[pfSense] ADSL2+ modem with IPv6 support

2011-09-21 Thread Eugen Leitl
further brain damage). I'd rather just use an ADSL2+ modem -- however, I'd like to be able to use IPv6 with these (MNet already offers experimental IPv6 support). Anyone aware of a decent ADSL2+ modem which can handle some 1 MBit/s upstream and some 18 MBit/s downstream, as well as IPv6? -- Eugen

Re: [pfSense] ADSL2+ modem with IPv6 support

2011-09-29 Thread Eugen Leitl
On Wed, Sep 21, 2011 at 02:10:10PM +0200, Seth Mos wrote: On 21-9-2011 13:49, Eugen Leitl wrote: I'm looking to add an ADSL2+ as second WAN to my home pfSense. Unfortunately, the ISP (MNet) only offers FritzBox routers, which have multiple issues (e.g. SSH session timeouts with the official

[pfSense] how stable is IPv6 for 2.0?

2011-11-20 Thread Eugen Leitl
Is anyone running IPv6 on 2.0 as described on http://doc.pfsense.org/index.php/Using_IPv6_on_2.0 Are you having any problems with it so far? I currently have native IPv6 in the colo, but rather not screw up the remote firewalls (one is even without IPMI). -- Eugen* Leitl a href=http

Re: [pfSense] how stable is IPv6 for 2.0?

2011-11-20 Thread Eugen Leitl
On Sun, Nov 20, 2011 at 04:28:53PM +0100, Seth Mos wrote: Hi Eugen, Op 20 nov 2011, om 13:04 heeft Eugen Leitl het volgende geschreven: Is anyone running IPv6 on 2.0 as described on http://doc.pfsense.org/index.php/Using_IPv6_on_2.0 I've been running it in production on a carp

Re: [pfSense] how stable is IPv6 for 2.0?

2011-11-20 Thread Eugen Leitl
On Sun, Nov 20, 2011 at 04:36:51PM +0100, Seth Mos wrote: Hi, Op 20 nov 2011, om 16:33 heeft Eugen Leitl het volgende geschreven: Great, I'll take the plunge, then. Thanks! Just for extra clarification, the images on http://files.pfsense.org/jimp/ipv6/ are the easiest to start rolling

Re: [pfSense] how stable is IPv6 for 2.0?

2011-11-23 Thread Eugen Leitl
On Sun, Nov 20, 2011 at 04:36:51PM +0100, Seth Mos wrote: Hi, Op 20 nov 2011, om 16:33 heeft Eugen Leitl het volgende geschreven: Great, I'll take the plunge, then. Thanks! Just for extra clarification, the images on http://files.pfsense.org/jimp/ipv6/ are the easiest to start rolling

Re: [pfSense] how stable is IPv6 for 2.0?

2011-11-23 Thread Eugen Leitl
On Wed, Nov 23, 2011 at 10:39:00AM +0100, Eugen Leitl wrote: inet6 fe80::225:90ff:fe02:1a4e%em0 prefixlen 64 scopeid 0x3 inet6 2a01:4f8:7d:300:: prefixlen 56 Anyone knows how disable IPv6 autoconfig in pfSense? Sorry, I'm an idiot, disregard. Assigned the wrong IPv6 address

Re: [pfSense] how stable is IPv6 for 2.0?

2011-11-23 Thread Eugen Leitl
On Wed, Nov 23, 2011 at 10:22:16AM -0500, Jim Pingle wrote: On 11/23/2011 4:21 AM, Eugen Leitl wrote: Just upgraded to http://files.pfsense.org/jimp/ipv6/pfSense-Full-Update-2.1-DEVELOPMENT-i386-20111021-1243.tgz on a SuperMicro Atom -- system boots fine but I'm getting Crash report

Re: [pfSense] how stable is IPv6 for 2.0?

2011-11-23 Thread Eugen Leitl
On Wed, Nov 23, 2011 at 10:42:41AM -0500, Jim Pingle wrote: On 11/23/2011 10:36 AM, Eugen Leitl wrote: Thanks -- did that, and rebooted. [snip] Crash report details: Did you submit the report? If so, did it give you an error when it submitted? Yes, submitted, and no error given

Re: [pfSense] how stable is IPv6 for 2.0?

2011-11-23 Thread Eugen Leitl
On Wed, Nov 23, 2011 at 11:44:56AM -0500, Jim Pingle wrote: On 11/23/2011 11:09 AM, Eugen Leitl wrote: I did see something like that. Just repeated the above, and it seems the last sync did succeed: # pfSsh.php playback gitsync master Starting the pfSense shell system

[pfSense] problems with setting 10.0.0.1/8 on LAN

2011-11-27 Thread Eugen Leitl
mixed network masks on the same LAN do. I was not able to ping the WAN interface at all. I reset the LAN back to 10.0.0.1/24 via an IPMI session, at which point the system sprang back. I'll try doing the same with a /16 mask, let's see what that does. -- Eugen* Leitl a href=http://leitl.org;leitl

Re: [pfSense] problems with setting 10.0.0.1/8 on LAN

2011-11-27 Thread Eugen Leitl
On Sun, Nov 27, 2011 at 04:07:31PM +0100, Eugen Leitl wrote: While trying to build VIPs and do 1:1 NAT I accidentally noticed that setting LAN to 10.0.0.1/8 (instead of 10.0.0.1/24) will make the system unresponsive (this is 2.1-DEVELOPMENT (i386) built on Fri Oct 21 12:51:56 EDT 2011). I

[pfSense] a somewhat strange problem with VIP 1:1 NAT reachability

2011-11-27 Thread Eugen Leitl
I've got a /28 and 3x /24 the latter of which I want to map 1:1 to private address space (e.g. each /24 to 10.0.x.0/24). My pfSense version is 2.1-DEVELOPMENT (i386) built on Fri Oct 21 12:51:56 EDT 2011 I've got a setup where hosts and firewalls look like this WAN LAN switch1 -

Re: [pfSense] problems with setting 10.0.0.1/8 on LAN

2011-11-29 Thread Eugen Leitl
think I'll do some experimenting by isolating hosts on a different, unreachable VLAN. This only works because the hosts are in very limited production, so some dowtime is tolerable. -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org

Re: [pfSense] enabling jumbo frames on LAN, any negative impact?

2011-12-01 Thread Eugen Leitl
On Thu, Dec 01, 2011 at 02:28:14PM -0500, Ugo Bellavance wrote: Why would you do that? To improve throughput on the home LAN. House is 40+ years old, doesn't have conduits -- so there is a number of daisy-chained switches hanging on the central one. Modern drives are fast enough to saturate a

Re: [pfSense] enabling jumbo frames on LAN, any negative impact?

2011-12-02 Thread Eugen Leitl
. Other than that, it won't impact anything. It definitely did boost SMB throughput, and will probably help with NFS even better. -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org __ ICBM: 48.07100, 11.36820 http

[pfSense] anyone running snort?

2011-12-21 Thread Eugen Leitl
old again for snort rules, probably? -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org __ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

Re: [pfSense] anyone running snort?

2011-12-21 Thread Eugen Leitl
On Wed, Dec 21, 2011 at 02:38:32PM +0100, Eugen Leitl wrote: I'm getting a Warning: opendir(/usr/local/etc/snort/snort_10053_igb1/rules/): failed to open dir: No such file or directory in /usr/local/www/snort/snort_rulesets.php on line 251 Warning: readdir(): supplied argument

[pfSense] files.pfsense.org down?

2011-12-22 Thread Eugen Leitl
package. Installation halted. -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org __ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

[pfSense] Unable to check for updates.

2011-12-24 Thread Eugen Leitl
You people with i386 2.0.1, what do you have in your Firmware Auto Update URL field? ___ List mailing list List@lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list

Re: [pfSense] dont sent me ur staff

2012-01-20 Thread Eugen Leitl
On Fri, Jan 20, 2012 at 09:31:21AM +0300, joseph malai wrote: pls dont sent me ur staff stff lready usnt. dycpy? ___ List mailing list List@lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list

Re: [pfSense] Snapshots are back

2012-03-23 Thread Eugen Leitl
On Thu, Mar 22, 2012 at 09:48:54PM -0400, Jim Pingle wrote: FYI- 2.1 snapshots are going again. http://snapshots.pfsense.org/ Great. How stable are they? Useful for limited production? If you want to track via auto update... pfSense i386 2.1 DEVELOPMENT snapshots

[pfSense] pfSense VPN to Cisco (ASA 5520)

2012-05-02 Thread Eugen Leitl
I need to make terminate a VPN tunnel (users behind NAT) with above Cisco box. Parameters are ISAKMP Phase I preshared key AES128 SHA Group 2 Lifetime 28800 sec IPSEC Phase II AES 128 SHA Group 2 Perfect forwarding secrecy: No Lifetime 3600 sec Anyone terminating such IPsec tunnels to Cisco?

Re: [pfSense] pfSense VPN to Cisco (ASA 5520)

2012-05-02 Thread Eugen Leitl
On Wed, May 02, 2012 at 08:28:52AM -0400, Chris Buechler wrote: On Wed, May 2, 2012 at 8:25 AM, Eugen Leitl eu...@leitl.org wrote: I need to make terminate a VPN tunnel (users behind NAT) with above Cisco box. Parameters are ISAKMP Phase I preshared key AES128 SHA Group 2

[pfSense] IPv6 site check

2012-06-01 Thread Eugen Leitl
. (there is an ipv6.level3.com). Does anyone know about their plans for next week? I don't see them on WorldIPv6Day's lists. Frank - End forwarded message - -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org __ ICBM

[pfSense] can it be that having WAN on RFC1918 space fucks up site to site IPsec tunnel?

2012-06-01 Thread Eugen Leitl
My WAN is on 10.0.2.6/30, and I can't get my tunnel up! Argh. Same tunnel config on a different pfSense (2.1, actually) and regular public IPs on WAN goes up green no issues. A Cisco is on the other end. I do have block private networks/bogon networks unchecked. This is 2.0 stable. Halp! My

Re: [pfSense] can it be that having WAN on RFC1918 space fucks up site to site IPsec tunnel?

2012-06-01 Thread Eugen Leitl
issues first. Is there some RFC1918 blocking code built-in in IPsec, at least with 2.0.1? -Original Message- From: list-boun...@lists.pfsense.org [mailto:list-boun...@lists.pfsense.org] On Behalf Of Eugen Leitl Sent: Friday, June 01, 2012 12:34 PM To: List@lists.pfsense.org

Re: [pfSense] can it be that having WAN on RFC1918 space fucks up site to site IPsec tunnel?

2012-06-01 Thread Eugen Leitl
Of Eugen Leitl Sent: Friday, June 01, 2012 12:34 PM To: List@lists.pfsense.org Subject: [pfSense] can it be that having WAN on RFC1918 space fucks up site to site IPsec tunnel? My WAN is on 10.0.2.6/30, and I can't get my tunnel up! Argh. Same tunnel config on a different

Re: [pfSense] can it be that having WAN on RFC1918 space bolloxes up site to site IPsec tunnel?

2012-06-01 Thread Eugen Leitl
On Fri, Jun 01, 2012 at 12:42:44PM -0500, Ryan Rodrigue wrote: Is the vulgarity in the subject really necessary? Sorry about triggering any sensibilities. Didn't realize that was an actual cussword in some parts of the world. Will try to stick strictly to rainbow- and pony-related imagery.

Re: [pfSense] can it be that having WAN on RFC1918 space fucks up site to site IPsec tunnel?

2012-06-01 Thread Eugen Leitl
On Fri, Jun 01, 2012 at 02:36:21PM -0400, Sean Cavanaugh wrote: If provider is providing you NATed internet access...my best guess is you It's not NATed. They're rewriting the packet headers. The only NAT there is is our own. also are being filtered. Take it up with ISP and they can prob help,

Re: [pfSense] can it be that having WAN on RFC1918 space fucks up site to site IPsec tunnel?

2012-06-01 Thread Eugen Leitl
On Fri, Jun 01, 2012 at 03:03:31PM -0500, Tim Nelson wrote: It's not NATed. They're rewriting the packet headers. The only NAT there is is our own. Isn't rewriting of the packet headers the exact definition of NAT aka Network Address Translation ? It's a simple 1:1 mapping from

Re: [pfSense] can it be that having WAN on RFC1918 space fucks up site to site IPsec tunnel?

2012-06-01 Thread Eugen Leitl
On Fri, Jun 01, 2012 at 04:48:24PM -0400, Ian Bowers wrote: What people commonly think of as NAT is more correctly called dynamic PAT. 1:1 mapping of network addresses is static nat. Not trying to nitpick, just letting on why some people might be confused. Thanks. Appreciated, I'm really not

Re: [pfSense] can it be that having WAN on RFC1918 space $%# up site to site IPsec tunnel?

2012-06-01 Thread Eugen Leitl
On Fri, Jun 01, 2012 at 06:55:10PM -0400, Sean Cavanaugh wrote: Real question. If you have actual internet IPs that are being 1:1 referenced to you, why are they doing static NAT on you in the first place instead of just routing all the way thru to you? Are you sure they are not sharing your

Re: [pfSense] pfSense vs JunOS

2012-07-02 Thread Eugen Leitl
On Sun, Jul 01, 2012 at 01:14:12PM +0200, Adam Thompson wrote: Are there any JunOS features you consider killer that are not in pfSense 2.1? What would be these features? Hardware offload: you can scale vertically with JunOS platforms with the simple addition of more money, whereas an

Re: [pfSense] pfSense vs JunOS

2012-07-02 Thread Eugen Leitl
On Mon, Jul 02, 2012 at 01:01:47PM +0100, Chris Bagnall wrote: On 1/7/12 4:47 pm, Eugen Leitl wrote: Are there any JunOS features you consider killer that are not in pfSense 2.1? What would be these features? 'JunOS' is a fairly vague comparison point - the JunOS feature set supported

Re: [pfSense] Firewire?

2012-07-25 Thread Eugen Leitl
On Tue, Jul 24, 2012 at 06:11:47PM -0500, Adam Thompson wrote: You can run IP over firewire. It's fairly straight-forward after that. ... For connecting to pfSense boxes back-to-back, sure, use fwe interfaces... but they'll generally only run at 1394a speeds (aka 400Mbit/sec), so

Re: [pfSense] Bird vs Quagga revisited

2012-08-29 Thread Eugen Leitl
with OSR, BIRD and Quagga involvement. There'll be one at RIPE65 again I think. Either way if you have questions, feel free to ask. -David - End forwarded message - -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org

Re: [pfSense] (no subject)

2012-10-04 Thread Eugen Leitl
On Thu, Oct 04, 2012 at 11:15:01AM +0530, Gagan VERMA wrote: Hi All, This is to inform you that our organization is using *pfSense 2.0.1-RELEASE (amd64) * from last six months and is very helpful solution for our org. * * But there is a concern that Gmail and Facebook uses https port to

Re: [pfSense] Routing public PI network in a tunnel

2012-11-10 Thread Eugen Leitl
On Sat, Nov 10, 2012 at 01:11:14PM +0100, Erik Augustsson wrote: So my question is. If I install pfsense at location A. Can I use that to tunnel/route my public PI network to my servers at location B? I would be probably looking at the OpenVPN pfsense package. P.S. In case you solve your

[pfSense] Alix 2D3 with pfSense 2.1

2012-11-20 Thread Eugen Leitl
I need to firewall a 100 MBit/s symmetrical site and want to reuse my ALIX 2D3 with Soekris VPN accelerator as this is a nonprofit with no budget. Can the hardware still handle pfSense 2.1 without choking? I'll be getting ~70-75 MBit/s max, right? ___

Re: [pfSense] Alix 2D3 with pfSense 2.1

2012-11-21 Thread Eugen Leitl
On Wed, Nov 21, 2012 at 12:30:11PM -0500, Vick Khera wrote: On Tue, Nov 20, 2012 at 4:58 AM, Eugen Leitl eu...@leitl.org wrote: ~85 Mbps max. Not going to fill a 100 Mb pipe, but will work. Thanks, that will do plenty. I think you will find it barely handling that load. Will you

Re: [pfSense] OpenVPN performance with Atom 1.6 Ghz

2012-12-05 Thread Eugen Leitl
On Wed, Dec 05, 2012 at 06:07:19PM +0100, WolfSec-Support wrote: hello I did some research already, but find no real good answer, so: what would be the troughput of a OpenVPN pfsense box with 1.6 Ghz CPU ? Which CPU? Atom? sure, depends on encryption level, too. but any example would

Re: [pfSense] update 2.1-BETA1

2012-12-13 Thread Eugen Leitl
On Thu, Dec 13, 2012 at 08:30:17AM -0600, Chris Buechler wrote: On Thu, Dec 13, 2012 at 8:25 AM, Eugen Leitl eu...@leitl.org wrote: I had a hang with 2.1-BETA1 (i386) update to 2.1-BETA (amd64) (on Intel D510) which I solved by a reset. The upgrade seems to have succeeded, though

Re: [pfSense] 2.0.2 release now available

2012-12-21 Thread Eugen Leitl
On Fri, Dec 21, 2012 at 08:44:29AM -0700, James Caldwell wrote: Awesome work guys, looking forward to 2.1! 2.1BETA1 has been working quite well for me (at home, at least). ___ List mailing list List@lists.pfsense.org

Re: [pfSense] WRAP

2013-01-05 Thread Eugen Leitl
On Fri, Jan 04, 2013 at 10:04:34PM -0500, Ugo Bellavance wrote: Hi, I'm still using a WRAP box for my pfSense at home. Should I change it? It works OK, but I'm stuck at V 2.0.0 for now. Will 2.1 run on WRAP? With the speed of courrent connections (100+ MBit/s) I would probably invest into

Re: [pfSense] Dandy pfSense appliance

2013-04-25 Thread Eugen Leitl
On Wed, Apr 24, 2013 at 07:18:26PM +0100, Chris Bagnall wrote: On 24/4/13 7:05 pm, Mathieu Simon wrote: Depends what you think about high specs many 1 GE ports or even 10 GE, lots of cores etc? This. You also have to decide whether you actually need high specs in a router. There's little

[pfSense] carp/pfsync cluster

2013-04-26 Thread Eugen Leitl
I'm moving colo (yay, no more 2 h drives) and have to renumber. Jiggle my memory, is a /29 enough for a carp/pfsync failover cluster? so that .129 gateway .130 switch (theoretically not really required, but) .131 fw1 .132 fw2 .133 carp1 .134 carp2 ? Thanks, and happy weekend.

[pfSense] looking for IPv6 pfSense setup

2013-05-04 Thread Eugen Leitl
for IPv6 and Track Interface as IPv6 configuration type for LAN I sometimes have no IPv6 connectivity on Windows 7 (while I can ping6 on pfSense just fine). Any idea what is breaking here? -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org

[pfSense] adding routes/gateways for override existing networks on WAN

2013-05-13 Thread Eugen Leitl
it blindly, since that firewall has no IPMI, and is hidden in a cramped wall rack which is a royal PITA). Thanks. -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org __ ICBM: 48.07100, 11.36820 http://ativel.com http

Re: [pfSense] Help

2013-05-16 Thread Eugen Leitl
On Thu, May 16, 2013 at 04:25:10PM +0530, Joy wrote: Hi Team, Is it possible to use cloud based web filtering with pfsense like open dns based filtering. in case yes what software does that like websense etc ? Have you tried just putting in OpenDNS resolvers under

[pfSense] routing with pfSense

2013-05-28 Thread Eugen Leitl
I'm having issues understanding how to route additional networks with 2.1RC0, given that WAN is on a subnet (/29 -- there will be a carp/pfsync cluster once it's debugged). I have a /26 (which can be eventually expanded to /24 or /23 without renumbering) and a /28, which need to be routed WAN to

Re: [pfSense] pfSense as a datacentre router (was: dual ISP BGP)

2013-05-29 Thread Eugen Leitl
On Tue, May 28, 2013 at 12:40:07PM -0400, Glenn Kelley wrote: In short BGP would just stop working - and the system would bail. This happened on multiple hardware implementations - Dell 2950, Dell R300, HP Equipment as well. I have asked Chris (who gave up his July 4th Holiday and

[pfSense] HiFn 7955 and Geode LX hardware RNG both in the same device? With Yarrow?

2013-09-08 Thread Eugen Leitl
I have an old ALIX 2d3 with Geode LX which has a hardware RNG as well as HiFn 7955, which also has a hardware RNG. 1) can I use them both in pfSense, or FreeBSD? 2) can I make them feed into Yarrow, or do they supercede Yarrow when present? Is there a priority, which of these gets selected? In

Re: [pfSense] 2.1 on WRAP

2013-09-20 Thread Eugen Leitl
On Fri, Sep 20, 2013 at 07:17:30AM -0400, Jim Pingle wrote: The main limitation here is RAM, if your Alix has 256 MB it should be fine really. The forwarding rate is limited to about 70 mbit, so if you need more only the newer Soekris 6500 series would work. Keep your eye on this one,

Re: [pfSense] 2.1 on WRAP

2013-09-20 Thread Eugen Leitl
On Fri, Sep 20, 2013 at 07:41:11AM -0500, Jim Thompson wrote: On Sep 20, 2013, at 6:45 AM, Odette Nsaka odette.ns...@libero.it wrote: Does somebody know other reliable and cheap embedded platforms running pfSense with no problem?

Re: [pfSense] 2.1-RELEASE and native IPv6 with HE.net

2013-09-21 Thread Eugen Leitl
On Sat, Sep 21, 2013 at 06:14:01AM -0500, Cheyenne Deal wrote: I recently upgraded to 2.1-RELEASE and noticed that many things are running much smoother than before. I saw that 2.1 had native IPv6 functionality built in. I have attempted to follow the instructions provided by the wiki. I have

Re: [pfSense] IPv6 - Subnetting/Routing with HE?

2013-09-27 Thread Eugen Leitl
On Fri, Sep 27, 2013 at 03:15:34PM +0200, Mark Tinka wrote: If you need SLAAC, a /64 is your only option. If you don't need SLAAC on your network segment, and you don't need a /64, then you can use a longer prefix length. All the IPv6 guys I asked said to never do that. I can see when I

Re: [pfSense] minimum IPv6 announcement size

2013-09-27 Thread Eugen Leitl
every grain of sand on the world's beaches doesn't describe reality very well. The IPv6 addressing plan didn't wind up meeting our requirements very well. Film at 11. Joe - End forwarded message - -- Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org

Re: [pfSense] IPv6 - Subnetting/Routing with HE?

2013-10-01 Thread Eugen Leitl
On Mon, Sep 30, 2013 at 11:52:31AM +0200, Mark Tinka wrote: All in all, apply for a /48 PI IPv6 allocation if you're an end-user. You won't have to renumber (ever) again. But you're going to pay the annual fee. Or is PI for end user through sponsoring LIR possible without incurring annual

Re: [pfSense] need some help with HE.net routed /48 on LAN with DHCPv6

2013-10-08 Thread Eugen Leitl
On Tue, Oct 08, 2013 at 06:54:55AM +0200, Olivier Mascia wrote: Le 3 oct. 2013 à 13:26, Eugen Leitl eu...@leitl.org a écrit : I've got a /64 and /48 from HE.net tunnelbroker, and followed https://doc.pfsense.org/index.php/Using_IPv6_on_2.1_with_a_Tunnel_Broker The tunnel is working (I

Re: [pfSense] NSA: Is pfSense infiltrated by big brother NSA or others?

2013-10-09 Thread Eugen Leitl
On Wed, Oct 09, 2013 at 11:20:11AM -0400, Paul Kunicki wrote: I think that in light of the recent news of the NSA coercing various organizations to provide them with means to eavesdrop this message has merit and deserves response although I doubt the NSA really needs cooperation from these

Re: [pfSense] NSA: Is pfSense infiltrated by big brother NSA or others?

2013-10-09 Thread Eugen Leitl
On Wed, Oct 09, 2013 at 12:10:00PM -0400, Jim Pingle wrote: On 10/9/2013 11:32 AM, Robert Guerra wrote: From the news i've read... a couple of questions for the pfsense developers come to mind: 1. Random Number generation - NSA is reported to have weakened several random number

Re: [pfSense] NSA: Is pfSense infiltrated by big brother NSA or others?

2013-10-09 Thread Eugen Leitl
On Wed, Oct 09, 2013 at 11:42:31AM -0500, Adam Thompson wrote: Argh. Anyone who answered Yes to your question (correctly, mind you) would immediately be committing a federal crime. All assuming the company in question resides in the US, or has significant presence in the US. There is, of

Re: [pfSense] NSA: Is pfSense infiltrated by big brother NSA or others?

2013-10-09 Thread Eugen Leitl
On Wed, Oct 09, 2013 at 06:50:53PM +0200, Jim Thompson wrote: IMO, this bullshit thread only serves to assist those asking the question in stroking their own ego. Sorry, this is not BS. The situation has changed, and we have to adapt. It doesn’t contribute anything to the project. It

Re: [pfSense] NSA: Is pfSense infiltrated by big brother NSA or others?

2013-10-09 Thread Eugen Leitl
On Wed, Oct 09, 2013 at 07:17:25PM +0200, Jim Thompson wrote: Sorry, this is not BS. The situation has changed, and we have to adapt. The situation did not change with the Snowden revelations. Anyone following along has known what was going on for at least the last decade. The difference

Re: [pfSense] NSA: Is pfSense infiltrated by big brother NSA or others?

2013-10-09 Thread Eugen Leitl
On Wed, Oct 09, 2013 at 07:53:24PM +0200, Jim Thompson wrote: Also, the source of git would also reveal a problem when examined. To get around that one starts hypothesizing the sort of globe-spanning conspiracy against which one might as well give up (well, maybe all my compilers (not just

Re: [pfSense] [Filters engaged]

2013-10-10 Thread Eugen Leitl
On Wed, Oct 09, 2013 at 06:20:56PM -0400, Joe Landman wrote: I just worked out setting up new filters for the recent S/N destroying, high tin-foil-hat content, on gmail. Since people pleading for this to go away hasn't worked, technological measures to restore S/N for my inbox on this list

Re: [pfSense] Can pfSense be considered trusted? What implementations of VPNs can now be trusted?

2013-10-10 Thread Eugen Leitl
On Thu, Oct 10, 2013 at 02:50:41PM +0100, Giles Coochey wrote: 1. The random number generator - As pfSense uses FreeBSD this may well be a FreeBSD specific question, however, are there any ways within pfsense that we can improve the entropy pool that the random number gets its randomness

Re: [pfSense] Can pfSense be considered trusted? What implementations of VPNs can now be trusted?

2013-10-11 Thread Eugen Leitl
can now be trusted? Message-ID: 52571f24.4030...@echeque.com User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:24.0) Gecko/20100101 Thunderbird/24.0 On 2013-10-11 00:39, Eugen Leitl wrote: - Forwarded message from Giles Coochey gi...@coochey.net - 2. Cipher Selection - we're not all

Re: [pfSense] Crypto/RNG Suggestions

2013-10-11 Thread Eugen Leitl
: Mozilla/5.0 (Windows NT 5.1; rv:24.0) Gecko/20100101 Thunderbird/24.0 On 2013-10-10 22:21, Eugen Leitl wrote: - Forwarded message from Jim Pingle li...@pingle.org - I haven't yet seen anything conclusive. People have called into question some or all of ECC, NSA's suggested Suite B, and so

Re: [pfSense] naive suggestion: conform to US laws

2013-10-12 Thread Eugen Leitl
On Sat, Oct 12, 2013 at 01:41:40PM -0400, Adrian Wenzel wrote: I can't say I agree with Thinker Rix on everything but on this I do agree. I have been on this list for many years (mostly just reading) and have always been impressed with the professionalism of most members who write and

Re: [pfSense] Hardware requirements for gigabit wirespead

2013-10-25 Thread Eugen Leitl
On Thu, Oct 24, 2013 at 07:18:28PM -0500, Jim Thompson wrote: The topic has wandered away from pfSense. It is rather interesting though, so please don't kill that thread just yet. ___ List mailing list List@lists.pfsense.org

Re: [pfSense] Hardware requirements for gigabit wirespead

2013-11-06 Thread Eugen Leitl
On Wed, Nov 06, 2013 at 09:11:08AM +0200, Thinker Rix wrote: Unfortunately the motherboards I plan to buy supports only the above-mentioned CPUs. Anyone running pfSense on a HP Microserver G8? http://b3n.org/installed-xeon-e3-1230v2-in-gen8-hp-microserver/ These are dual Broadcoms BCM5717

Re: [pfSense] Hardware requirements for gigabit wirespead

2013-11-06 Thread Eugen Leitl
On Wed, Nov 06, 2013 at 04:12:09PM +, Chris Bagnall wrote: On 6/11/13 12:30 pm, Eugen Leitl wrote: Anyone running pfSense on a HP Microserver G8? I have - in the past - had it running on a G5 and a G6 if that's any help. One of our clients is using it on a G7. lspci on both mine

[pfSense] cluster with two WANs and load balancing

2014-02-07 Thread Eugen Leitl
I've been running dual-WAN with a single pfSense for a while, and was not very happy with it due to some hard to diagnose strangeness (some connections time out). This might be due to hardware trouble though. As I've retired two pfSense firewalls from production recently I'm considering running

[pfSense] FreeBSD 10.0 on Ubiquiti EdgeRouter Lite

2014-02-11 Thread Eugen Leitl
http://rtfm.net/FreeBSD/ERL/ FreeBSD 10.0 on Ubiquiti EdgeRouter Lite The Ubiquiti EdgeRouter Lite is a neat little device that costs less than US$100, has three Ethernet ports, and can run FreeBSD/mips. It's based on the Cavium Octeon CN5020 platform and features a dual core 500mhz MIPS64

Re: [pfSense] FreeBSD 10.0 on Ubiquiti EdgeRouter Lite

2014-02-12 Thread Eugen Leitl
On Wed, Feb 12, 2014 at 08:05:17AM -0700, David Burgess wrote: That's great news. Does anybody care to speculate whether FreeBSD will be able to take advantage of the packet forwarding acceleration of this hardware at some point? IIRC you need NDAs for that, so unless it's cleanroom reversed

Re: [pfSense] FreeBSD 10.0 on Ubiquiti EdgeRouter Lite

2014-02-12 Thread Eugen Leitl
On Wed, Feb 12, 2014 at 09:44:46AM -0600, Jim Thompson wrote: On Feb 12, 2014, at 9:41 AM, Eugen Leitl eu...@leitl.org wrote: On Wed, Feb 12, 2014 at 08:05:17AM -0700, David Burgess wrote: That's great news. Does anybody care to speculate whether FreeBSD will be able to take

Re: [pfSense] FreeBSD 10.0 on Ubiquiti EdgeRouter Lite

2014-02-12 Thread Eugen Leitl
On Wed, Feb 12, 2014 at 10:35:56AM -0600, Jim Thompson wrote: Can the blobs be reversed so easily? (Too bad about lack of IPv6 offloading, but we can live with that for a while, I guess). I don’t know. If you’re really curious, you can read this:

[pfSense] successor to ALIX is here

2014-04-02 Thread Eugen Leitl
Apu.1c http://www.heise.de/newsticker/meldung/Embeddded-Mainboard-mit-x86-CPU-und-Coreboot-2160404.html http://www.pcengines.ch/apu1c.htm in stock, €105.13 ___ List mailing list List@lists.pfsense.org https://lists.pfsense.org/mailman/listinfo/list

[pfSense] IPsec regression between 2.0.1 and 2.1.2?

2014-04-25 Thread Eugen Leitl
We encountered Cisco VPN client (Cisco Systems VPN Client Version 5.0.07.0440) connection issues in the last couple days after I've upgraded to 2.1.2-RELEASE (amd64) recently. The issues disappear when client connects though a different gateway (an ADSL Fritzbox 7270 with latest firmware). I

[pfSense] [IP] How the NSA tampers with US-made Internet routers

2014-05-13 Thread Eugen Leitl
- Forwarded message from David Farber far...@gmail.com - Date: Mon, 12 May 2014 14:05:40 -0400 From: David Farber far...@gmail.com To: ip i...@listbox.com Subject: [IP] How the NSA tampers with US-made Internet routers Message-Id: 52e5077f-83dc-4d50-bbed-b25c96532...@gmail.com X-Mailer:

Re: [pfSense] apu.4c silently dies

2014-06-05 Thread Eugen Leitl
On Wed, Jun 04, 2014 at 02:53:15PM -0500, Jim Thompson wrote: so sad as this is the ideal platform that i was after. It’s nice, (and I have zero problems in a 24C ambient), but I wouldn’t call it “Ideal”. (watch this space) Heavy breathing intensifies.

Re: [pfSense] Difference between APU4 and APU1C4

2014-07-22 Thread Eugen Leitl
On Tue, Jul 22, 2014 at 02:40:44PM +, Ryan Coleman wrote: Is there a difference between the 4 and the 1C4? Is Netgate just trying to fleece people for an extra $200 by packaging the entire thing together built and tested? http://store.netgate.com/kit-APU1C4.aspx