gmane.comp.security.firewalls.pfsense.support

HEADS UP: this mailing list has moved

Chris Buechler — 2011-09-08T07:59:41

The mailing list has moved to list-aAvXoCwUuUu/b9cO8ncIzgRtnQ8X5fEL< at >public.gmane.org This list server
is being decommissioned. Your email address on this list has been
subscribed to the new list, and you will receive a welcome message on
that list shortly.

The old support< at > and discussion< at > emails will bounce. Feel free to
continue existing threads, but you'll have to change the to address to
list-aAvXoCwUuUu/b9cO8ncIzgRtnQ8X5fEL< at >public.gmane.org

Chris

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

RE: STP on Redundant Transparent Firewalls

Adam Thompson — 2011-09-07T16:34:38

Then STP *is* working. :-)

I’m unclear on how you can have CARP functioning – or even what you’re attempting, actually – if the two pfSense boxes are covering different VLANs; can you provide more detail on your setup?

Also, what flavour of STP are you using?  STP? RSTP? MSTP? PVSTP?  If you don’t know, just tell us what kind of switch(es) are involved.

Lastly, what does your PBX have to do with any of this?

 

-Adam Thompson

 <mailto:athompso-gKoiEJA+T1nk1uMJSBkQmQ< at >public.gmane.org> athompso-gKoiEJA+T1nk1uMJSBkQmQ< at >public.gmane.org

 

 

From: Austin G. Smith [mailto:Austin-t4aQvBRgbK3HasSoFNkwMtBPR1lH4CV8< at >public.gmane.org] 
Sent: Tuesday, September 06, 2011 13:09
To: support-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
Subject: [pfSense Support] STP on Redundant Transparent Firewalls

 

Greetings-

 

We have 2 pfsense machines that are bridged on different vlans operating as a transparent firewall.  These machines are setup for CARP replication to each other, which is verified functioning.  How

Re: Outbound port forward

Adam Piasecki — 2011-09-07T13:19:10

This works, and works great. Combined with open dns, it's a great way of 
filtering domains.

Adam

On 9/6/2011 9:54 PM, Ryan Rodrigue wrote:

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Re: Outbound port forward

Seth Mos — 2011-09-06T20:32:38

Op 6 sep 2011, om 21:12 heeft David Burgess het volgende geschreven:


This should work, i've been doing this a while back where I had a combination of a port forward on the LAN and a outbound NAT rule on the LAN interface to mangle traffic.

That was 1.2.3 or a early 2.0 beta.

Regards,

Seth
---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

RE: Linking 2 Building without VPN

Ron Lemon — 2011-09-06T22:32:46

Hi Klaus,

Thanks for the initial assistance.  I have now added an interface into each pfSense box to use for this link.  Just because the rest of my subnets are /24 I have added the same to these two cards.

So in
10.0.0.0/24 (Site A) I have added a new interface with 10.0.9.1 and from my pfSense box and all my workstation boxes I can ping 10.0.9.1
10.0.2.0/24 (Site B) I have added a new interface with 10.0.9.2 and from my pfSense box and all my workstation boxes I can ping 10.0.9.2

From
                10.0.0.254 I can ping 10.0.9.1 but not 10.0.9.2
                10.0.2.254 I can ping 10.0.9.2 but not 10.0.9.1

Even without any routes being created I figure from 10.0.9.1 I should be able to see 10.0.9.2

We did have a lightning strike so now I am questioning if I have my setup correct or some more dead hardware here in the building.

Thanks.


From: Klaus Wunder [mailto:klaus-ODWIaUi5DjHddJNmlsFzeA< at >public.gmane.org]
Sent: Tuesday, August 02, 2011 4:03 AM
To: support-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.o

RE: Outbound port forward

Ryan Rodrigue — 2011-09-06T20:54:59

What if you enabled DNS Forwarder and forwarded All DNS Request to PFsense.

Ryan Rodrigue
P.O. Box 4336
Chief Technical Manager
Houma, LA 70361
A A R Electronics, Inc
Phone (985) 876-4096
510 West Tunnel Blvd
Phone (800) 649-7346
Houma, LA 70360
Fax (985) 853-0134
Radiotech1-VLNP13999mZWk0Htik3J/w< at >public.gmane.org
www.aarelectronics.com


-----Original Message-----
From: Arquivos [mailto:arquivos-XbLTj5g7dhlfyO9Q7EP/yw< at >public.gmane.org] 
Sent: Tuesday, September 06, 2011 2:34 PM
To: support-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
Subject: Re: [pfSense Support] Outbound port forward


I´ve tried this config and it didn´t work :( In NAT por forward only
internal IP´s can be specified and i need an external DNS server, so i´m
still in the dark.
Tks..

Danilo



---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org For additional
commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commerci

Re: Outbound port forward

Arquivos — 2011-09-06T19:34:11

I´ve tried this config and it didn´t work :(
In NAT por forward only internal IP´s can be specified and i need an
external DNS server, so i´m still in the dark.
Tks..

Danilo



---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Re: Outbound port forward

David Burgess — 2011-09-06T19:12:38



What you want is a NAT Port Forward entry on your LAN interface to
destination port 53 and a redirect target IP of the server you want to
force. I haven't tried this but I believe it will do what you are
asking.

db

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Outbound port forward

Arquivos — 2011-09-06T19:08:50

Hi all.

I have a pfSense 2.0 box with 1 LAN and two WAN´s; Actually i´m facing a
problem: 
i need to forward all the requests going out by the port 53 (DNS) to a
single external DNS server, in dispite off the DNS configured in the
clients. Can someone help me in that? 

Danilo



---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

STP on Redundant Transparent Firewalls

Austin G. Smith — 2011-09-06T18:09:25

Greetings-



We have 2 pfsense machines that are bridged on different vlans operating as a transparent firewall.  These machines are setup for CARP replication to each other, which is verified functioning.  However, for somereason, the STP is not quite functioning on the secondary PBX.  We have to keep one of the interfaces down, or we get in a loop situation.



Has anyone experienced this behavior that can advise a work around?  What are we missing here?



Thank you-



Austin Smith, A+, NET+, SMBE, MCSA
Director of Information Techology
Digital Compass

(404) 410-2708 direct
(404) 410-2701 fax
949 W. Marietta Street, Suite x104
Atlanta, GA 30318

**For immediate assistance please contact our technical team at 888-640-2260**

RES: Install NIC Atheros of mainboard

Ivanildo Galvão - IT Services — 2011-09-06T17:15:50

That's right, the motherboard is a Biostar, has said the situation for the client asked him to get an offboard network card that is compatible, such as 3Com and Realtek,or get another computrador that already have network cards compatible .

Thanks for your help!

 

 

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

 <mailto:ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org> ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org    |  <http://www.itservices.com.br/> www.itservices.com.br 

Twitter: < at >ivanildogalvao 

  

 

 

 

 

 

De: Adam Thompson [mailto:athompso-gKoiEJA+T1nk1uMJSBkQmQ< at >public.gmane.org] 
Enviada em: terça-feira, 6 de setembro de 2011 12:29
Para: support-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
Assunto: RE: [pfSense Support] Install NIC Atheros of mainboard

 

It doesn’t look like that particular Atheros chipset is supported yet in FreeBSD, which means you will not be able to use it with pfSense

IPSEC client behind pfsense nat unable to make particular type traffic

Giacomo Di Ciocco — 2011-09-06T15:37:07

Hello Everyone,
I had two guests using IPSEC VPN unable to connect to their exchange 
servers while connected to their company VPN, when using the old router, 
a linux machine doing outbound NAT, they were not experiencing this; one 
of these guests experiences such problem also from its home ADSL link.

Apart from the protocol specific problem mentioned above their VPN is 
working fine.

I'm asking you because I cannot figure how there can be different 
behaviours for the "same" type of traffic (it is encrypted!).

I'm using AON with lan->wan rule for port 500 and after that i have a 
global lan->wan rule.

Thank you,
Giacomo.


---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

RE: Install NIC Atheros of mainboard

Adam Thompson — 2011-09-06T15:29:25

It doesn’t look like that particular Atheros chipset is supported yet in FreeBSD, which means you will not be able to use it with pfSense at all.

(The alc(4) driver supports the Atheros 815x series of devices, but only claims to support the AR8151 and AR8152 so far.)

I assume you’re using a BIOSTAR motherboard, since no-one else appears to use the AR8158 yet?  This chip is new enough that even Qualcomm/Atheros’ own website does not list it!

You might have to wait for pfSense 2.1, which is expected be based on FreeBSD 9, *if* support for the chip is added to FreeBSD 9 prior to release.  Most likely, you’ll have to wait for pfSense 2.2, which might be based on FreeBSD 9.1 – whenever that happens.  Since FreeBSD 9 is already in beta, I doubt support for that chip will be added before release.

 

-Adam Thompson

athompso-gKoiEJA+T1nk1uMJSBkQmQ< at >public.gmane.org

(204) 291-7950 - direct

(204) 489-6515 - fax

 

From: Ivanildo Galvão - IT Services [mailto:ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >pu

Install NIC Atheros of mainboard

Ivanildo Galvão - IT Services — 2011-09-06T15:12:45

 

Good afternoon, how do I recognize the pfSense an onboard NIC ? Is there any
command or some way for him to download the driver from the internet via
shell?
The card in question is Atheros AR8158 - 10/100 Controller, the offboard
Realtekhas been recognized and is usually configured as a WAN, the need to
enable Atheros to be onboard LAN.

 

 

Sds,

 

 

 

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org    | www.itservices.com.br
<http://www.itservices.com.br/>  

Twitter: < at >ivanildogalvao

Install NIC

Ivanildo Galvão - IT Services — 2011-09-06T12:37:41

Good afternoon, how do I recognize the pfSense an onboard NIC ? Is there any
command or some way for him to download the driver from the internet via
shell?
The card in question is Atheros AR8158 - 10/100 Controller, the offboard
Realtekhas been recognized and is usually configured as a WAN, the need to
enable Atheros to be onboard LAN.

 

 

Sds,

 

 

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org    | www.itservices.com.br
<http://www.itservices.com.br/>  

Twitter: < at >ivanildogalvao

Re: Routing/NAT issue

Giacomo Di Ciocco — 2011-09-03T14:26:09

Il giorno 02/set/2011, alle ore 17.51, Jim Pingle ha scritto:



Hi Jim,
I applied a modified version of "your" solution, i've split the /26 in two /27s the first /27 is in the interface facing the servers and the second is in the WAN, then i modified outbound nat to source packets from the LANs with an ip from the second /27 assigned to the WAN; can't actually find any drawback to this setup.

The state-of-the-art solution was to have another pfsense box with LANs connected to it and WAN in the /26, cannot find how to do this with just one box...

Opinions appreciated :)

Regards,
Giacomo.
---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Re: Squid VideoCache

Glenn Kelley — 2011-09-03T00:49:14

I am really wondering if there is a free alternative - and if so what it is - does it work the 2.x for pfsense.

On Sep 2, 2011, at 6:36 PM, Glenn Kelley wrote:

Squid VideoCache

Glenn Kelley — 2011-09-02T22:36:37

I am now running a 2.0 Snapshot (latest) and loving what the team has done with 2.0.x 
Amazing! 

My question today rests around the Squid VideoCache instructions located here: http://doc.pfsense.org/index.php/Setup_VideoCache_with_Squid#Install_VideoCache 

At present many of the instruction sets on the system appear to be for the 1.2.x release - 
Are these instructions still good to follow for the 2.0.x release? 

(appear they may work - but figured it would be best to ask) 

Thank you

Glenn

Re: how to block the bit torrent

Glenn Kelley — 2011-09-02T22:34:37

Thanks Chris - figured with the many changes from 1.2.x to 2 it still might be worth it.
but I hear ya there :-)


On Sep 2, 2011, at 4:18 PM, Jorge Fábregas wrote:



---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Re: how to block the bit torrent

Jorge Fábregas — 2011-09-02T20:18:00

Hi Chris,

I own the 1.2.x book and found it very useful.  Are there any remote
plans for a 2.0 book once 2.0 (final) is out?

Regards,
Jorge

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

RE: how to block the bit torrent

Ryan Rodrigue — 2011-09-02T17:41:15

On Fri, Sep 2, 2011 at 12:23 PM, Glenn Kelley <glenn-W1duGfzjw/5Wk0Htik3J/w< at >public.gmane.org> wrote:


I recommended the 1.2 book because he said he was running 1.2



---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org