37
IPv6 is designed to not do that. Trying IPv4 style NAT with IPv6 will break things. That said, I'm pretty sure you can do NAT IPv6 with Linux iptables, so it's not impossible. But I would strongly recommend not to do it.
21
IPv6 doesn't have a NAT standard the way IPv4 does. There is an EXPERIMENMTAL RFC for one-to-one NAT (one outside address for each inside address) on IPv6, but explicitly forbids what you want to do (I highlighted it below):
6. A Note on Port Mapping
In addition to overwriting IP addresses when datagrams are forwarded,
NAPT44 devices overwrite the source ...
16
WARNING about your setup
I would advise you caution using this system in this setup, if you have only one physical adapter and then only one uplink to the universe from the system. I would suggest going and purchasing an extra adapter for the system, and add that to your system - this way you can still have a backup physical connection.
The other ...
10
Yes, this is absolutely possible. In fact, the pfSense wiki has an entire page dedicated to this topic.
In short, you'll use CARP VIPs so to move your gateway address between routers and then use pfSense's XMLRPC sync to synchronize config between the two devices.
In an ideal setup, you'd have both of your internet circuits connected to each router. This ...
9
They are giving (roughly) the same data. Units matter. :)
pfSense is using megabits per second, and Netbalancer is using megabytes per second.
9
Yes, it's possible but its configuration is in a location that isn't intuitive. Here's how:
Go to the Firewall > Virtual IPs menu
Click Add
Click IP Alias
Select the Interface to add the IP alias to
Add the IP alias to the Address field and set its prefix length
Click Save
8
IPv6 addresses are not the most powerful way to track. DNS traffic shows where on the Internet you are going. On desktop and mobile, ad and social tracking identifiers follow users across devices and IPs.
IPv6 addresses can be changed frequently, leaving only the common prefix identifying your site, not the host. On devices without privacy extensions, ...
7
As others have noted, there are many ways your devices will be tracked. Even if you had thousands (instead of just dozens) of them and mapped them all on same IP it wouldn't make much difference.
See for example https://panopticlick.eff.org/ if you want to try it yourself, and click on "Show full results". Try with different devices, even change your IP ...
6
Perhaps its easier when you have a look at ansible and playbooks. There are some playbooks for pfsense and i think you find some more. There you can make templates and configure your firewall over ssh with ansible.
https://github.com/amatas/ansible-pfsense
http://docs.ansible.com/playbooks.html
6
This issue is very well documented in Pfsense with workaround: DNS Rebinding Protections
The DNS forwarder (dnsmasq) uses the option --stop-dns-rebind by
default, which rejects and logs addresses from upstream nameservers
which are in the private IP ranges. In the most common usage, this is
filtering DNS responses received from the Internet to ...
6
In BSD, network interfaces are named after which driver they use. So in your case, emX = Intel, and bgeX = Broadcom.
Any of your interfaces can be used for any purpose within pfSense. It's just up to you to examine the performance characteristics of each and decide accordingly.
6
It appears that this is a known limitation[1] when pfsense is connected with your modem/router using TCP/IP (either static or dynamic). The workaround is this:
Install the cron package (System > Package Manager > Available Packages, search for cron and click INSTALL). Then go to Services > Cron and click edit(the pencil) on the line about rc.dyndns....
5
pfSense stores its log files in the /var/log directory.
The logs are not stored in the standard text-based format. Instead they are stored in a 'circular logging' format. Use the clog tool to view the logs. You can use it similarly to the tail command. i.e. clog -f /var/log/system.log will display the entire log and then continue to 'follow' it.
5
This can be done with the squid3 package. squid3 includes a Reverse Proxy server
Install the squid3 package...
System > Packages
Scroll down to squid3 and press the + button
After installation go to Services > Reverse Proxy
Under the General tab...
Reverse Proxy interface: WAN
external FQDN: YourFQDN.com (this should be your main name, but it doesn't ...
5
I had a similar problem.
Connecting to a cisco VPN, sshing in to the remote machine and simply running ps aux would just completely freeze my session.
The solution was indeed to tune the MTU.
On CentOS you have to run ip addr to figure out the current MTU of your different network adapters. And you can change them via sudo ip link set eth0 mtu 1300 (this ...
5
You don't block "LAN Address", you need to block "LAN Subnet".
Do the following:
Add a rule as the first rule: PASS, 172.16.1.1 -> ANY
Add a rule as the second rule: DENY, LAN subnet -> ANY
5
It's entirely possible that if you're using pfSense 2.2 or later, you're being affected by this. Symptoms would include:
Slowness for other VMs hosted on the KVM platform if they need to access a network resource which is on the other side of one of the router interfaces on the pfSense router
Physical machines which need to access something across the ...
5
Duplicate your existing P2 (click the + to the right of it), change local from 10.0.2.0/24, leaving same 10.172.0.0/16 remote. Do the same, flipping local and remote, on "other router." Then you'll be able to communicate between.
5
I need to host a web application on these 2 servers in failover mode. I want to use KVM virtualization (most likely Ubuntu). There will be a number of VMs on each server.
Hey, your thoughts about KVM looking good, just want to add that for creating really redundant Highly-available platform I recommend my clients to take a look either on HPE VSA or ...
5
"the ping go from one side, Desktop --> Node1 but not when launched from Node1 --> Desktop" - This statement, if accurate, eliminates all possibilities of a routing issue.
In order for a ping to work from Desktop->Node1, you also have to receive a reply back from Node1->Desktop. That indicates everything is setup fine on the VPN and routing.
Instead this ...
5
The config file stored in /var/etc/xinetd.conf is regenerated every time you perform a filter reload.
To make changes to this process, you need to modify the filter reload process, you can find it on /etc/inc/filter.inc.
Start by creating a directory of xinetd config files that will be included at filter reload time:
mkdir -p /opt/etc/xinetd.d
Create ...
5
If you want to do unusual/frowned upon stuff then using a pre-canned "router distro" as your edge router probablly isn't the best way to go. Further pfsense is based on freebsd pf which does not support "one to many" ipv6 NAT.
If you want to do one to many ipv6 NAT I would suggest using a recent version of a generic linux distro as your edge router. Linux ...
5
They represent the TCP flags, indeed. RFC 793, 3.1:
Control Bits: 6 bits (from left to right):
URG: Urgent Pointer field significant
ACK: Acknowledgment field significant
PSH: Push Function
RST: Reset the connection
SYN: Synchronize sequence numbers
FIN: No more data from sender
And additions:
NS: ECN-nonce - concealment protection. RFC 3540
CWR: ...
4
It does not, it depends on your Setup. I have a working solution with 1 IP. The Slave just uses the Master as a gateway.
4
Add a rule to your LAN interface that matches traffic coming from/going to certain hosts/nets as required and specify the outgoing gateway in that rule.
4
What you need to do is create 2 virtual switches. First one will be connected to a network interface with public IP and other one will be for internal use.
Connect pfSync to both, while all other VMs should be connected only to internal switch. Then set up NAT in pfSync.
But, problem is you only have 1 public IP at your disposal, and that IP should be ...
4
According to this site, you can create a disablesid.conf file that looks somewhat like this (there's extra in this, use what you need)
https://forum.pfsense.org/index.php?topic=95881.0
# Messes up with DNS resolution on LAN
1:2200073 # SURICATA IPv4 invalid checksum
# Bittorrent noise, DNS
1:2200075 # SURICATA UDPv4 invalid checksum
1:2200078 # SURICATA ...
4
This isn't an answer per se, but I still can't comment because I do not have 50 rep points. But, I got on and tested that exact same pfsense image with both cdrom and location. cdrom with vnc seems like the way to go here, since for whatever reason location was having trouble locating a .img file when crawling the iso (I had trouble locating a .img when ...
4
Simply exit the shell with exit
The menu from your screenshot is the default shell for the admin user, /etc/rc.initial
4
First you should know that HP and Cisco use the term "trunk" differently. What HP calls a trunk, Cisco calls an Etherchannel (port aggregation).
I'll use the term in the Cisco sense (VLAN trunk) since you seem comfortable with that.
Trunk ports can have up to one untagged VLAN; all others must be tagged. You can, if you prefer, tag all VLANs on a trunk. ...
Only top voted, non community-wiki answers of a minimum length are eligible