gmane.comp.security.firewalls.pfsense.support

HEADS UP: this mailing list has moved

Chris Buechler — 2011-09-08T07:59:41

The mailing list has moved to list-aAvXoCwUuUu/b9cO8ncIzgRtnQ8X5fEL< at >public.gmane.org This list server
is being decommissioned. Your email address on this list has been
subscribed to the new list, and you will receive a welcome message on
that list shortly.

The old support< at > and discussion< at > emails will bounce. Feel free to
continue existing threads, but you'll have to change the to address to
list-aAvXoCwUuUu/b9cO8ncIzgRtnQ8X5fEL< at >public.gmane.org

Chris

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Outbound port forward

Arquivos — 2011-09-06T19:08:50

Hi all.

I have a pfSense 2.0 box with 1 LAN and two WAN´s; Actually i´m facing a
problem: 
i need to forward all the requests going out by the port 53 (DNS) to a
single external DNS server, in dispite off the DNS configured in the
clients. Can someone help me in that? 

Danilo



---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

IPSEC client behind pfsense nat unable to make particular type traffic

Giacomo Di Ciocco — 2011-09-06T15:37:07

Hello Everyone,
I had two guests using IPSEC VPN unable to connect to their exchange 
servers while connected to their company VPN, when using the old router, 
a linux machine doing outbound NAT, they were not experiencing this; one 
of these guests experiences such problem also from its home ADSL link.

Apart from the protocol specific problem mentioned above their VPN is 
working fine.

I'm asking you because I cannot figure how there can be different 
behaviours for the "same" type of traffic (it is encrypted!).

I'm using AON with lan->wan rule for port 500 and after that i have a 
global lan->wan rule.

Thank you,
Giacomo.


---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Install NIC Atheros of mainboard

Ivanildo Galvão - IT Services — 2011-09-06T15:12:45

 

Good afternoon, how do I recognize the pfSense an onboard NIC ? Is there any
command or some way for him to download the driver from the internet via
shell?
The card in question is Atheros AR8158 - 10/100 Controller, the offboard
Realtekhas been recognized and is usually configured as a WAN, the need to
enable Atheros to be onboard LAN.

 

 

Sds,

 

 

 

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org    | www.itservices.com.br
<http://www.itservices.com.br/>  

Twitter: < at >ivanildogalvao

Install NIC

Ivanildo Galvão - IT Services — 2011-09-06T12:37:41

Good afternoon, how do I recognize the pfSense an onboard NIC ? Is there any
command or some way for him to download the driver from the internet via
shell?
The card in question is Atheros AR8158 - 10/100 Controller, the offboard
Realtekhas been recognized and is usually configured as a WAN, the need to
enable Atheros to be onboard LAN.

 

 

Sds,

 

 

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org    | www.itservices.com.br
<http://www.itservices.com.br/>  

Twitter: < at >ivanildogalvao

Squid VideoCache

Glenn Kelley — 2011-09-02T22:36:37

I am now running a 2.0 Snapshot (latest) and loving what the team has done with 2.0.x 
Amazing! 

My question today rests around the Squid VideoCache instructions located here: http://doc.pfsense.org/index.php/Setup_VideoCache_with_Squid#Install_VideoCache 

At present many of the instruction sets on the system appear to be for the 1.2.x release - 
Are these instructions still good to follow for the 2.0.x release? 

(appear they may work - but figured it would be best to ask) 

Thank you

Glenn

Routing/NAT issue

Giacomo Di Ciocco — 2011-09-02T15:17:17

Hello everyone,
please consider this scenario: http://www.deffie.it/garbage/theproblem.png

Servers are reaching the internet from their public IP in the /26 and 
they have PFSense /26 IP as their default route, this is ok.

Users from LAN are reaching the internet with the PFSense IP in the /30 
but it is not conceptually correct, how can make services and LANs to 
reach the internet from the /26 address assigned to pfsense ?

Thank you,
Giacomo.

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Problem with forwarding between interfaces

Ray — 2011-09-02T11:09:49

 Hi,

 I've set up 2.0r3 on an ALIX2D13 box. Largely things work fine, but I 
 have a routing issue that I can't get my head around. I'll quickly 
 describe my setup first and then explain the problem I'm facing:

 The ALIX2D13 has 3 Ethernet interfaces. I use the first (vr0) as WAN 
 connection with DHCP. Works fine.

 The second Ethernet interface has a static private IP and serves as my 
 backdoor into the box when I screw up things on the other interfaces. 
 Also works fine.

 The ALIX has a Wifi card built in that runs as access point. This 
 access point, am openVPN tap client interface and the third Ethernet 
 interface are all part of a bridge (br0). Via VPN, the bridge gets an IP 
 assigned using a DHCP Server at the other end of the VPN tunnel in a 
 data center. Works also.

 When I connect to the WIFI access point provided by the ALIX box, the 
 client box contacts the DHCP server at the far end of the VPN tunnel for 
 an IP address. This also works. Part of the DHCP-provided information is 
 the gateway to be used by the client, which is set as the IP of the 
 bridge interface in the ALIX box. Here the problem comes in: the 
 Internet-bound traffic arrives at the ALIX, and my hope would be that it 
 is routed out directly via the WAN interface. However, it somehow 
 disappears there or hits some kind of wall. I should say that in the 
 advanced setting of pfSense I completely turned off packet filtering for 
 the moment, so that the firewall is not the problem.

 From Linux, I know that IP forwarding can be enabled with echo "1 > 
 /proc/sys/net/ipv4/ip_forward". I assume, FreeBSD is doing this in some 
 similar way? Is this feature enabled by default in pfSense? if not, 
 could that be the problem?

 Are there any diagnostic dumps I could add to provide more detailed 
 info?

 I would really appreciate a hint or two...

 Thanks,
 Ray

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Static ARP

Ivanildo Galvão - IT Services — 2011-09-01T20:19:53

What does this function in pfSense DHCP?

Enable Static ARP entries

Note: Only the machines listed below will be able to communicate with the
firewall on this NIC.

Sds,

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146 | Cel. (84) 9111 8873

<mailto:ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org> ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org |
<http://www.itservices.com.br/> www.itservices.com.br

Twitter: < at >ivanildogalvao

De: Ian Bowers [mailto:iggdawg-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org]
Enviada em: quinta-feira, 1 de setembro de 2011 14:04
Para: support-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
Assunto: Re: [pfSense Support] how to block the bit torrent

if you use any technology to classify and/or block bit torrent at layer 4,
all someone has to do is change their source port to something different, or
proxy the connection so the destination port is different. Or if you're
particularly unlucky, they might use VPN to mask it.

This is why you cannot depend on a fire-and-forget solution to do all the
blocking for you. it's better to identify the offending traffic, save some
pcaps to show what the user was doing, then deal with the user themselves
face to face or over email. Notify them that their activity is a breach of
security policy.

What is reading have you done on traffic shaping, packet filtering, IDS,
etc? No offense, but I think you may lack some fundamental understanding of
the technologies involved. Please take that as an observation only, I'm not
talking down to you. You've asked a number of very basic questions today,
so I'm trying to get a good handle of where you're at.

Regards,

- Ian

On Thu, Sep 1, 2011 at 11:49 AM, suresh suresh <suresh.notionink-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
wrote:

suppose i block through the traffic shapers means what will happen

if user changes bit torrent port in his/her machine only he/her download
torrent or bit torrent automatically changes the port number start
downloading.please help me.

Thank you,

Regards,
Suresh

On Thu, Sep 1, 2011 at 9:06 PM, Ian Bowers <iggdawg-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

savvy users will use a different port. if your goal is to say "we block bit
torrent", this shouldnt matter. if your goal is to actually block bit
torrent or successfully enforce security policy, this may not be sufficient.

On Thu, Sep 1, 2011 at 11:32 AM, suresh suresh <suresh.notionink-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
wrote:

if we disable the bit torrent using traffic shapers.. bit torrent will be
block or what will happen.please help me

Thank you,

Regards,
Suresh

On Thu, Sep 1, 2011 at 8:44 PM, Ian Bowers <iggdawg-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

pfsense is the freebsd, so one way or another you can install the snort.
there is a pfsense package for it though for easy installation and
maintenance. you may want to google IDS and how to tune it before deploying
it. IDS isn't something you want to walk into blind.

On Thu, Sep 1, 2011 at 11:04 AM, suresh suresh <suresh.notionink-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
wrote:

we can install the snort in pfsense 1.2.3?

On Thu, Sep 1, 2011 at 8:13 PM, Ian Bowers <iggdawg-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

You won't find much success in trying to block bittorrent with a firewall.
Your best bet is to use IDS (eg: snort) or another sort of categorization
software or appliance to identify who is using bittorrent and deal with them
at layer 8 via company security policy. Torrenting is one place where you
simply cannot deploy a fire-and-forget solution and hope for it to actually
work.

Regards,

-Ian

On Thu, Sep 1, 2011 at 9:38 AM, suresh suresh <suresh.notionink-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
wrote:

Hi All,

how to block the bit torrent in my nlan network.. and how to block the
websites,and how to block the websites except some lan connection. please
help me.

Thank you,

Regards,

suresh

PPTP "not working" after update on Tuesday

Vick Khera — 2011-09-01T17:31:42

Office firewall has been running 2.0-RC2 from some time in May.  PPTP
was working fine and dandy from iOS devices.  Just click the vpn on
and off you went.

Yesterday I updated the firewall to the latest snapshot of RC3 (Aug 30
18:45:48).  Since this time, after the PPTP connect succeeds.  The
pfSense logs show full success and assignment of the IP address to the
client, yet no traffic will pass.

The only two "tools" to test on the iOS device are mail and the
browser, and neither makes a connection to the server inside the
office.

The PPTP firewall filter tab has the "allow" rule.  No other changes
were made to the configuration other than running the upgrade.

If I ping back from the inside host to the assigned IP, it replies
"sendto: Host is down" *immediately*.  Normally pinging a dead IP
takes a while before it responds with that.

Anyone else observing this?  What else can I poke around to find
exactly where it fails?

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Block Website

suresh suresh — 2011-09-01T17:02:43

Hi All,

How to block the website in pfsense 1.2.3


Thank you,

Regards,
Suresh

suresh suresh wants to chat

suresh suresh — 2011-09-01T14:25:52

-----------------------------------------------------------------------

suresh suresh wants to stay in better touch using some of Google's coolest new
products.

If you already have Gmail or Google Talk, visit:
http://mail.google.com/mail/b-6e443e5064-311197686a-6BmY95mv9eYMD3T-9o2BloUhuyY
You'll need to click this link to be able to chat with suresh suresh.

To get Gmail - a free email account from Google with over 2,800 megabytes of
storage - and chat with suresh suresh, visit:
http://mail.google.com/mail/a-6e443e5064-311197686a-6BmY95mv9eYMD3T-9o2BloUhuyY

Gmail offers:
- Instant messaging right inside Gmail
- Powerful spam protection
- Built-in search for finding your messages and a helpful way of organizing
  emails into "conversations"
- No pop-up ads or untargeted banners - just text ads and related information
  that are relevant to the content of your messages

All this, and its yours for free. But wait, there's more! By opening a Gmail
account, you also get access to Google Talk, Google's instant messaging
service:

http://www.google.com/talk/

Google Talk offers:
- Web-based chat that you can use anywhere, without a download
- A contact list that's synchronized with your Gmail account
- Free, high quality PC-to-PC voice calls when you download the Google Talk
  client

We're working hard to add new features and make improvements, so we might also
ask for your comments and suggestions periodically. We appreciate your help in
making our products even better!

Thanks,
The Google Team

To learn more about Gmail and Google Talk, visit:
http://mail.google.com/mail/help/about.html
http://www.google.com/talk/about.html

(If clicking the URLs in this message does not work, copy and paste them into
the address bar of your browser).

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org

Limiters

Danny — 2011-09-01T13:50:02

Hi,

Why cannot limit the bandwidth to 1 bps? The minimum bandwith that i be able
to establish is 1 Kbps. If i set to 1bps, and click Save, automatically
changes to 1Kbps

Best Regards

how to add the wifi

suresh suresh — 2011-09-01T13:48:23

Hi All,

how to add the wifi in pfsense. i am having the linksys home router.how to
setup wifi in the pf sense. please help me.

Thank you,

Regards,
Suresh

assign the bandwidth

suresh suresh — 2011-09-01T13:44:13

Hi All,

how to assign the bandwidth for the each lan ports.. like software team get
2 mbps and support team get 5 mbps. how to do this. please help me..


Thank you,


Regards,
Suresh

how to block the bit torrent

suresh suresh — 2011-09-01T13:38:07

Hi All,

how to block the bit torrent in my nlan network.. and how to block the
websites,and how to block the websites except some lan connection. please
help me.

Thank you,

Regards,
suresh

Conectividade Social

Ivanildo Galvão - IT Services — 2011-08-31T17:51:43

Alguém aqui que é do Brasil ou ajudou alguém do Brasil, sabe como fazer com
que as máquinas acessem normalmente a Conectividade Social da Caixa
Econômica Federal ?

Este serviço sempre tem problemas com todos os proxys e firewalls e a
solução é diferente em cada produto, a Caixa disponibiliza uma documentação
antiga, mas que dé uma idéia, segue:

 

http://downloads.caixa.gov.br/_arquivos/fgts/conectividade_social/Manual_Con
figuracao_CSE.pdf

 

Na internet vemos muitas soluções para resolver isso em Linux e no ISA
Server, mas em pfSense não tem nada confiável, pelo menos não achei ainda.

 

Alguma ideia ?

 

 

Obrigado !

 

 

 

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org    | www.itservices.com.br
<http://www.itservices.com.br/>  

Twitter: < at >ivanildogalvao

DHCP Static Mapping - In Português

Ivanildo Galvão - IT Services — 2011-08-31T17:46:18

Olá pessoal,

Como faço para as máquinas que tem IP com o MAC definido em "Services: DHCP:
Edit static mapping"  no console DHCP, pegue também a informação do Gateway
e do DNS Server ?

Obrigado !

 

 

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org    | www.itservices.com.br
<http://www.itservices.com.br/>  

Twitter: < at >ivanildogalvao

DHCP Static Mapping

Ivanildo Galvão - IT Services — 2011-08-31T17:20:40

 

Hello,

How do the machines that have IP with the MAC set to "Services: DHCP:
Editstatic mapping" in the DHCP console, also get information from the
Gatewayand DNS Server?

Thank you!

 

 

Sds,

 

 

Ivanildo Galvão - MCP, MCT, MCSA, VSP

Consultor de Tecnologia

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

 <mailto:ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org> ivanildo-8vsvu/pafSijyxCuvWNt+1AUjnlXr6A1< at >public.gmane.org    |
<http://www.itservices.com.br/> www.itservices.com.br 

Twitter: < at >ivanildogalvao

ntop crashes

Nick Upson — 2011-08-31T10:38:02

Hi,

running pfsense 1.2.3, ntop 3.3.8. after a few mins ntop crashes with the
following message in syslog

 kernel: pid 43126 (ntop), uid 0: exited on signal 11 (core dumped)

packets passed and logged in UI

Mario Ciccarelli — 2011-08-31T09:17:21

Hi,

is there any reason why this type of packets are logged in interface gui even if they are passed by firewall ?

they are all ftp connection and via UI this is the void message: "The rule that triggered this action is:" and nothing is displayed.

328050 rule 77.390.2208.0/0(match): pass in on rl0: 213.92.xxx.172.20 > 10.5.1.1.1231: [|tcp]
327482 rule 77.390.2208.0/0(match): pass in on rl0: 213.92.xxx.172.20 > 10.5.1.1.1232: [|tcp]

this on 1.2.3 (nano bsd platform)

Thanks for help.
---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org
For additional commands, e-mail: support-help-zsHM3v2T5LBBDgjK7y7TUQ< at >public.gmane.org

Commercial support available - https://portal.pfsense.org