Re: [pfSense] Host Overrides in Services/DNS Forwarder not working until manual restart of DNS Forwarder Service

2017-05-14 Thread Stefan Baur
smasq[32840]: reading /etc/resolv.conf May 15 07:43:45 cora dnsmasq[32840]: ignoring nameserver 127.0.0.1 - local interface May 15 07:43:45 cora dnsmasq[32840]: using nameserver 192.168.0.1#53 May 15 07:43:45 cora dnsmasq[32840]: read /etc/hosts - 7 addresses May 15 07:43:45 cora dnsmasq[32840

[pfSense] Host Overrides in Services/DNS Forwarder not working until manual restart of DNS Forwarder Service

2017-05-13 Thread Stefan Baur
correct result from the start. This somehow doesn't look right. Any insights? Bug in pfSense or misconfiguration on my side? Kind Regards, Stefan Baur ___ pfSense mailing list https://lists.pfsense.org/mailman/listinfo/list Support the project with Gold! https://pfsense.org/gold

Re: [pfSense] Loading pfSense on Netgate 1U rack mount server c2758

2015-07-02 Thread Stefan Baur
Am 02.07.2015 um 21:29 schrieb Chris Buechler: > On Thu, Jul 2, 2015 at 1:31 PM, Paul Upson > wrote: >> ...and am now trying to load pfSense onto it >> using a usb stick. ... > ... The > memstick is your best bet, write that out to a USB flash drive, boot > from it and do the install. Looks to

[pfSense] [OT] Re: serial port sadness

2015-02-27 Thread Stefan Baur
Am 27.02.2015 um 23:24 schrieb Sean: > Although... you reminded me of a good story. Once upon a time I worked > for this startup company trying to develop a device that was programmed > over serial. > Some argument between owner and guy who did original dev work left us > with a device and a crapp

Re: [pfSense] More ports

2014-12-13 Thread Stefan Baur
Am 14.12.2014 um 03:06 schrieb Chris Bagnall: > > (I've listed HP models because that's what I've experience with, no > doubt other manufacturers have similar models. Just watch out for some > of the cheap Netgears that claim to be 'managed' (model beginning J I > think) - they have a horrible Ado

Re: [pfSense] OpenVPN & Non-admin users.

2014-12-01 Thread Stefan Baur
Am 01.12.2014 um 21:37 schrieb Karl Fife: > I'd like to poll how others have dealt with the issue of non-admin > Windows users running OpenVPN (TUN) for remote access. > > If you recall, non-admin users don't have the privileged of inserting a > routes, so even though the tunnel is is established,

Re: [pfSense] OT: Good network switch for 10 machines?

2014-09-23 Thread Stefan Baur
Am 23.09.2014 um 20:56 schrieb Chris Bagnall: > Be careful which model you get. Some of the newer/cheaper ones that have > been sold as 'managed' recently don't have a web interface. They have > some horrible management application that uses Adobe Air, only works on > Windows, only communicates wit

Re: [pfSense] Returned mail: Data format error

2014-09-08 Thread Stefan Baur
Am 08.09.2014 um 14:45 schrieb Bob Gustafson: > Is anyone else on this list getting bounce notices? That's no bounce notice, that's just another lame attempt at getting you to open an infected attachment. Darn spammers. -Stefan ___ List mailing list Li

[pfSense] OpenVPN not working any more after Upgrade to 2.1.4-RELEASE

2014-08-05 Thread Stefan Baur
Hi List, my OpenVPN doesn't work any more. The OpenVPN log file on the server says: Aug 5 14:46:53 openvpn[32895]: Exiting due to fatal error Aug 5 14:46:53 openvpn[32895]: Cannot load certificate file /var/etc/openvpn/server2.cert: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:

Re: [pfSense] ZFS warning message on local console during boot

2014-07-30 Thread Stefan Baur
Am 30.07.2014 um 23:47 schrieb Jim Thompson: JT> no pfSense we produce has an installer that will make a zfs filesystem. JT> JT> Try again? Well, "mount" doesn't show any mounted zfs filesystems (only ufs, devfs, and msdosfs - the latter's where the config file is stored) which makes this error m

Re: [pfSense] ZFS warning message on local console during boot

2014-07-30 Thread Stefan Baur
Am 30.07.2014 um 23:34 schrieb Jim Thompson: > tl;dr: I wouldn’t run ZFS… yet. > > I didn’t see the error message, you’re barking up a tree attempting to use it > right now. Again, I don't care what FS pfSense uses under the hood as long as it works. I didn't make a conscious decision to insta

Re: [pfSense] ZFS warning message on local console during boot

2014-07-30 Thread Stefan Baur
Am 30.07.2014 um 22:09 schrieb Espen Johansen: > ZFS = FS+LVM. Its efficient in many ways. Its highly resillient to > things like silent data corruption ( disk FW bugs, power spikes). It has > on the fly checking and repair. Copy on write, snapshoting, NFSv4 native > acls and a few more nice things

Re: [pfSense] ZFS warning message on local console during boot

2014-07-30 Thread Stefan Baur
Am 30.07.2014 um 16:43 schrieb Vick Khera: > On Wed, Jul 30, 2014 at 9:50 AM, Paul Mather wrote: >> Personally, I think ZFS on i386 has become a losing proposition as of >> late. I ran a ZFS-on-root FreeBSD/i386 10-STABLE system with 2 GB of >> RAM and it appeared to become very flaky with ZFS in

[pfSense] ZFS warning message on local console during boot

2014-07-30 Thread Stefan Baur
Hi list, I'm seeing the following warning on my pfsense 2.1.4-RELEASE (i386): ZFS WARNING: Recommended minimim kmem_size is 512MB; expect unstable behavior. Consider tuning vm.kmem_size and vm.kmem_size_max in /boot/loader.conf Currently, the values are: vm.kmem_size="525544320" vm.kmem_size_max

Re: [pfSense] How to Enable/Disable DynDNS update e-mail notifiations?

2014-07-11 Thread Stefan Baur
Am 10.07.2014 16:57, schrieb Jim Pingle: >> (I'm kinda curious whether no one uses e-mail notifications in >> combination with DynDNS, or why I'm the first to notice/complain. I >> can't really imagine an "everything OK" e-mail being a desired feature >> for DynDNS updates, given their frequency.)

Re: [pfSense] How to Enable/Disable DynDNS update e-mail notifiations?

2014-07-10 Thread Stefan Baur
Am 10.07.2014 16:52, schrieb Peder Rovelstad: > Just saying, but I get one email a month; my WAN on Comcast DHCP. But if I > did get a change, I think I'd want to know. One more email is the least of > my problems, lol. Over here, DSL has dynamic IPs, changing with every reconnect and at least e

Re: [pfSense] How to Enable/Disable DynDNS update e-mail notifiations?

2014-07-10 Thread Stefan Baur
Am 10.07.2014 15:15, schrieb Jim Pingle: > On 7/10/2014 4:27 AM, Stefan Baur wrote: >> since upgrading to 2.1.3-RELEASE and enabling e-mail notifications under >> "System: Advanced: Notifications", I'm receiving an e-mail whenever the >> DynDNS update s

Re: [pfSense] How to Enable/Disable DynDNS update e-mail notifiations?

2014-07-10 Thread Stefan Baur
Am 10.07.2014 14:34, schrieb Ryan Coleman: > What I am saying it Dyn is the one that controls if it is updated or not. That's really not the point. The point is that I'm receiving alert e-mails from *my pfSense installation*. Not from Dyn. And the message of the alert is "DynDNS updated IP Addres

Re: [pfSense] How to Enable/Disable DynDNS update e-mail notifiations?

2014-07-10 Thread Stefan Baur
Am 10.07.2014 14:16, schrieb Giles Coochey: > On 10/07/2014 13:05, Ryan Coleman wrote: >> I am not sure that’s how Dyn works? >> As far as I understand it Dyn gets a request and it looks at the >> originating IP address, then makes the change. >> >> > I believe that it is possible to send DynDNS up

Re: [pfSense] How to Enable/Disable DynDNS update e-mail notifiations?

2014-07-10 Thread Stefan Baur
Am 10.07.2014 14:05, schrieb Ryan Coleman: > I am not sure that’s how Dyn works? > As far as I understand it Dyn gets a request and it looks at the originating > IP address, then makes the change. It's supposed to update the DNS entry, yes, but I don't want to receive an e-mail notification for

[pfSense] How to Enable/Disable DynDNS update e-mail notifiations?

2014-07-10 Thread Stefan Baur
[I had already posted a similar message on 2014-06-27, but as it didn't get any replies, I'm trying again, slightly rephrased] Hi, since upgrading to 2.1.3-RELEASE and enabling e-mail notifications under "System: Advanced: Notifications", I'm receiving an e-mail whenever the DynDNS update script

Re: [pfSense] Problem using wlan on mobile device with pptp, LCP: parameter negotiation failed

2014-07-04 Thread Stefan Baur
udcracker project went live. They offer to crack every PPTP access within 24h for a fee of 200 USD (See first heise.de link). -Stefan Baur ___ List mailing list List@lists.pfsense.org https://lists.pfsense.org/mailman/listinfo/list

[pfSense] How do I set what gets reported by mail and what doesn't?

2014-06-27 Thread Stefan Baur
Hi, one of my pfSenses just surprised me with an e-mail message Subject: - Notification "DynDNS updated IP Address on WAN (em0) to XXX.XXX.XXX.XXX" This is on 2.1.3-RELEASE. I do want e-mail notifications, just not for such mundane things, only when stuff breaks. So how do I configure that?

Re: [pfSense] skype 29 minute fail

2014-06-16 Thread Stefan Baur
Am 16.06.2014 22:50, schrieb Vick Khera: > FWIW I just did a call with the firewall set to "conservative" state > management. Still 29 minutes until voice quality fail. I'm anything but a Skype expert, but have you tried blocking your Skype installs from becoming supernodes? On Windows: HKEY_LOCA

[pfSense] Please update the pfSense Wiki with the attached note

2014-06-11 Thread Stefan Baur
Hi Jim (or anyone with editing rights on the Wiki): Coud you please update https://doc.pfsense.org/index.php/VirtIO_Driver_Support by adding a note at the bottom of the "Loading Kernel Modules" section: With the current (2014-06-11) state of virtio network drivers in FreeBSD, it is necessary to

Re: [pfSense] Weird routing issue with pfSense-2.1.3-RELEASE-i386, Debian Wheezy, kvm and virtio

2014-06-10 Thread Stefan Baur
Am 10.06.2014 22:52, schrieb Karsten Gorling: > * Stefan Baur [140610 17:59]: >> This works all fine and dandy as long as I'm not using virtio: > > I had the same Problem. Essentially the VirtIO Network Drivers of > FreeBSD are broken, you have to use another virtua

Re: [pfSense] Weird routing issue with pfSense-2.1.3-RELEASE-i386, Debian Wheezy, kvm and virtio

2014-06-10 Thread Stefan Baur
Am 10.06.2014 22:52, schrieb Karsten Gorling: > * Stefan Baur [140610 17:59]: >> This works all fine and dandy as long as I'm not using virtio: > > I had the same Problem. Essentially the VirtIO Network Drivers of > FreeBSD are broken, you have to use another virtua

[pfSense] Weird routing issue with pfSense-2.1.3-RELEASE-i386, Debian Wheezy, kvm and virtio

2014-06-10 Thread Stefan Baur
Hi everyone, I am running a Debian Wheezy host with the following setup: bridge br0 - 192.168.133.100 - contains: 1) physical LAN interface of Host 2) virtual LAN interface of pfSense guest - 192.168.133.1 bridge br1 - 192.168.0.41 (DHCP) - contains: 1) physical WAN interface of Host 2) virtual

[pfSense] Display error, 2.1.3-RELEASE-i386, network device names on CLI

2014-06-10 Thread Stefan Baur
Dear pfSense maintainers, I decided to give the KVM/virtio support in pfsense 2.1.3-RELEASE-i386 a spin. Looks good so far, but there's a display error when the machine boots and tries to load the config file. Obviously, pfSense is confused as the network device names don't match the saved values

Re: [pfSense] Restoring from XML prevents VM from booting [SOLVED]

2014-06-08 Thread Stefan Baur
Am 06.02.2014 18:43, schrieb Brian Candler: >>> I find that the one restored >>> >via web interface has: >>> > >>> >* an extra file /boot.config containing "-D" >>> >* extra settings in /boot/loader.conf >>> > >>> >boot_multicons="YES" >>> >boot_serial="YES" >>> >comconsole_speed="115200" >>> >cons

[pfSense] [OT] Re: vmware

2014-05-28 Thread Stefan Baur
Am 28.05.2014 17:36, schrieb Adam Thompson: > Do yourself a favor, then, and don't use VMware on it. That's akin to > deliberately installing a Windows 2000 domain controller today... Some people ... just want to see the fans churn! SCNR, Stefan

Re: [pfSense] apu.4c silently dies

2014-05-21 Thread Stefan Baur
Am 21.05.2014 22:53, schrieb mayak: > i'll be curious to see pc engines proposes a new mounting/heat sync > method. if the case had air flow slits on top and on the sides, i'd bet > that it would be much cooler. Out of curiosity, did you buy a new case for you APU or or recycle an old one from an

Re: [pfSense] My son is able to bypass my captivate portal

2014-05-11 Thread Stefan Baur
Am 11.05.2014 21:28, schrieb Ryan Coleman: >> The simple solution is to block all outbound DNS at the firewall, but >> this can also break things (like some Google and Apple devices). >> Even broken devices usually have a fallback mode, but be careful of >> what breaks when you do this! > Correct

Re: [pfSense] Interface options for pfsense

2014-04-22 Thread Stefan Baur
Am 22.04.2014 18:29, schrieb Jim Thompson: > It's not like we disabled the hme driver. Nobody accused you of intentionally disabling it. Manure happens. :-) Relax. > We have no ability to test it, since we don't have one of these cards. Nor > are we likely to invest in one. Over in the "Inter

Re: [pfSense] Interface options for pfsense

2014-04-22 Thread Stefan Baur
Am 22.04.2014 17:12, schrieb Jim Thompson: > Hardly. > > Before damning pfSense, please try it on something other than "scrapped > PCs" containing an Ethernet controller from 1998: He wasn't damning pfSense in general, nor pfSense's network drivers in general, he was damning the combination of t

Re: [pfSense] Interface options for pfsense

2014-04-22 Thread Stefan Baur
Am 22.04.2014 14:19, schrieb Vick Khera: > I disagree that is a sufficient condition, unless you restrict this > statement to hme interfaces. >From his previous posts, I think it's pretty obvious that that is what he meant. :-) -Stefan ___ List mailing

Re: [pfSense] Interface options for pfsense

2014-04-21 Thread Stefan Baur
Am 21.04.2014 02:13, schrieb Volker Kuhlmann: > There is no 'doze in the house and on no account will I add a > Billy-dependency to my infrastructure. Any manufacturer too stupid to make > their stuff controllable by open source software can sell elsewhere. > Period. Well, there is http://sourcef

Re: [pfSense] Interface options for pfsense

2014-04-20 Thread Stefan Baur
Am 21.04.2014 00:40, schrieb Stefan Baur: > I heard the 8-port model GS108E is actually easier to configure (Web GUI > instead of Adobe-Air-based proprietary tool), but I can't claim personal > experience with that, so don't take my word for it, but ask someone who >

Re: [pfSense] Interface options for pfsense

2014-04-20 Thread Stefan Baur
Am 21.04.2014 00:32, schrieb Volker Kuhlmann: > The frequently recommended option of using VLANs may look good for > larger commercial networks, but just buying a VLAN capable switch costs > more than a suitable pfsense box and brings the power budget of the > combination to the same level as a scr

Re: [pfSense] Blast from the past: pfSense 1.2 / ALIX / VLANs

2014-03-24 Thread Stefan Baur
Am 24.03.2014 14:18, schrieb Chris Bagnall: > However, the new tenant found that performance was erratic - certain > websites loaded instantly, but others wouldn't load at all. This > normally screams classic MTU problems, in my experience, but I normally > see these on weird WAN connections, not o

Re: [pfSense] http://pfsense.org/ip.php and wget

2014-03-19 Thread Stefan Baur
Am 19.03.2014 22:35, schrieb Chris Buechler: > Oh you're one of those people that's hammering us with wget requests > to ip.php. :p Was curious why people would be hitting it like that. > There are a few hundred IPs that query it once a minute or so. Um, nope. Requests get sent out once a day, whe

Re: [pfSense] http://pfsense.org/ip.php and wget

2014-03-19 Thread Stefan Baur
Am 19.03.2014 21:11, schrieb jungleboogie0: > Just curious why you would not use curl. Using it now, as per Brian's suggestion. > IS your objective to get your > current IP address? Yes, on a machine that has no GUI, only a command line. -Stefan ___

Re: [pfSense] http://pfsense.org/ip.php and wget

2014-03-19 Thread Stefan Baur
Am 19.03.2014 10:51, schrieb Brian Candler: > That's a problem I can replicate with Debian Wheezy. I find that > > openssl s_client -CApath /etc/ssl/certs -connect pfsense.org:443 > > is happy, so my guess it's a problem with wget 1.13.4 - maybe it doesn't > do SNI. In that case, the solution is

Re: [pfSense] http://pfsense.org/ip.php and wget

2014-03-19 Thread Stefan Baur
Am 19.03.2014 10:18, schrieb A Mohan Rao: > Hello, > i have configured openvpn road warrior also client is properly connected > from outside internet network. > but not able to access server end network and servers's. > can anybody give any help where is do any wrong steps. This has nothing to do

Re: [pfSense] http://pfsense.org/ip.php and wget

2014-03-19 Thread Stefan Baur
Am 19.03.2014 10:09, schrieb Stefan Baur: > Hi List, > > is there a particular reason why wgetting http://pfsense.org/ip.php > gives a blank result? Works just fine when using a regular GUI browser > like Firefox, but not on the command line with wget. Oh. I just noticed it&#

[pfSense] http://pfsense.org/ip.php and wget

2014-03-19 Thread Stefan Baur
Hi List, is there a particular reason why wgetting http://pfsense.org/ip.php gives a blank result? Works just fine when using a regular GUI browser like Firefox, but not on the command line with wget. -Stefan ___ List mailing list List@lists.pfsense.org

Re: [pfSense] Restoring from XML prevents VM from booting [SOLVED]

2014-02-06 Thread Stefan Baur
Am 06.02.2014 13:10, schrieb Brian Candler: > On 05/02/2014 17:47, Espen Johansen wrote: >> Might be that serial redirection makes it show nothing. > Yes, the serial port was the problem - thank you! Interesting ... > The production physical box (which this XML was pulled from) *was* > configure

Re: [pfSense] Restoring from XML prevents VM from booting

2014-02-05 Thread Stefan Baur
Am 05.02.2014 18:41, schrieb Brian Candler: > This is a really strange behaviour, I wonder if anyone has seen anything > similar. /me raises his hand > I've just been trying to replicate a production config in a VirtualBox > VM (vbox 4.3.6, OSX 10.9.1). I'm using KVM on Debian Linux (Wheezy/7).

Re: [pfSense] Squid version for pfSense 2.1

2014-01-28 Thread Stefan Baur
Am 28.01.2014 17:56, schrieb Chris Bagnall: > In this context, it's basically a method of caching things like Windows > / Apple updates for an IT company, especially when there are 4 or 5 > engineers all working on clients' machines simultaneously. Little point > in downloading the same update for

[pfSense] Connection issues after changing from 2.0.3-RELEASE to 2.1-RELEASE

2013-12-12 Thread Stefan Baur
Hi List, I'm kind of stumped by this. Situation: pfSsense with 3 Interfaces WAN: 192.168.0.161/24 (DHCP) LAN: 192.168.133.1/24 OPT1 (renamed "DMZ"): 172.16.0.2/12 What I did: 1) fresh install of 2.1-RELEASE as virtual machine (KVM on Linux host), with same virtual machine settings as for 2.0.3

Re: [pfSense] Problems with Realtek 8168/8111 nic

2013-12-11 Thread Stefan Baur
Am 11.12.2013 16:14, schrieb Adrian Zaugg: This device is quite new, embedded industrial design, 2GB of RAM. A "Lex Twister" (http://www.lex.com.tw/product/TWISTER.html), by any chance? They don't play along well with some brands of RAM. Not all sellers know about this, though. Kingston seem

[pfSense] OpenVPN issues with iOS OpenVPN client

2013-12-04 Thread Stefan Baur
Hi List, I'm having trouble getting an iPhone connect to my pfSense OpenVPN installation. On the Server, I'm seeing: openvpn[2371]: [remote IP here]:11125 WARNING: Bad encapsulated packet length from peer (1404), which must be > 0 and <= 1300 -- please ensure that --tun-mtu or --link-mtu is

Re: [pfSense] Please update the Wiki with the following information

2013-12-01 Thread Stefan Baur
Am 01.12.2013 15:28, schrieb Adam Thompson: [FEAT VPN now available free of charge w/o time limit] I'll note that this only became visible to me on the Play store *today* (Sunday). As of yesterday (Saturday), I was still seeing the Free version and the Pro version in the Play store. I'm not s

Re: [pfSense] Please update the Wiki with the following information

2013-12-01 Thread Stefan Baur
Am 01.12.2013 03:15, schrieb Jim Thompson: "Android 2.1 - 3.2: The FEAT VPN client, which claims to not require root access and to work on older versions of Android. The free version is limited to 1hr/day of use." How is this inaccurate? The free version is limited to 1hr/day according to ww

Re: [pfSense] Please update the Wiki with the following information

2013-11-30 Thread Stefan Baur
Am 30.11.2013 18:34, schrieb Adam Thompson: On 13-11-29 03:00 PM, Stefan Baur wrote: Hi, would somebody with editing privileges please update https://doc.pfsense.org/index.php/Android_VPN_Connectivity#pfSense_2.0 with the following information: Done. Please check and ensure I've under

[pfSense] Please update the Wiki with the following information

2013-11-29 Thread Stefan Baur
Hi, would somebody with editing privileges please update https://doc.pfsense.org/index.php/Android_VPN_Connectivity#pfSense_2.0 with the following information: FEAT VPN is now available free of charge and brings OpenVPN Connectivity to 2.x and 3.x Androids. FEAT VPN works on 4.x, too, with a

Re: [pfSense] naive suggestion: conform to US laws

2013-10-15 Thread Stefan Baur
Am 15.10.2013 16:15, schrieb Jim Thompson: So what excuse do I have, given that I was stone sober? (In France at the time, but still… sober.) Maybe you were immersed long enough to assimilate the French attitude? (Think "French Soldier" in "Monty Python and the Holy Grail" - http://www.imdb.co

Re: [pfSense] Sanity check on Routing with pfSense

2013-05-24 Thread Stefan Baur
Am 24.05.2013 22:25, schrieb Jeffrey Mealo: Will be pfSense be running on bare metal or virtualized? pfSense has issues running on some hypervisors including KVM. It has? I haven't noticed any, and I'm running it on some 40-50 machines, since 2011 or so. This is Debian Squeeze with KVM. Care

Re: [pfSense] 2.0.1-RELEASE, dual-WAN with loadbalancing

2013-02-19 Thread Stefan Baur
Am 19.02.2013 23:06, schrieb Stefan Baur: You may find enabling 'sticky connections' in Advanced Settings might do what you wish. That's not quite where I would have searched for it, but it's great that the feature already exists. Thanks for the pointer! :-) Seems I

Re: [pfSense] 2.0.1-RELEASE, dual-WAN with loadbalancing

2013-02-19 Thread Stefan Baur
Am 19.02.2013 22:54, schrieb Chris Bagnall: I'm using 2.0.1-RELEASE, in a dual-WAN configuration with loadbalancing. Some websites that require a login apparently do not like that, as I'm constantly being asked to re-authenticate. Is there a way to make pfSense remember the pairs of source an

[pfSense] 2.0.1-RELEASE, dual-WAN with loadbalancing

2013-02-19 Thread Stefan Baur
Hi list, I'm using 2.0.1-RELEASE, in a dual-WAN configuration with loadbalancing. Some websites that require a login apparently do not like that, as I'm constantly being asked to re-authenticate. Is there a way to make pfSense remember the pairs of source and destination IP, and only use the

[pfSense] Turning UDP broadcast into a unicast on another interface

2012-10-02 Thread Stefan Baur
Hi list, is it possible to have pfSense act upon receiving a UDP broadcast on one specific port on one interface, and turn it into a unicast to a known IP on another interface? And if yes, will I have to set up a second rule so the answer packet reaches its destination on the other interface?

Re: [pfSense] NATting/re-routing in the same network, is this possible?

2012-10-01 Thread Stefan Baur
Am 30.09.2012 03:53, schrieb Chris Buechler: If I'm following, you're redirecting out the same interface the traffic comes in on. That is correct. In that case you have to source NAT the redirected connection to the firewall's IP. What's happening now is the firewall directs it to the server,

Re: [pfSense] NATting/re-routing in the same network, is this possible?

2012-09-29 Thread Stefan Baur
Am 29.09.2012 13:56, schrieb Adrian Wenzel: Out of curiosity, what's the DNS setup? We've had... issues with DNS, thanks to the mixed Windows(AD)/Unix environment. So I'd prefer using IPs. That way, the setup works even when DNS is misconfigured/taking a day off/moody/whatever. -Stefan __

[pfSense] NATting/re-routing in the same network, is this possible?

2012-09-29 Thread Stefan Baur
Hi List, I have multiple sites where several clients (C1...Cn) within the same LAN need to connect a server (S). The pfSense box acts a router (R) at all these sites. The router IP on the LAN side is the same everywhere. The server IP varies from site to site, though. Ex: Site 1

Re: [pfSense] Android VPN with pfSense

2012-09-08 Thread Stefan Baur
Am 08.09.2012 10:16, schrieb Paul Gear: I'll leave others to discuss the relative security merits of each (but yes, L2TP by itself will not encrypt). [...] If you have a PPTP VPN, you should read http://isc.sans.edu/diary/End+of+Days+for+MS-CHAPv2/13807 I'm working on a plan to eradicate all

[pfSense] Android VPN with pfSense

2012-09-08 Thread Stefan Baur
Hi List, I have an Android phone that offers - PPTP-VPN - L2TP-VPN - L2TP/IPSec PSK-VPN - L2TP/IPSec CRT-VPN (That's Android 2.2.1, but possibly with certain backports or vendor-specific extensions by Motorola) I would like to connect it to my pfSense 2.0.1-RELEASE box so I have a secure co

Re: [pfSense] SSH error

2012-08-28 Thread Stefan Baur
Am 28.08.2012 12:19, schrieb Pankaj Kumar: sshd is running and gateway is also same as configured on PfSense Well, that sounds wrong. The gateway on the ssh server should not be the same as the one you set in pfSense for its upstream connection, but the IP of the interface your pfSense box h

Re: [pfSense] SSH error

2012-08-28 Thread Stefan Baur
Am 28.08.2012 12:11, schrieb Pankaj Kumar: yes i can access locally from any system in the network ^^ That might be the crucial hint. Check that the box running the sshd has the right gateway address. I've seen the same issue with CUPS t

Re: [pfSense] DynDNS troubles, once again

2012-07-27 Thread Stefan Baur
Am 27.07.2012 12:54, schrieb Frank: >>- does ist still works, if you call /etc/rc.dyndns.update manually ? Main difference between /etc/rc.dyndns.update and wget -O- ... is that rc.dyndns.update uses the system config. So: wget working and rc.dyndns.update not would indicate a config error. Bu

Re: [pfSense] DynDNS troubles, once again

2012-07-27 Thread Stefan Baur
Am 27.07.2012 12:54, schrieb Frank: BTW: Have you thought about using an own DynDNS Server? Thought about it, yes. But won't help in this particular case, as my customer insists on using no-ip; he recently migrated away from DynDNS to no-ip and doesn't want to perform another migration. I ta

Re: [pfSense] DynDNS troubles, once again

2012-07-26 Thread Stefan Baur
Am 27.07.2012 01:16, schrieb Jeppe Øland: On Thu, Jul 26, 2012 at 2:14 PM, Stefan Baur wrote: - what does your log say about dyndns? Nothing that would look helpful: check_reload_status: Updating all dyndns is the only message containing the string "dyn", and it only ap

Re: [pfSense] DynDNS troubles, once again

2012-07-26 Thread Stefan Baur
Am 26.07.2012 23:53, schrieb Nishant Sharma: Are you running dual WAN setup with gateway failover by any chance? Nope, single WAN, but in private IP space, as there is another router above it. -Stefan ___ List mailing list List@lists.pfsense.org h

Re: [pfSense] DynDNS troubles, once again

2012-07-26 Thread Stefan Baur
Am 26.07.2012 22:45, schrieb Frank: Hi Stefan, On Thu, Jul 26, 2012 at 09:09:35AM +0200, Stefan Baur wrote: Am 25.07.2012 18:36, schrieb RB: However, repeatedly firing off fetch -q -o - http://checkip.dyndns.org | sed 's/^.*Current IP Address: \(.*\)<\/body>.*$/\1/' within

Re: [pfSense] DynDNS troubles, once again

2012-07-26 Thread Stefan Baur
Am 25.07.2012 18:36, schrieb RB: However, repeatedly firing off fetch -q -o - http://checkip.dyndns.org | sed 's/^.*Current IP Address: \(.*\)<\/body>.*$/\1/' within the same minute doesn't error out, so it doesn't look like a limit that's enforced by dyndns. My only guess is that they're enf

Re: [pfSense] DynDNS troubles, once again

2012-07-25 Thread Stefan Baur
Am 25.07.2012 23:30, schrieb Fuchs, Martin: I also had many problems and since I use noip now, the problems have gone... It's still the case that dyndns updates sometimes work and sometimes not :-( I *am* using no-ip, however, pfSense uses the checkip.dyndns.org server to check for the current

Re: [pfSense] DynDNS troubles, once again

2012-07-25 Thread Stefan Baur
Am 25.07.2012 18:24, schrieb RB: On Wed, Jul 25, 2012 at 10:19 AM, Stefan Baur wrote: I thought there was a maximum allowable frequency (e.g. 10 minutes) for hitting checkip.dyndns.org, but can't currently find documentation of that. The limit is for hitting the update server, no

Re: [pfSense] DynDNS troubles, once again

2012-07-25 Thread Stefan Baur
Am 25.07.2012 18:17, schrieb RB: I thought there was a maximum allowable frequency (e.g. 10 minutes) for hitting checkip.dyndns.org, but can't currently find documentation of that. The limit is for hitting the update server, not for hitting checkip.dyndns.org (but feel free to prove me wrong)

Re: [pfSense] DynDNS troubles, once again

2012-07-25 Thread Stefan Baur
Am 25.07.2012 18:02, schrieb Michael Schuh: Hi Stefan, you are in Germany - right? i suggest: most DSL-Providers "spend" you a firm IP-Address if you ask. Most times it will cost you just the phone call. some will bill you 5 €. So no more dynamic dns needed. no hussle, no troubles. HTH Sadly,

[pfSense] DynDNS troubles, once again

2012-07-25 Thread Stefan Baur
Hi list, as previously mentioned on this list, I'm running my pfSense boxes within private address space, so they can't detect the WAN ip change on their own interface, as what they believe is their WAN ip is just another private address. Therefore, I need to rely on the mechanism that conne

Re: [pfSense] Squid transparent ssl proxy

2012-07-24 Thread Stefan Baur
Am 25.07.2012 05:17, schrieb Jerome Alet: Any idea what I'm doing wrong ? This is what you're doing wrong: > Now I'd like to set it up as an HTTPS transparent proxy as well. HTTPS traffic is encrypted, and squid is lacking the proper keys/certificates to decrypt it. In theory, you could se

Re: [pfSense] pfSense 2.0.1-RELEASE, Restoring partial config.xml does not work

2012-07-24 Thread Stefan Baur
Am 23.07.2012 21:44, schrieb Seth Mos: Good news. Support for just that and a few other items have been included in pfSense 2.1 Thank you. What's the rough estimate for the 2.1 release date? -Stefan ___ List mailing list List@lists.pfsense.org http

Re: [pfSense] pfSense 2.0.1-RELEASE, Restoring partial config.xml does not work

2012-07-23 Thread Stefan Baur
Am 23.07.2012 15:10, schrieb Oliver Hansen: Hi Stefan, I can't be sure but I think I have run into this before. Have you tried uploading a config with ONLY those parts that you want to change? I think it is intended to be restored from a backup that only contained those parts. While it indeed d

[pfSense] pfSense 2.0.1-RELEASE, Restoring partial config.xml does not work

2012-07-23 Thread Stefan Baur
e reboot. I tried to debug the issue by repeating the steps with manual reboots after each upload, but that doesn't help either. My changes are simply being ignored. Manually splicing the changes into the XML file and uploading it completely works, though, so I can rule out

Re: [pfSense] whiltelist of mac address

2012-06-11 Thread Stefan Baur
Am 11.06.2012 15:43, schrieb Bill Yuan: seems is it not free! http://en.wikipedia.org/wiki/TANSTAAFL ___ List mailing list List@lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list

Re: [pfSense] pfSense "product support lifecycle"?

2012-04-24 Thread Stefan Baur
Am 24.04.2012 10:50, schrieb Gerald A: Well, I'm sure you've heard of "never change a running system"... and my 2.0.1 installations are running just fine right now, and that's the way I like them. ;-) I'm usually a pretty ardent follower of this rule myself -- except when it comes

Re: [pfSense] pfSense "product support lifecycle"?

2012-04-24 Thread Stefan Baur
Am 24.04.2012 09:32, schrieb Chris Buechler: Nothing formal. To date, once we put out a new release, all prior releases will not get any updates. That will probably especially be true going forward, with much shorter release cycles than we had from 1.2.3 to 2.0, and much fewer changes, hence much

Re: [pfSense] pfSense "product support lifecycle"?

2012-04-24 Thread Stefan Baur
Am 24.04.2012 09:20, schrieb Seth Mos: Well, we currently only really support the last one. The product mostly evolves through repetition. The last as in "the latest, current one", I suppose... :-( There's a lot of other fixes unrelated to IPv6 in 2.1 that you'll find which you will probabl

[pfSense] pfSense "product support lifecycle"?

2012-04-24 Thread Stefan Baur
Hi list, I just stumbled over a few posts mentioning the scheduled 2.1 release of pfSense on June 6, 2012. This has made me wonder: Is there any centralized resource (ordinary web page, wiki, whatever) where one can review what Microsoft would call the "product support lifecycle" of pfSense?

Re: [pfSense] DNS resolution in aliases

2012-03-15 Thread Stefan Baur
Am 14.03.2012 21:23, schrieb Jim Pingle: On 3/14/2012 4:08 PM, Ugo Bellavance wrote: Is there DNS resolution in aliases (pfSense 2.x)? Is it possible to create an alias, for example, named "bunch of servers", and in the hosts, instead of entering the IP address, enter a DNS name? Yes. Uh, ar

Re: [pfSense] DynDNS/No-IP question, cascaded NAT

2012-01-06 Thread Stefan Baur
Am 07.01.2012 00:41, schrieb Ingo Schmitt: Hi, On 01/06/12 21:09, Stefan Baur wrote: ... a) No-IP in regular intervals and "blindly" update the status - I'm not sure if that violates No-IPs Terms of Service, though - or, ... freeDNS allows you to update your IP by just hittin

Re: [pfSense] DynDNS/No-IP question, cascaded NAT

2012-01-06 Thread Stefan Baur
Am 06.01.2012 21:57, schrieb Lyle Giese: I have not checked but I doubt that pfsense would store that password in plain text either. I just did, with a no-ip account. It's stored there in plain text. And if you think about it, anything else would just add a false sense of security. Kind Reg

Re: [pfSense] DynDNS/No-IP question, cascaded NAT

2012-01-06 Thread Stefan Baur
Am 06.01.2012 21:57, schrieb Lyle Giese: Use a user name & password unique to dyndns. Obviously... I never give my customer's that info, just set it up for them and say here it is. Not possible in my situation, I'd say - reason see below. I have not checked but I doubt that pfsense would

Re: [pfSense] DynDNS/No-IP question, cascaded NAT

2012-01-06 Thread Stefan Baur
Am 06.01.2012 21:24, schrieb Lyle Giese: I went the route to buy an account at Dyndns for $20/year and that allows 32 dyn hosts. I give them to my customers as needed for that amount. I have handed out 22 and still have 10 more available. Doesn't that mean that all of the machines are using

[pfSense] DynDNS/No-IP question, cascaded NAT

2012-01-06 Thread Stefan Baur
Hi List, some of my customers are switching to No-IP, as DynDNS.org doesn't seem to offer free accounts any more. So far, they had used their ISP-provided routers for DynDNS.org with the pfSense box plugged into the LAN side of that router: [Clients]---192.168.133.x---[pfSense]---192.168.5.

[pfSense] Strange hard disk size issue

2011-09-23 Thread Stefan Baur
Hi list, a bout a year and a half ago, I installed pfSense 1.2.3 in a virtual environment. I didn't use the VMware Image provided on the pfsense web site, as I am using a different virtualization solution (Linux kvm, in case anyone wonders). I created the virtual environment with a 512 Megab