Hot answers tagged

18 votes

Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server

Its been two years since the question was asked, but I had the same problem (domain name) and SOLVED it by: Log into pfsense via IP address or any working domain name Goto System -> Advanced -> ...
MarcoZen's user avatar
  • 283
6 votes
Accepted

Block communication between hosts in the same VLAN

As has already been stated, communication between devices on the same VLAN (or layer-2 segment) does not cross a router but only the switch(es) in between the devices. Depending on the switches' ...
Zac67's user avatar
  • 82.6k
6 votes
Accepted

pfsense DHCP lease remember time settings?

You need to change the DHCP lease duration. It is a standard option in all DHCP servers. In pfsense you'll find related settings under the Services / DHCP server page, in the "other options" part: ...
JFL's user avatar
  • 19.5k
5 votes
Accepted

Spurious restransmission to a server behind pfsense NAT

Found it ! It's a bug when running pfsense virtualized -> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059 Workaround is to disable hardware checksum offload box under System > Advanced on ...
aurel's user avatar
  • 81
5 votes

Why would pfSense ignore arp requests?

A bridge exists containing members WAN and LAN, assigned to an interface LANBR. A bridge is a L2-Device, and has only interest in IP addressing for the purpose of configuring/managing the bridge ...
Marc 'netztier' Luethi's user avatar
4 votes

pfSense join 2 networks

Yes it is possible. You can do it by setting up a Static Route between your two gateways. See the documentation here: https://doc.pfsense.org/index.php/Static_Routes This is the same scenario as my ...
Bitten Fleax's user avatar
4 votes
Accepted

OSPF between Cisco & PFsense

Insufficient reputation to comment but I think I've got a good observation here. You said this: Cisco OSPF has area 0 with 10.0.0.0/24. PFsense OSPF has area 0 with 10.0.0.0/24 But take a look at ...
Darrell Root's user avatar
  • 2,183
4 votes

Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server

Go to System > Advanced, Firewall/NAT tab. then you need to enable three options: 1) Pure NAT for NAT Reflection mode for port forwards 2) Enable NAT Reflection for 1:1 NAT 3) Enable automatic ...
Kabul's user avatar
  • 41
4 votes

Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server

Under System->Advanced->Firewall and NAT there is an option "Automatically create outbound NAT rules which assist inbound NAT rules that direct traffic back out to the same subnet it ...
bitcor's user avatar
  • 41
4 votes
Accepted

What could cause kvm virtualized pfsense to get 84mbps behind physical pfsense, but then drop to 1mbps when it replaces physical pfsense?

JFL was correct it was a NIC checksum offloading error. My guess is that when my virtual router was behind my physical router it somehow made it so it didn't need to do checksumming. Recap of ...
neoakris's user avatar
  • 287
4 votes

Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?

Can anybody explain why a pfSense router's subnet mask wouldn't be all 24 bits (255.255.255.0) like any regular router is? What is the advantage or any reason that could justify this /24/24/20/24 ...
Ron Trunk's user avatar
  • 67.1k
4 votes
Accepted

Can I bulk export aliases from pfSense (in order to import to another pfSense)?

I was able to use Diagnostics / Backup & Restore / Backup & Restore to complete this task. Select "Aliases" under Backup area for both exporting and importing. Obviously in the restore step ...
yourcomputergenius's user avatar
4 votes
Accepted

What does "delta" stand for in arpwatch?

"delta" is just a standard mathematical expression for the difference between two measurements. Often a capital delta: Δt means difference in t, often time, which would be worked out as t1 - t0 ...
jonathanjo's user avatar
  • 16.2k
4 votes
Accepted

What does 'parent interface' mean with respect to VLANs?

As you've already guessed, the parent interface is the physical interface the virtual subinterfaces are created on. It's the one doing the actual transport to other physical devices. The igb0 bit most ...
Zac67's user avatar
  • 82.6k
3 votes

Network Segregation by pfsense + ESXi VLAN

Purpose: prevent VM in VLAN40 access VM of other VLANs Is done by rule 2, unless any of your VMs in the other VLANs gets a public IP address. If you are sure that won't happen, you're fine. allow ...
xpac's user avatar
  • 440
3 votes

How WANs work and why it is it bad to run DNS and DHCP on a router?

WAN is a very subjective term. Routers have interfaces. Some types of router interfaces are more likely to be used as or called WAN interfaces. For example, PPP, HDLC, Frame relay, etc. are rarely ...
Ron Maupin's user avatar
  • 98.7k
3 votes
Accepted

Issues trunking VLANs from pfSense to Cisco switch

This has to do with how FreeBSD (the source OS for pfSense) handles interfaces. What you are labeling as "LAN" is the "VLAN parent interface" and when you perform a shut or "if down" on that ...
Kit's user avatar
  • 101
3 votes
Accepted

How to force users to authenticate to get IP adress from DHCP?

There's a standard to achieve this: 802.1X. Basically the switch request authentication from the computer, then contact an authentication server to validate the credentials and depending on the ...
JFL's user avatar
  • 19.5k
3 votes
Accepted

Access pfSense LAN through OpenVPN

You're going down the correct path, you need a route for your local LAN. But you need a route back from your LAN machine. At the moment it only has a default route of X.Y.Z.254 so sends all its ...
boopzz's user avatar
  • 161
3 votes

IP VLANS and SUBNETS on Cisco and PFSENSE

Your Cisco L3 switch is acting as a router between various LAN segments. pfSense has to be made aware of the 192.168.3.0/24 network and any other LAN segment, to do the right thing™. Please register ...
Marco De Lellis's user avatar
3 votes
Accepted

Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?

9.9.192.1 is an address owned by IBM - so unless they've given it to you, you can't use it on your LAN without causing problems. A subnet mask of 255.255.240.0 or /20 is completely fine as long as ...
Zac67's user avatar
  • 82.6k
3 votes
Accepted

Why would pfSense ignore arp requests?

It turns out that the paravirtualized network ports need to be put in promiscuous mode. Once that's done, everything works as expected.
Reinderien's user avatar
3 votes

How does pfSense control network traffic when plugged into a switch?

There are a couple of possibilities. Your firewall does not control internal traffic between your PCs. Only traffic between you and the Internet. If you have a few VLANs, the firewall can control ...
Ron Trunk's user avatar
  • 67.1k
3 votes
Accepted

No route to host for IPs in same subnet being routed by bgp

The problem is because the destination is in the same subnet the client arps for the destination IP, not the IP of your pfsense box. By default your pfsense box does not respond to arp requests for ...
Peter Green's user avatar
  • 13.1k
3 votes
Accepted

How to perform an inbound and outbound NAT at the same time in Pfsense?

Generally, source NAT (SNAT, NAPT) and destination NAT (DNAT, reverse NAT, port forwarding) are each stateful. That means that if you permit packets in one direction, packets belonging to the same ...
Zac67's user avatar
  • 82.6k
3 votes
Accepted

Server with multiple NICs takes different route when answering

This is all working "as designed". The client doesn't know anything about Server 2's configuration, so to reach it (and any other 5.x) the default route to Server 1 applies. When that ...
Ricky's user avatar
  • 31.7k
2 votes
Accepted

High traffic caused by DHCPv6

I have seen this behaviour before. It tends to happen when you set the M (Managed) flag in the RA (Router Advertisement) but have a DHCPv6 server that doesn't provide the client with IA_NA (basically ...
Sander Steffann's user avatar
2 votes

How WANs work and why it is it bad to run DNS and DHCP on a router?

What is the purpose of the WAN interface and how does it separate a local virtual environment from the public internet? And how is it similar to a cable modem? WAN interface is a vague term but it ...
TDurden's user avatar
  • 1,241
2 votes
Accepted

Ping unlocks ipsec vpn

I have seen this behavior before where the VPN tunnel will only stay up when a ping is done from one end of the VPN tunnel to the other. There could be a few reasons for this. First I would check the ...
Brian halbach's user avatar
2 votes
Accepted

Assign public IP of /29 block directly to a connected device in pfSense

I found my answer in the pfSense The Definitive Guide Version 2.1. Small WAN IP subnet with larger LAN IP subnet Some ISPs will give you a small IP subnet as the "WAN side" assignment, and ...
Scott's user avatar
  • 141

Only top scored, non community-wiki answers of a minimum length are eligible