Re: [pfSense] A unique problem requires a unique solution. PFsense behind shorewall

2013-09-05 Thread Seth Mos
On 5-9-2013 13:09, Asim Ahmed Khan wrote: Hi, Let me first briefly explain my setup. I have redundant internet link from two ISPs. Before pfsense, I was using two gateway boxes. One for each internet link. Each box is CentOs, with Shorewall + Squid. I have certain rules imposed on each box.

Re: [pfSense] A unique problem requires a unique solution. PFsense behind shorewall

2013-09-05 Thread Asim Ahmed Khan
The point of setting up this way is that pfSense does not offer that kind of Web content filtering which we need and squid provides. I know I can setup squid on pfSense box as well. But being not very expert in pfSense, I don't want to open too many fronts and start fighting on all at once. -

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jim Pingle
On 9/4/2013 8:33 PM, Robert Guerra wrote: Curious on people's comments on types of routers, firewalls and other appliances that might be affected as well as mitigation strategies. Would installing a pfsense and/or other open source firewall be helpful in anyway at a home net location? The

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jim Thompson
On Sep 5, 2013, at 7:57 AM, Jim Pingle li...@pingle.org wrote: But it doesn't matter if the vendors issue a patch, people actually have to install the update to fix it, and odds are high that typical end users have no idea that is even possible or something they have to do. This speaks to a

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jim Pingle
On 9/5/2013 9:43 AM, Jim Thompson wrote: On Sep 5, 2013, at 7:57 AM, Jim Pingle li...@pingle.org wrote: But it doesn't matter if the vendors issue a patch, people actually have to install the update to fix it, and odds are high that typical end users have no idea that is even possible or

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Michael Schuh
The $Customer will have his Pizza and Entertainment well served, functioning and NOW for $0 costs. So how will you provide security under this circumstances? Impossible. Beside the fact, that this entire NSA-Story is funny as hell. Why? Deal with it, deal with the world you (the crowd) would like

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Mark Tinka
On Thursday, September 05, 2013 04:55:31 PM Jim Pingle wrote: I'm not opposed to auto-update if it's done securely and opt-in. Especially if you can schedule the time it takes place (e.g. specific day, specific time frame). The problem with updating router/switch software, as you know, is

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jim Pingle
On 9/5/2013 1:08 PM, Mark Tinka wrote: On Thursday, September 05, 2013 04:55:31 PM Jim Pingle wrote: I'm not opposed to auto-update if it's done securely and opt-in. Especially if you can schedule the time it takes place (e.g. specific day, specific time frame). The problem with

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jim Pingle
On 9/5/2013 9:58 AM, Jim Pingle wrote: On 9/5/2013 9:43 AM, Jim Thompson wrote: On Sep 5, 2013, at 7:57 AM, Jim Pingle li...@pingle.org wrote: But it doesn't matter if the vendors issue a patch, people actually have to install the update to fix it, and odds are high that typical end users

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jim Thompson
Read ‘em and weep: http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?_r=0 My take is that most places don’t enable PFS (because it’s “hard”) in IPSec. In theory, Transport Layer Security (TLS) can choose appropriate ciphers since SSLv3, but in everyday practice

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jeremy Porter
On 9/5/2013 7:57 AM, Jim Pingle wrote: On 9/4/2013 8:33 PM, Robert Guerra wrote: Curious on people's comments on types of routers, firewalls and other appliances that might be affected as well as mitigation strategies. Would installing a pfsense and/or other open source firewall be helpful

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jim Thompson
On Sep 5, 2013, at 12:08 PM, Mark Tinka mark.ti...@seacom.mu wrote: On Thursday, September 05, 2013 04:55:31 PM Jim Pingle wrote: I'm not opposed to auto-update if it's done securely and opt-in. Especially if you can schedule the time it takes place (e.g. specific day, specific time

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Bob Gustafson
On 09/05/2013 08:58 AM, Jim Pingle wrote: On 9/5/2013 9:43 AM, Jim Thompson wrote: On Sep 5, 2013, at 7:57 AM, Jim Pingle li...@pingle.org wrote: But it doesn't matter if the vendors issue a patch, people actually have to install the update to fix it, and odds are high that typical end users

[pfSense] insert a pfsense box to handle high network load (botnet attack)

2013-09-05 Thread Roberto Nunnari
Hi all. I have a problem with my home internet connection. My vdsl router gets on the wan interface about 40-50 requests per second on port 80 and when I configure it so that it forwards that traffic to my web server, the router can't bear the load and freezes after a few seconds. All that

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches

2013-09-05 Thread Jim Thompson
On Sep 5, 2013, at 6:49 PM, Bob Gustafson bob...@rcn.com wrote: The new Apple operating system = Mavericks or iOS 7 will have an autoupdate feature. Which can be disabled. ___ List mailing list List@lists.pfsense.org

Re: [pfSense] insert a pfsense box to handle high network load (botnet attack)

2013-09-05 Thread Vick Khera
It entirely depends on the hardware you use for pfSense as to how much load it can handle. I for one, push a sustained 60-70Mbps, with bursts of 120Mbps or more on a fairly hefty Xeon 64-bit server with 16GB of RAM. I have mostly simple rules, several IPSec and OpenVPN endpoints, and about 8