router. Your rules are never being applied. The two devices are connected to a switch (or some other Layer 2 networking hardware). Host A says "I want this traffic to go to Host B's IP" and your switch says "Ok, done." UPDATE: If VLANs are an option, put each host in a ...


10

Simply setting all PCs, switches, routers and etcetera network infrastructure to use the pfsense virtual machine as their default gateway will make all traffic flow through the content filter. Certainly, someone could yank network cables out of the server and plug their PC straight into your WAN. You could set some kind of MAC filtering or 802.1x ...


10

The arguments people generally have against that are security of the hypervisor itself, which history has pretty much proven isn't much of a concern. That could always change, but there haven't yet been any really significant recurring hypervisor security issues. Some people just refuse to trust it, for no good reason. It's not about attacking other hosts if ...


9

There's a danger in anything being hooked up to the internet period. To quote the immortal Weird Al: Turn off your computer and make sure it powers down Drop it in a forty-three-foot hole in the ground Bury it completely; rocks and boulders should be fine Then burn all the clothes you may have worn any time you were online! Anything you ...


9

The answer to this is most likely: don't do that. Whatever it was you were doing to break pfSense, figure out what is was and don't do that any more. I've worked with a plethora of linux and BSD-based router distributions, and pfSense is by far the most stable and flexible one of the bunch. While there are a few pfSense folks here on Serverfault, I'd ...


9

Theo and others can make claims along those lines, but history suggests it's not a significant concern. Security researchers have been looking for vulnerabilities in hypervisors for years, and by and large they've escaped unscathed from at least major repeated vulnerabilities. Not entirely, you'll have to patch your hypervisor as needed where you generally ...


9

There's no comparison because they're really two totally seperate products that are aimed at two different markets. Kind of how you'll probably never see a comparison of a Ferrari 599 against a Bugatti Veryon. Both crazy fast expensive cars, but aimed at two different markets. I've used both. In fact our internal office uses TMG, and our remote site uses ...


9

Yes, this is absolutely possible. In fact, the pfSense wiki has an entire page dedicated to this topic. In short, you'll use CARP VIPs so to move your gateway address between routers and then use pfSense's XMLRPC sync to synchronize config between the two devices. In an ideal setup, you'd have both of your internet circuits connected to each router. This ...


9

They are giving (roughly) the same data. Units matter. :) pfSense is using megabits per second, and Netbalancer is using megabytes per second.


7

Under FreeBSD (pfSense is based on FreeBSD and has nothing to do with Linux) you can create multiple wlan interfaces based on the physical interface, then connect them to various APs. For instance, if you have an Atheros card in your computer (and it isn't renamed): ifconfig wlan0 create wlandev ath0 ifconfig wlan bssid NetworkA [wep/wpa/etc info] dhclient ...


7

Yes. Services -> DHCP Server. Then add entries to the table at the bottom of the page.


6

dmidecode will give you the details of what's currently installed in the box: Handle 0x0015, DMI type 17, 27 bytes Memory Device Array Handle: 0x0014 Error Information Handle: Not Provided Total Width: 64 bits Data Width: 64 bits Size: 1024 MB Form Factor: DIMM Set: None Locator: J1MY Bank Locator: CHAN A DIMM 0 Type: ...


6

I also manage several small offices and the resulting experience is that sooner or later the so called SMB products fall short of expectation. It may be vendor imposed software limitations or the hardware limitations. pfSense is more than capable of doing what you want. This is why I stick with either Cisco (when the budget allows) or pfSense (cheaper, yet ...


6

"Monowall is first and foremost, a routing platform. Nothing more, nothing less. The distribution comes in two flavors, either for embedded systems or for regular PCs." "pfSense is a hybrid of sorts, that has multiple sources for it’s major components. It was originally derived from monowall, but uses OpenBSD’s ported Packet Filter, a package management ...


6

You can run from it if you're using the embedded version, but if you're looking to do a full install, it's not possible with the stable version, you need a CD drive. There are USB stick equivalents of the iso for 2.0 at snapshots.pfsense.org.


6

Exactly as Mark said, they're very much two entirely different products. If you're looking for a proxy server that's tightly integrated with Active Directory and provides a slew of nice functionality in that area, you want TMG. If you need advanced NAT, routing, multi-WAN, flexible cross-platform VPN options, etc. you're somewhere between some, minimal and ...


6

For over a year i have been using m0n0wall for its IPv6 connectivity. It isn't perfect, as m0n0wall still has a lot of IPv6 functionality missing (e.g. traffic shaping). But it does have extraordinarily simple IPv6 Tunnel Broker setup. Now pfSense 2.1 has been released, with (hopefully) more IPv6 support than m0n0wall. On the other hand, the setup of an ...


6

I suspect the correct answer is neither. You should probably follow the instructions for installing an embedded pfsence ( I assume the CF cards will go into some sort of headless box.) http://doc.pfsense.org/index.php/Installing_pfSense#Embedded


6

PFSense and Monowall are both based on FreeBSD (which is not Windows, not a Microsoft product, nothing like the aforementioned, does not use their file systems) and use UFS/FFS as their primary file system. You should let their installers slice and format the "disks". The physdiskwrite utility can write an image file to the cards, you have to override the ...


6

You don't really protect yourself from DDOS from your end. You identify traffic and coordinate with your ISP to block it before it gets in your link. If you have to block it in your side, you already lost the battle because your tubes are already clogged (the packets must reach your FW before being dropped). The ones that manage to stand to DDOS that way ...


6

No, carp requires three WAN IPs.


5

Um... no. The pfSense homepage begins by saying: pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall and router. It's not really designed or intended for you to install the pieces separately and "roll your own" as it were. (And, saying FreeBSD isn't a real operating system is not only inaccurate, but ...



Only top voted, non community-wiki answers of a minimum length are eligible