Hot answers tagged

16 votes

Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server

Its been two years since the question was asked, but I had the same problem (domain name) and SOLVED it by: Log into pfsense via IP address or any working domain name Goto System -> Advanced -> ...
user avatar
  • 263
6 votes
Accepted

Block communication between hosts in the same VLAN

As has already been stated, communication between devices on the same VLAN (or layer-2 segment) does not cross a router but only the switch(es) in between the devices. Depending on the switches' ...
user avatar
  • 71.5k
6 votes
Accepted

pfsense DHCP lease remember time settings?

You need to change the DHCP lease duration. It is a standard option in all DHCP servers. In pfsense you'll find related settings under the Services / DHCP server page, in the "other options" part: ...
user avatar
  • 18.4k
5 votes
Accepted

Spurious restransmission to a server behind pfsense NAT

Found it ! It's a bug when running pfsense virtualized -> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059 Workaround is to disable hardware checksum offload box under System > Advanced on ...
user avatar
  • 81
5 votes

Why would pfSense ignore arp requests?

A bridge exists containing members WAN and LAN, assigned to an interface LANBR. A bridge is a L2-Device, and has only interest in IP addressing for the purpose of configuring/managing the bridge ...
user avatar
4 votes

Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server

Under System->Advanced->Firewall and NAT there is an option "Automatically create outbound NAT rules which assist inbound NAT rules that direct traffic back out to the same subnet it ...
user avatar
  • 41
4 votes
Accepted

What could cause kvm virtualized pfsense to get 84mbps behind physical pfsense, but then drop to 1mbps when it replaces physical pfsense?

JFL was correct it was a NIC checksum offloading error. My guess is that when my virtual router was behind my physical router it somehow made it so it didn't need to do checksumming. Recap of ...
user avatar
  • 287
4 votes

Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?

Can anybody explain why a pfSense router's subnet mask wouldn't be all 24 bits (255.255.255.0) like any regular router is? What is the advantage or any reason that could justify this /24/24/20/24 ...
user avatar
  • 63k
4 votes
Accepted

Can I bulk export aliases from pfSense (in order to import to another pfSense)?

I was able to use Diagnostics / Backup & Restore / Backup & Restore to complete this task. Select "Aliases" under Backup area for both exporting and importing. Obviously in the restore step ...
user avatar
4 votes
Accepted

What does "delta" stand for in arpwatch?

"delta" is just a standard mathematical expression for the difference between two measurements. Often a capital delta: Δt means difference in t, often time, which would be worked out as t1 - t0 ...
user avatar
  • 15.9k
4 votes
Accepted

What does 'parent interface' mean with respect to VLANs?

As you've already guessed, the parent interface is the physical interface the virtual subinterfaces are created on. It's the one doing the actual transport to other physical devices. The igb0 bit most ...
user avatar
  • 71.5k
3 votes
Accepted

Access pfSense LAN through OpenVPN

You're going down the correct path, you need a route for your local LAN. But you need a route back from your LAN machine. At the moment it only has a default route of X.Y.Z.254 so sends all its ...
user avatar
  • 161
3 votes

can pfsense perform ipv6 nat (for outbound service redirection)

https://forum.pfsense.org/index.php?topic=89014.0 An expert finally responded - the answer is no, pfSense provides no IPv6 NAT capabilities.
user avatar
  • 151
3 votes

pfSense join 2 networks

Yes it is possible. You can do it by setting up a Static Route between your two gateways. See the documentation here: https://doc.pfsense.org/index.php/Static_Routes This is the same scenario as my ...
user avatar
3 votes

Network Segregation by pfsense + ESXi VLAN

Purpose: prevent VM in VLAN40 access VM of other VLANs Is done by rule 2, unless any of your VMs in the other VLANs gets a public IP address. If you are sure that won't happen, you're fine. allow ...
user avatar
  • 440
3 votes

Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server

Go to System > Advanced, Firewall/NAT tab. then you need to enable three options: 1) Pure NAT for NAT Reflection mode for port forwards 2) Enable NAT Reflection for 1:1 NAT 3) Enable automatic ...
user avatar
  • 31
3 votes

Pfsense and two networks

on pfsense put a static global route: 192.168.2.0/24 -->>192.168.2.254 on the cisco router/firewall put 2 statis routes : iproute 192.168.4.0 255.255.255.0 xxxx(wan interface of the pfsense box , ...
user avatar
3 votes
Accepted

How to force users to authenticate to get IP adress from DHCP?

There's a standard to achieve this: 802.1X. Basically the switch request authentication from the computer, then contact an authentication server to validate the credentials and depending on the ...
user avatar
  • 18.4k
3 votes
Accepted

OSPF between Cisco & PFsense

Insufficient reputation to comment but I think I've got a good observation here. You said this: Cisco OSPF has area 0 with 10.0.0.0/24. PFsense OSPF has area 0 with 10.0.0.0/24 But take a look at ...
user avatar
  • 2,083
3 votes

How WANs work and why it is it bad to run DNS and DHCP on a router?

WAN is a very subjective term. Routers have interfaces. Some types of router interfaces are more likely to be used as or called WAN interfaces. For example, PPP, HDLC, Frame relay, etc. are rarely ...
user avatar
  • 94k
3 votes
Accepted

Issues trunking VLANs from pfSense to Cisco switch

This has to do with how FreeBSD (the source OS for pfSense) handles interfaces. What you are labeling as "LAN" is the "VLAN parent interface" and when you perform a shut or "if down" on that ...
user avatar
  • 101
3 votes

IP VLANS and SUBNETS on Cisco and PFSENSE

Your Cisco L3 switch is acting as a router between various LAN segments. pfSense has to be made aware of the 192.168.3.0/24 network and any other LAN segment, to do the right thing™. Please register ...
user avatar
3 votes
Accepted

Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?

9.9.192.1 is an address owned by IBM - so unless they've given it to you, you can't use it on your LAN without causing problems. A subnet mask of 255.255.240.0 or /20 is completely fine as long as ...
user avatar
  • 71.5k
3 votes
Accepted

Why would pfSense ignore arp requests?

It turns out that the paravirtualized network ports need to be put in promiscuous mode. Once that's done, everything works as expected.
user avatar
3 votes

How does pfSense control network traffic when plugged into a switch?

There are a couple of possibilities. Your firewall does not control internal traffic between your PCs. Only traffic between you and the Internet. If you have a few VLANs, the firewall can control ...
user avatar
  • 63k
3 votes
Accepted

No route to host for IPs in same subnet being routed by bgp

The problem is because the destination is in the same subnet the client arps for the destination IP, not the IP of your pfsense box. By default your pfsense box does not respond to arp requests for ...
user avatar
  • 11.7k
3 votes

How to perform an inbound and outbound NAT at the same time in Pfsense?

Generally, source NAT (SNAT, NAPT) and destination NAT (DNAT, reverse NAT, port forwarding) are each stateful. That means that if you permit packets in one direction, packets belonging to the same ...
user avatar
  • 71.5k
2 votes

Is it possible to implement IPSec with failover between one pfSense firewall and Amazon VPC (no BGP)

I dont think it possible : Pfsense doc : Both locations must be using non-overlapping LAN IP subnets. And no "ip virtual-reassembly" seen. btw, pfsense 2.0.1 is outdated, and more recent support ...
user avatar
2 votes
Accepted

pfSense multi-wan Bridge, NAT, Load balancing and CARP

For the multi-wan bridge + NAT + load balancing, it can be setup as follow : 1 Create a DMZ interface IPv4 Configuration Type : None 2 Create a bridge Interfaces Assign Bridges Add Select WAN1, ...
user avatar
2 votes
Accepted

Ping unlocks ipsec vpn

I have seen this behavior before where the VPN tunnel will only stay up when a ping is done from one end of the VPN tunnel to the other. There could be a few reasons for this. First I would check the ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible