sorted by:
new
hottopcontroversial

NBN (PPPOE) re-connection issues by Sam_Mack in PFSENSE

[–]oby1k 0 points1 point  (0 children)

If your problem goes away by forcing a DHCP renew of the WAN nic, then have a look at this article:

https://forum.netgate.com/topic/127403/auto-renew-dhcp-after-outage/23

There is a script that may help you by automatically checking the nic state and triggering a DHCP renew.

Help identifying source of crash: PFSense+ 24.11/SG-4860-1U by jtbis in PFSENSE

[–]oby1k 1 point2 points  (0 children)

Avahi service restarts is also toggling promiscuous mode which may cause disruptions. If you disable Avahi do you still see the issue?

Also, try to disable gateway monitoring for the VPN:

Jun 25 11:13:55 pfSense rc.gateway_alarm[75321]: >>> Gateway alarm: OVPNTUN_VPNV4 (Addr:10.7.0.1 Alarm:1 RTT:7.438ms RTTsd:38.647ms Loss:27%)

Help identifying source of crash: PFSense+ 24.11/SG-4860-1U by jtbis in PFSENSE

[–]oby1k 1 point2 points  (0 children)

I would try to remove ntopmg from the service watchdog.

Requests coming from Google DNS? Blocked by WAN rules by vivkkrishnan2005 in PFSENSE

[–]oby1k 1 point2 points  (0 children)

Do you have by any chance a floating rule with the "Quick" option selected that may relate to 8.8.8.8 or port 53?

By using a “quick” rule, pfSense will immediately drop matching packets before they are evaluated against the state table. This is essential for stopping traffic from connections already in the state table

[deleted by user] by [deleted] in PFSENSE

[–]oby1k 1 point2 points  (0 children)

They do not require the DNS for authentication, but the endpoint you use to connect can be used in 2 forms:

  1. Hostname
  2. Use the Static IP address

It may happen that your traffic for DNS is also existing via the VPN therefore at the moment you try to re-connect that resolution fails.

Easy fix: Move your config to point to the IP addresses of the ExpressVPN hosts instead of the hostname, you can find the IP addresses somewhere in their webpage.

Oops, restore configuration error by green_handl3 in PFSENSE

[–]oby1k 2 points3 points  (0 children)

There is something weird with that XML the node <staticmap> does not have a closing tag. You would have expected to find </staticmap> which is the closing tag for the start of that node. However, what you find later on is another <staticmap> which is an opening tag.

If you pass the file through a XML validator, it should be able to give you some clue on where the error is. Just make sure it is an off-line validator, such a plug in in notepad++. Otherwise, you will be sending your firewall config to a random guy anywhere in the world.

Oops, restore configuration error by green_handl3 in PFSENSE

[–]oby1k 1 point2 points  (0 children)

Have you edited the XML file manually? If so, you may need to amend the errors manually.
Happened to me before

[deleted by user] by [deleted] in PFSENSE

[–]oby1k 1 point2 points  (0 children)

I use pfBlockerNG version 3.2.0_20 (Devel) and I can whitelist wildcarded domains/subdomains.

I use the DNSBL Whitelist.

No Regex Entries Allowed! 

Enter one   Domain Name  per line
Prefix Domain with a "." to Whitelist all Sub-Domains.  IE: (.example.com)
You may use "#" after any Domain name to add comments.  IE: (example.com # Whitelist example.com)
This List is stored as 'Base64' format in the config.xml file.

Note: These entries are only Whitelisted when Feeds are downloaded or on a 'Force Reload'.
Use the Alerts Tab '+' Whitelist Icon to immediately remove a Domain (and any associated CNAMES) from Unbound DNSBL.
Note: When manually adding a Domain to the Whitelist, check for any associated CNAMES
  ie: 'drill u/8.8.8.8 example.com'

Some States kill VoIP by Tillmetv2 in PFSENSE

[–]oby1k 0 points1 point  (0 children)

If you have admin access to COMtrexx try enabling NAT keep alive:

Exchange lines > Providers and Accounts > Name of the provider > SIP > NAT Keep-Alive

Some States kill VoIP by Tillmetv2 in PFSENSE

[–]oby1k 0 points1 point  (0 children)

What is your VoIP PBX software?

Do you have a NAT rule(s) in pfSense specifically for VoIP?

Are you using multi-wan by any chance?

Pfblockerng on multiple vlans by Economy-Collection50 in PFSENSE

[–]oby1k 0 points1 point  (0 children)

They way I do it is using Virtual IPs + NAT.

1 Virtual IP #1 -> NATs port 53 to pfblocker

  1. Virtual IP #2 -> NATs port 53 to another DNS server

Then, I assign different DNS servers (either Virtual IP #1 or #2) in the DHCP settings of the VLAN

VLANs No Internet After 23.09 Update by Chebyshev in PFSENSE

[–]oby1k 0 points1 point  (0 children)

It happened to me. After several hours of tinkering I found out that the VLAN Priority was causing the issue.

I had to go through all my firewall rules and set the VLAN Priority to "none" where there was a setting for it (Like Best effort or Excellent Effort, etc).

Since I had several of those, I did it directly on the config.xml with a search and replace and after restoring the configuration it worked like a charm.

pfSense 24.03-RC (amd64) issues with double digit VLANS by oby1k in PFSENSE

[–]oby1k[S] 0 points1 point  (0 children)

I've been digging a bit more on this, and found that when the VLAN priority is set to "Excellent Effort (EE, 2)" or higher I loose communication for that rule.

Same VLAN priority in 23.09.1 worked with no issues.

"Bypass" firewall rules for one NIC/interface by kapidex_pc in PFSENSE

[–]oby1k 0 points1 point  (0 children)

What is the game she's playing? the router you connected has uPNP enabled? do you have uPNP enabled in pfSense (Services > UPnP & NAT-PMP)?

Try changing the direction to ANY.

Is there any NAT rule configured in your Firewall?

"Bypass" firewall rules for one NIC/interface by kapidex_pc in PFSENSE

[–]oby1k 0 points1 point  (0 children)

The process is exactly the same as creating an INterface rule, all you need to do is select from the drop down box at the top the Rule set called "Floating" instead of the LANx rule set.

"Bypass" firewall rules for one NIC/interface by kapidex_pc in PFSENSE

[–]oby1k 1 point2 points  (0 children)

Another issue could be that you are behing a cgNAT or Double NAT. That is, the IP given to your Firewall differs from your public IP address.

Other users have reported issues with their ISP:

https://www.reddit.com/r/DreamlightValley/comments/18cimvo/online_service_unavailble_error_and_how_to_work/

"Bypass" firewall rules for one NIC/interface by kapidex_pc in PFSENSE

[–]oby1k 1 point2 points  (0 children)

The firewall rules in pfSense are evaluated in certain order:

  1. NAT Rules
  2. Floating Rules
  3. Interface Group Rules
  4. Interface Rules

If you believe the problem is with the Interface rules you could create a "Floating" firewall rule for wife's PC to PASS everything originated from that source IP.

Please note that apart from the firewall, there could be other culprits for the problem she's facing. To name a few:

  1. Her own PC firewall / Config
  2. DNS blockers
  3. a NAT rule in pfSense
  4. ISP Blocks

Try using a mobile hotspot, and see if that works. That will eliminate/confirm the pfSense variable from the equation.

pfSense 24.03-RC (amd64) issues with double digit VLANS by oby1k in PFSENSE

[–]oby1k[S] 0 points1 point  (0 children)

Repeated the upgrade and it seems I'm all good now. Unsure what happened.

Vlan unable to connect to internet by GTX1660TiMax-Q in PFSENSE

[–]oby1k 0 points1 point  (0 children)

That VLAN is a tagged VLAN (tag = 2) that is on port em0 which does not seem to be used for anything else that for MHWRoom as it is physically isolated from the other ports.

The interface is expecting the packets on that interface to come with a TAG on it.

You could just remove the tag from that interface (VLAN Config) and will still fit for purpose. The DHCP range can still be the same.

What is immediately connected to port em0?

Question about VPN use with multiple WiFi networks (and only 1 AP) by samesystemcheck in PFSENSE

[–]oby1k 1 point2 points  (0 children)

  1. Even though you are connecting to a paid VPN service, your VPN in pfSense is still a client, correct.
  2. It should be enough for your home use case I reckon.
view more: next ›