17
votes
Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server
Its been two years since the question was asked, but I had the same problem (domain name) and SOLVED it by:
Log into pfsense via IP address or any working domain name
Goto System -> Advanced -> ...
- 273
6
votes
Accepted
Block communication between hosts in the same VLAN
As has already been stated, communication between devices on the same VLAN (or layer-2 segment) does not cross a router but only the switch(es) in between the devices.
Depending on the switches' ...
- 78.4k
6
votes
Accepted
pfsense DHCP lease remember time settings?
You need to change the DHCP lease duration.
It is a standard option in all DHCP servers.
In pfsense you'll find related settings under the Services / DHCP server page, in the "other options" part:
...
- 19k
5
votes
Accepted
Spurious restransmission to a server behind pfsense NAT
Found it !
It's a bug when running pfsense virtualized -> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059
Workaround is to disable hardware checksum offload box under System > Advanced on ...
- 81
5
votes
Why would pfSense ignore arp requests?
A bridge exists containing members WAN and LAN, assigned to an
interface LANBR.
A bridge is a L2-Device, and has only interest in IP addressing for the purpose of configuring/managing the bridge ...
- 8,122
4
votes
Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server
Go to System > Advanced, Firewall/NAT tab. then you need to enable three options:
1) Pure NAT for NAT Reflection mode for port forwards
2) Enable NAT Reflection for 1:1 NAT
3) Enable automatic ...
- 41
4
votes
Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server
Under System->Advanced->Firewall and NAT there is an option "Automatically create outbound NAT rules which assist inbound NAT rules that direct traffic back out to the same subnet it ...
- 41
4
votes
pfSense join 2 networks
Yes it is possible. You can do it by setting up a Static Route between your two gateways.
See the documentation here: https://doc.pfsense.org/index.php/Static_Routes
This is the same scenario as my ...
- 143
4
votes
Accepted
OSPF between Cisco & PFsense
Insufficient reputation to comment but I think I've got a good observation here. You said this:
Cisco OSPF has area 0 with 10.0.0.0/24.
PFsense OSPF has area 0 with 10.0.0.0/24
But take a look at ...
- 2,153
4
votes
Accepted
What could cause kvm virtualized pfsense to get 84mbps behind physical pfsense, but then drop to 1mbps when it replaces physical pfsense?
JFL was correct it was a NIC checksum offloading error. My guess is that when my virtual router was behind my physical router it somehow made it so it didn't need to do checksumming.
Recap of ...
- 287
4
votes
Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?
Can anybody explain why a pfSense router's subnet mask wouldn't be all
24 bits (255.255.255.0) like any regular router is? What is the
advantage or any reason that could justify this /24/24/20/24 ...
- 65.4k
4
votes
Accepted
Can I bulk export aliases from pfSense (in order to import to another pfSense)?
I was able to use Diagnostics / Backup & Restore / Backup & Restore to complete this task.
Select "Aliases" under Backup area for both exporting and importing.
Obviously in the restore step ...
4
votes
Accepted
What does "delta" stand for in arpwatch?
"delta" is just a standard mathematical expression for the difference between two measurements.
Often a capital delta: Δt means difference in t, often time, which would be worked out as t1 - t0 ...
- 16k
4
votes
Accepted
What does 'parent interface' mean with respect to VLANs?
As you've already guessed, the parent interface is the physical interface the virtual subinterfaces are created on. It's the one doing the actual transport to other physical devices. The igb0 bit most ...
- 78.4k
3
votes
Accepted
How to force users to authenticate to get IP adress from DHCP?
There's a standard to achieve this: 802.1X.
Basically the switch request authentication from the computer, then contact an authentication server to validate the credentials and depending on the ...
- 19k
3
votes
Accepted
Access pfSense LAN through OpenVPN
You're going down the correct path, you need a route for your local LAN. But you need a route back from your LAN machine. At the moment it only has a default route of X.Y.Z.254 so sends all its ...
- 161
3
votes
can pfsense perform ipv6 nat (for outbound service redirection)
https://forum.pfsense.org/index.php?topic=89014.0
An expert finally responded - the answer is no, pfSense provides no IPv6 NAT capabilities.
- 151
3
votes
How WANs work and why it is it bad to run DNS and DHCP on a router?
WAN is a very subjective term. Routers have interfaces. Some types of router interfaces are more likely to be used as or called WAN interfaces. For example, PPP, HDLC, Frame relay, etc. are rarely ...
- 97.3k
3
votes
Network Segregation by pfsense + ESXi VLAN
Purpose:
prevent VM in VLAN40 access VM of other VLANs
Is done by rule 2, unless any of your VMs in the other VLANs gets a public IP address. If you are sure that won't happen, you're fine.
allow ...
- 440
3
votes
Accepted
Issues trunking VLANs from pfSense to Cisco switch
This has to do with how FreeBSD (the source OS for pfSense) handles interfaces. What you are labeling as "LAN" is the "VLAN parent interface" and when you perform a shut or "if down" on that ...
- 101
3
votes
IP VLANS and SUBNETS on Cisco and PFSENSE
Your Cisco L3 switch is acting as a router between various LAN segments.
pfSense has to be made aware of the 192.168.3.0/24 network and any other LAN segment, to do the right thing™.
Please register ...
- 333
3
votes
Accepted
Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?
9.9.192.1 is an address owned by IBM - so unless they've given it to you, you can't use it on your LAN without causing problems.
A subnet mask of 255.255.240.0 or /20 is completely fine as long as ...
- 78.4k
3
votes
Accepted
Why would pfSense ignore arp requests?
It turns out that the paravirtualized network ports need to be put in promiscuous mode. Once that's done, everything works as expected.
- 161
3
votes
How does pfSense control network traffic when plugged into a switch?
There are a couple of possibilities.
Your firewall does not control internal traffic between your PCs. Only traffic between you and the Internet.
If you have a few VLANs, the firewall can control ...
- 65.4k
3
votes
Accepted
No route to host for IPs in same subnet being routed by bgp
The problem is because the destination is in the same subnet the client arps for the destination IP, not the IP of your pfsense box. By default your pfsense box does not respond to arp requests for ...
- 12.5k
3
votes
How to perform an inbound and outbound NAT at the same time in Pfsense?
Generally, source NAT (SNAT, NAPT) and destination NAT (DNAT, reverse NAT, port forwarding) are each stateful. That means that if you permit packets in one direction, packets belonging to the same ...
- 78.4k
3
votes
Accepted
Server with multiple NICs takes different route when answering
This is all working "as designed". The client doesn't know anything about Server 2's configuration, so to reach it (and any other 5.x) the default route to Server 1 applies. When that ...
- 30.9k
2
votes
Is it possible to implement IPSec with failover between one pfSense firewall and Amazon VPC (no BGP)
I dont think it possible :
Pfsense doc : Both locations must be using non-overlapping LAN IP subnets.
And no "ip virtual-reassembly" seen.
btw, pfsense 2.0.1 is outdated, and more recent support ...
- 21
2
votes
How WANs work and why it is it bad to run DNS and DHCP on a router?
What is the purpose of the WAN interface and how does it separate a
local virtual environment from the public internet? And how is it
similar to a cable modem?
WAN interface is a vague term but it ...
- 1,241
2
votes
Accepted
Ping unlocks ipsec vpn
I have seen this behavior before where the VPN tunnel will only stay up when a ping is done from one end of the VPN tunnel to the other. There could be a few reasons for this. First I would check the ...
Only top scored, non community-wiki answers of a minimum length are eligible