[go: up one dir, main page]

Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

Categories

  • Discussions about TNSR

    379 Topics
    1k Posts
    M
    Not sure why but there is no ability to log ACLs or VPFs rules. I cant troubleshoot when i dont know if an ACL rule is blocking or accepting a connection. To say nothing for auditing and having those logs sent to a syslog collector...

  • Discussions about pfSense Software, click a category below

    122k Topics
    783k Posts
    H
    @makeitso said in I tried, I can't get it to work: @johnpoz Thank you for replying! Specifically, I want to expose the web gui. Like I said, I want haproxy to handle the certificates. I want to expose WebDAV, sftp and possibly carddav on only one of the NAS devices. I’m not sure if that’s realistic or not. I have ports exposed to enable those protocols but would rather have a few ports as possible. I have no intention to expose smb. If I wanted to do that, I would use a VPN. It would not be publicly available. I believe I mention Nextcloud and mailcow in my first post.not sure those are possible either.. Nextcloud would be talk and the web interface, WebDAV, cardav and whatever it takes to make those work. I have haproxy sort of working but not as well as I’d like. I hope that clears it up a bit. Thanks, Jack To expose services, just use port foward. No need to use haproxy. That is for web servers

  • Discussions about pfSense software packages

    21k Topics
    130k Posts
    LaxarusL
    Hi, Just curious is there a bug in the current squid package when using transparent proxy? When the transparent proxy is enabled, the certs served by the squid package do not contain proper common names and altdns names but only ip address as CN. This creates certificate errors on the browsers. However, when the proxy is set manually, it works normally. My config with transparent proxy enabled: # This file is automatically generated by pfSense # Do not edit manually ! http_port 192.168.100.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=100MB cert=/usr/local/etc/squid/serverkey.pem tls-cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1 http_port 192.168.26.1:3128 http_port 192.168.99.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=100MB cert=/usr/local/etc/squid/serverkey.pem tls-cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1 http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=100MB cert=/usr/local/etc/squid/serverkey.pem tls-cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1 https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=100MB cert=/usr/local/etc/squid/serverkey.pem tls-cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1 icp_port 0 digest_generation off dns_v4_first on pid_filename /var/run/squid/squid.pid cache_effective_user squid cache_effective_group proxy error_default_language en icon_directory /usr/local/etc/squid/icons visible_hostname localhost cache_mgr admin@localhost access_log /var/squid/logs/access.log cache_log /var/squid/logs/cache.log cache_store_log none netdb_filename /var/squid/logs/netdb.state pinger_enable on pinger_program /usr/local/libexec/squid/pinger sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048 tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt tls_outgoing_options capath=/usr/local/share/certs/ tls_outgoing_options options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1 tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls_outgoing_options flags=DONT_VERIFY_PEER sslcrtd_children 50 sslproxy_cert_error allow all sslproxy_cert_adapt setValidAfter all sslproxy_cert_adapt setValidBefore all sslproxy_cert_adapt setCommonName all logfile_rotate 10 debug_options rotate=10 shutdown_lifetime 3 seconds # Allow local network(s) on interface(s) acl localnet src 192.168.100.0/24 192.168.99.0/24 192.168.26.0/24 forwarded_for on uri_whitespace strip dns_nameservers 192.168.100.1 acl dynamic urlpath_regex cgi-bin \? cache deny dynamic cache_mem 2048 MB maximum_object_size_in_memory 256 KB memory_replacement_policy heap GDSF cache_replacement_policy heap LFUDA minimum_object_size 0 KB maximum_object_size 4 MB cache_dir ufs /var/squid/cache 1000 16 256 offline_mode off cache_swap_low 90 cache_swap_high 95 cache allow all # Add any of your own refresh_pattern entries above these. refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 #Remote proxies # Setup some default acls # ACLs all, manager, localhost, and to_localhost are predefined. acl allsrc src all acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 3128 3129 1025-65535 acl sslports port 443 563 acl purge method PURGE acl connect method CONNECT # Define protocols used for redirects acl HTTP proto HTTP acl HTTPS proto HTTPS # SslBump Peek and Splice # http://wiki.squid-cache.org/Features/SslPeekAndSplice # http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit # Match against the current step during ssl_bump evaluation [fast] # Never matches and should not be used outside the ssl_bump context. # # At each SslBump step, Squid evaluates ssl_bump directives to find # the next bumping action (e.g., peek or splice). Valid SslBump step # values and the corresponding ssl_bump evaluation moments are: # SslBump1: After getting TCP-level and HTTP CONNECT info. # SslBump2: After getting TLS Client Hello info. # SslBump3: After getting TLS Server Hello info. # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that # they can be used there for custom configuration. acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 acl allowed_subnets src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl" acl sslwhitelist ssl::server_name_regex -i "/var/squid/acl/whitelist.acl" http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !safeports http_access deny CONNECT !sslports # Always allow localhost connections http_access allow localhost request_body_max_size 0 KB delay_pools 1 delay_class 1 2 delay_parameters 1 -1/-1 -1/-1 delay_initial_bucket_level 100 delay_access 1 allow allsrc # Reverse Proxy settings # Custom options before auth # Always allow access to whitelist domains http_access allow whitelist ssl_bump peek step1 ssl_bump splice sslwhitelist ssl_bump bump all # Setup allowed ACLs # Allow local network(s) on interface(s) http_access allow allowed_subnets http_access allow localnet # Default block all to be sure http_access deny allsrc It only works properly if I uncheck the transparent proxy and manually enter the proxy details in the clients.

  • Discuss pfSense in other languages

    43k Topics
    268k Posts
    D
    Update Heute Morgen ist der Fehler erneut aufgetreten. Hier der relevante Auszug aus dem Authentifizierungs-Log: Jul 27 08:58:52 openvpn 64884 /openvpn.auth-user.php: ERROR! Could not bind to LDAP server contriaINT. Please check the bind credentials. Jul 27 08:58:45 openvpn 64884 user 'User_3 could not authenticate. Jul 27 08:58:45 openvpn 64884 /openvpn.auth-user.php: ERROR! Could not bind to LDAP server contriaINT. Please check the bind credentials. Jul 27 08:58:40 openvpn 64884 user 'User_3' could not authenticate. Jul 27 08:58:40 openvpn 64884 /openvpn.auth-user.php: ERROR! Could not bind to LDAP server contriaINT. Please check the bind credentials. Jul 27 08:42:45 openvpn 64884 user 'User_4' could not authenticate. Jul 27 08:42:45 openvpn 64884 /openvpn.auth-user.php: ERROR! Could not bind to LDAP server contriaINT. Please check the bind credentials. Jul 27 08:38:10 openvpn 54810 user 'User_1' authenticated Jul 27 08:38:00 openvpn 33838 user 'User_1' authenticated Jul 27 08:37:58 openvpn 28831 user 'User_5' authenticated Jul 27 08:37:53 openvpn 64884 user 'User_1' could not authenticate. Jul 27 08:37:53 openvpn 64884 /openvpn.auth-user.php: ERROR! Could not bind to LDAP server contriaINT. Please check the bind credentials. Jul 27 08:36:56 php-fpm 84141 /index.php: Successful login for user 'admin' from: 10.49.255.204 (Local Database) Jul 27 08:36:45 php-fpm 84141 /index.php: Session timed out for user 'admin' from: 10.49.255.204 (Local Database) Jul 27 08:17:36 openvpn 84141 user 'User_2' authenticated Spannendes Detail im Log: Während der PHP-Prozess mit der PID 64884 dauerhaft fehlschlägt, konnten andere PIDs (28831, 33838, 54810) dazwischen erfolgreich authentifizieren. Das Problem betrifft also offenbar gezielt hängende PHP-Worker-Prozesse bzw. veraltete Socket-Handles. Ich habe sofort folgende Tests auf der pfSense-Konsole durchgeführt, während der Fehler aktiv war: Ping auf den Hostnamen des DCs: Erfolgreich. DNS-Auflösung des DCs: Funktionierte, wirkte aber gefühlt etwas verzögert ("hat ein wenig gedauert"). Zertifikat via OpenSSL: openssl s_client -connect <DC_IP>:636 -showcerts hat sofort das korrekte LDAPS-Zertifikat geliefert. PHP-FPM Restart: Ich habe /etc/rc.php-fpm_restart ausgeführt. Direkt danach funktionierte die OpenVPN-Authentifizierung sofort wieder für alle Benutzer! Hat jemand eine Idee, wie ich dieses Problem in den Griff bekomme?

  • Information about hardware available from Netgate

    3k Topics
    21k Posts
    M
    For reference: https://github.com/influxdata/telegraf/issues/19072 https://github.com/snowflakedb/gosnowflake/issues/1800

  • Information about hardware available from Netgate

    44 Topics
    211 Posts
    AriKellyA
    It looks like unified web management could be coming soon. It would be great if it means easier control and management of all web services in one place. Let's see if any companies announce more details about it!

  • Feel free to talk about anything and everything here

    4k Topics
    19k Posts
    stephenw10S
    You should just set the identifier to something specific but valid. So I'd use FQDN, it doesn't change with actual IP address used. It only needs to match at each end.
Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.
Privacy Policy · Cookie Policy