Tag Info

Hot answers tagged

16

You dont need to drop it all, you could just use nginx in front of haproxy for SSL support, keeping all your load balancing config. You dont even need to use nginx for HTTP if you don't want to. Nginx can pass both X-Forwarded-For and a custom header indicating SSL is in use (and client cert information if you want). Nginx config snippet that sends required ...


13

I found the solution after spending roughly 40 hours on this problem. There is a setting in the switch that enables "Auto DoS" protection. Apparently it considers TCP or UDP traffic that has matching source or destination ports to be a blat attack and drops the packet. This is ridiculously short-sighted since SIP traffic often (always?) relies on source ...


13

What Wesley said... Plus a diagram: +----------------------------------+ | +----------+ +---------+ | +----+ +----+ +----+ | | pfSense | | Host OS | | | | | | | | | | | | | | | PC | | PC | | PC | | +----------+ ...


12

Check out ALIX hardware, only draws 3 watts, generates very little heat, has no moving parts (to fail and make noise), and you can just restore your existing pfSense configuration right onto it. several options here: http://www.netgate.com/index.php?cPath=60%5F85


11

pfSense has all of that and more, plus you can scale up to whatever hardware you need: from a simple, 500MHz ALIX-based platform from PCEngines.ch (3 NICs as well, less than $300 all told with PSU, enclosure, and CompactFlash for storage), up to an Axiomtek barebones network appliance with 6 GbE interfaces, Intel Dual Core chipset, 2 GB DDR2 RAM, etc. for ...


11

There are several different types of DDoS so any generic information about them may only be correct for one particular type. For instance, the idea that a DDoS always exhausts your bandwidth is incorrect. What you need to do is analyse (some of) the traffic, determine why it's breaking your site, find a way of identifying it and then decide on an action ...


10

Simply setting all PCs, switches, routers and etcetera network infrastructure to use the pfsense virtual machine as their default gateway will make all traffic flow through the content filter. Certainly, someone could yank network cables out of the server and plug their PC straight into your WAN. You could set some kind of MAC filtering or 802.1x ...


10

If two hosts are on the same subnet, the traffic has no reason to go through the router. Your rules are never being applied. The two devices are connected to a switch (or some other Layer 2 networking hardware). Host A says "I want this traffic to go to Host B's IP" and your switch says "Ok, done." UPDATE: If VLANs are an option, put each host in a ...


10

For anyone else who finds this question, I followed Ochoto's advice and used nginx. Here's the specific steps I used to make this work on my pfSense router: Using the pfsense web interface, I installed the pfsense PfJailctl package and the "jail_template" package under System > Packages so I could create a FreeBSD jail under which to compile and install ...


10

Just for the record, as this thread is often referred to concerning HAProxy + SSL, HAProxy does support native SSL on both sides since 1.5-dev12. So having X-Forwarded-For, HTTP keep-alive as well as a header telling the server that the connection was made over SSL is as simple as the following : listen front bind :80 bind :443 ssl crt ...


10

If you're comfortable and satisfied with PFSense, why not just invest in some newer, more reliable hardware for it? Something small based around a mini-itx or micro-atx board, maybe. Get one of those CF cards that plugs into the IDE port, RAM and a case, and you're golden as long as the board has 2 network ports. Low power and should be pretty reliable if ...


10

Theo and others can make claims along those lines, but history suggests it's not a significant concern. Security researchers have been looking for vulnerabilities in hypervisors for years, and by and large they've escaped unscathed from at least major repeated vulnerabilities. Not entirely, you'll have to patch your hypervisor as needed where you generally ...


10

After much research on this I discovered what the problem was. Both pfSense and FreeNAS provide SNMP support through the FreeBSD begemot SNMP daemon (bsnmpd). In order to provide memory usage, CPU usage, and Load Average information, the begemot SNMP daemon needs to have an additional module, snmp_ucd.so loaded. I found the following forum thread explaining ...


9

The answer to this is most likely: don't do that. Whatever it was you were doing to break pfSense, figure out what is was and don't do that any more. I've worked with a plethora of linux and BSD-based router distributions, and pfSense is by far the most stable and flexible one of the bunch. While there are a few pfSense folks here on Serverfault, I'd ...


8

There's no comparison because they're really two totally seperate products that are aimed at two different markets. Kind of how you'll probably never see a comparison of a Ferrari 599 against a Bugatti Veryon. Both crazy fast expensive cars, but aimed at two different markets. I've used both. In fact our internal office uses TMG, and our remote site uses ...


7

There's a danger in anything being hooked up to the internet period. To quote the immortal Weird Al: Turn off your computer and make sure it powers down Drop it in a forty-three-foot hole in the ground Bury it completely; rocks and boulders should be fine Then burn all the clothes you may have worn any time you were online! Anything you ...


6

I suspect the correct answer is neither. You should probably follow the instructions for installing an embedded pfsence ( I assume the CF cards will go into some sort of headless box.) http://doc.pfsense.org/index.php/Installing_pfSense#Embedded


6

PFSense and Monowall are both based on FreeBSD (which is not Windows, not a Microsoft product, nothing like the aforementioned, does not use their file systems) and use UFS/FFS as their primary file system. You should let their installers slice and format the "disks". The physdiskwrite utility can write an image file to the cards, you have to override the ...


6

Exactly as Mark said, they're very much two entirely different products. If you're looking for a proxy server that's tightly integrated with Active Directory and provides a slew of nice functionality in that area, you want TMG. If you need advanced NAT, routing, multi-WAN, flexible cross-platform VPN options, etc. you're somewhere between some, minimal and ...


6

You don't really protect yourself from DDOS from your end. You identify traffic and coordinate with your ISP to block it before it gets in your link. If you have to block it in your side, you already lost the battle because your tubes are already clogged (the packets must reach your FW before being dropped). The ones that manage to stand to DDOS that way ...


6

I also manage several small offices and the resulting experience is that sooner or later the so called SMB products fall short of expectation. It may be vendor imposed software limitations or the hardware limitations. pfSense is more than capable of doing what you want. This is why I stick with either Cisco (when the budget allows) or pfSense (cheaper, yet ...


6

dmidecode will give you the details of what's currently installed in the box: Handle 0x0015, DMI type 17, 27 bytes Memory Device Array Handle: 0x0014 Error Information Handle: Not Provided Total Width: 64 bits Data Width: 64 bits Size: 1024 MB Form Factor: DIMM Set: None Locator: J1MY Bank Locator: CHAN A DIMM 0 Type: ...


5

Here's what may be an issue. Imagine you have following network: address pool: 10.1.1.0/255.255.255.0 router: 10.1.1.1 internal interface on internal vpn server: 10.1.1.2 some external machine that VPNs to network: 10.2.2.2 some internal client machine: 10.1.1.90 When you trying to access SIC from external VPN box, then traffic route goes like this: ...


5

Add a LAN Firewall rule to block the IP of the guy by going to Firewall -> Rules -> LAN: And be sure your rule is before the default "allow everyone" rule; since rules are processed top down, in order, until it finds one that matches.


5

"Monowall is first and foremost, a routing platform. Nothing more, nothing less. The distribution comes in two flavors, either for embedded systems or for regular PCs." "pfSense is a hybrid of sorts, that has multiple sources for it’s major components. It was originally derived from monowall, but uses OpenBSD’s ported Packet Filter, a package management ...


5

I have used Smoothwall for a long time, though I have been watching pfSense with great anticipation. I am kind of sad that third-party development for smoothwall seems to have largely died out since the great 2.0 days... thus I have been watching other products to see where they are going. pfSense has an embedded version that is perfect for running from ...


5

For over a year i have been using m0n0wall for its IPv6 connectivity. It isn't perfect, as m0n0wall still has a lot of IPv6 functionality missing (e.g. traffic shaping). But it does have extraordinarily simple IPv6 Tunnel Broker setup. Now pfSense 2.1 has been released, with (hopefully) more IPv6 support than m0n0wall. On the other hand, the setup of an ...


5

We've done this before in PFSense. If your IP addresses are grouped together it's easier, otherwise you have to create a rule for each and every IP address. In the WAN Firewall rules, create a rule matching: Protocol: any Source: x.x.x.x (or a range, if appropriate) Destination: any Gateway: (select WAN connection) You might want to create two failover ...


5

Under FreeBSD you can create multiple wlan interfaces based on the physical interface, then connect them to various APs. For instance, if you have an Atheros card in your computer (and it isn't renamed): ifconfig wlan0 create wlandev ath0 ifconfig wlan bssid NetworkA [wep/wpa/etc info] dhclient wlan0 (assuming DHCP) if you wanted another connection just ...


5

If the client is joined to the domain then the only thing preventing it from communicating properly would be that traffic is not being routed correctly from one subnet to the other, that the client has the wrong DNS settings, or that the firewall is blocking the required traffic from one subnet to the other. Having the other subnet set up in ADS&S ...



Only top voted, non community-wiki answers of a minimum length are eligible