Re: [pfSense] icmp best practices

2012-03-21 Thread Frank Heydlauf
Hi Chris, On Tue, Mar 20, 2012 at 10:14:54PM -0400, Chris Buechler wrote: ... So you break PMTUd and basic diagnostic functionality for your users?  That seems mean, and utterly pointless.  If you *really* think there's a security issue, rate limit ICMP, but don't block it. ... Depends on

Re: [pfSense] icmp best practices

2012-03-21 Thread David Burgess
On Mon, Mar 19, 2012 at 12:07 PM, David Burgess apt@gmail.com wrote: I have it enabled on all my interfaces I should clarify by saying that I allow ICMP echo requests on all interfaces, not all ICMP. This does not appear to prevent me from receiving other types of ICMP packets, as I can

Re: [pfSense] pfSense error, maybe hard drive?

2012-03-21 Thread David Burgess
On Wed, Mar 21, 2012 at 11:08 AM, Adam Piasecki apiase...@midatlanticbb.com wrote: What hard drive is recommended for pfSense. Or can someone tell me what your running. I use a Lexar Professional 2G and 4G compact flash with the embedded version in a couple of pfsenses. I deployed about a

Re: [pfSense] pfSense error, maybe hard drive?

2012-03-21 Thread Jeppe Øland
I deployed about a dozen Kingston 64G SSDs about a year and a half ago  (in laptops and desktops) and I've seen about a quarter of them fail with different symptoms in each case. Garbage Totally agree. I have gone through 2 Kingston 4GB industrial SSDs so far - and it didn't take long either.

Re: [pfSense] pfSense error, maybe hard drive?

2012-03-21 Thread Ulrik Lunddahl
I always use the Intel 311 SSD's they are 20 GB SLC Drives priced very aggressive for a Single Level Cell drive, have yet to see one fail, and have shipped way over 100 of them for various embedded systems. Med venlig hilsen, Best regards Ulrik Lunddahl Sales Manager - Salgschef PROconsult

Re: [pfSense] pfSense error, maybe hard drive?

2012-03-21 Thread Chris Buechler
On Wed, Mar 21, 2012 at 1:08 PM, Adam Piasecki apiase...@midatlanticbb.com wrote: I'm getting the following error when logging into the box. It's at the top of the page when presented with the username and password prompt. You can not go past the login page.  pretty sure it's due to faulty hard

Re: [pfSense] pfSense error, maybe hard drive?

2012-03-21 Thread Jeppe Øland
I'm getting the following error when logging into the box. It's at the top of the page when presented with the username and password prompt. You can not go past the login page.  pretty sure it's due to faulty hard drives. Indeed it is. We discussed this with the vendor you got them from at

Re: [pfSense] pfSense error, maybe hard drive?

2012-03-21 Thread Chris Buechler
On Wed, Mar 21, 2012 at 2:46 PM, Jeppe Øland jol...@gmail.com wrote: I'm getting the following error when logging into the box. It's at the top of the page when presented with the username and password prompt. You can not go past the login page.  pretty sure it's due to faulty hard drives.

Re: [pfSense] pfSense error, maybe hard drive?

2012-03-21 Thread Dimitri Alexandris
Normal commercial flash will eventually fail. It's not designed for this purpose. We use only industrial products which include error correction blocks and mechanism (transparent to the system), like:

[pfSense] Virtual IPs: Carp or proxy arp?

2012-03-21 Thread Ugo Bellavance
Hi, I was re-reading a book to help my pfsense implementation and in the section about VIPs, it says that some people rather use CARP VIPs instead of proxy arp because of some reasons. Then, looking at http://doc.pfsense.org/index.php/What_are_Virtual_IP_Addresses%3F I see that IP aliases

[pfSense] Site-to-Site VPN, IPSec or OpenVPN

2012-03-21 Thread Ugo Bellavance
Hi, For a simple site-to-site VPN (main office to DR site), what is most recommended? I used IPSec in the past and it worked well. We will have multiple subnets in the main office, but I've read on it and I understand that I may have to configure the networks in the vpn connection

Re: [pfSense] Virtual IPs: Carp or proxy arp?

2012-03-21 Thread Adam Thompson
Based on that very high-level summary: -assuming the /28 isn't a true routed /28, -set pfSense's WAN IP to the first IP in the range (or reserve the first three if using CARP for HA) -set all remaining IPs as CARP-type aliases, and implement inbound NAT a necessary (maybe including 1:1 for the

Re: [pfSense] Site-to-Site VPN, IPSec or OpenVPN

2012-03-21 Thread Oliver Hansen
Ipsec works but I've found it much easier to use OpenVPN when that's an option. Easier to do real routing as well. On Mar 21, 2012 6:01 PM, Ugo Bellavance u...@lubik.ca wrote: Hi, For a simple site-to-site VPN (main office to DR site), what is most recommended? I used IPSec in the past and

[pfSense] NAT kills connections

2012-03-21 Thread David Burgess
I hate to resurrect an old thread, but this was never resolved for me, and the workaround that I was using is no longer valid due to a change in the situation. The old thread is here: http://www.mail-archive.com/list@lists.pfsense.org/msg00260.html, but just to quickly recap, I have a web server