20
votes
Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server
Its been two years since the question was asked, but I had the same problem (domain name) and SOLVED it by:
Log into pfsense via IP address or any working domain name
Goto System -> Advanced -> ...
- 303
6
votes
Accepted
Block communication between hosts in the same VLAN
As has already been stated, communication between devices on the same VLAN (or layer-2 segment) does not cross a router but only the switch(es) in between the devices.
Depending on the switches' ...
- 88.1k
6
votes
Accepted
pfsense DHCP lease remember time settings?
You need to change the DHCP lease duration.
It is a standard option in all DHCP servers.
In pfsense you'll find related settings under the Services / DHCP server page, in the "other options" part:
...
- 19.8k
5
votes
Accepted
Can I bulk export aliases from pfSense (in order to import to another pfSense)?
I was able to use Diagnostics / Backup & Restore / Backup & Restore to complete this task.
Select "Aliases" under Backup area for both exporting and importing.
Obviously in the restore step ...
5
votes
Why would pfSense ignore arp requests?
A bridge exists containing members WAN and LAN, assigned to an
interface LANBR.
A bridge is a L2-Device, and has only interest in IP addressing for the purpose of configuring/managing the bridge ...
- 8,876
4
votes
Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server
Go to System > Advanced, Firewall/NAT tab. then you need to enable three options:
1) Pure NAT for NAT Reflection mode for port forwards
2) Enable NAT Reflection for 1:1 NAT
3) Enable automatic ...
- 41
4
votes
Accepted
OSPF between Cisco & PFsense
Insufficient reputation to comment but I think I've got a good observation here. You said this:
Cisco OSPF has area 0 with 10.0.0.0/24.
PFsense OSPF has area 0 with 10.0.0.0/24
But take a look at ...
- 2,243
4
votes
Accepted
What could cause kvm virtualized pfsense to get 84mbps behind physical pfsense, but then drop to 1mbps when it replaces physical pfsense?
JFL was correct it was a NIC checksum offloading error. My guess is that when my virtual router was behind my physical router it somehow made it so it didn't need to do checksumming.
Recap of ...
- 297
4
votes
Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?
Can anybody explain why a pfSense router's subnet mask wouldn't be all
24 bits (255.255.255.0) like any regular router is? What is the
advantage or any reason that could justify this /24/24/20/24 ...
- 68k
4
votes
Accepted
What does "delta" stand for in arpwatch?
"delta" is just a standard mathematical expression for the difference between two measurements.
Often a capital delta: Δt means difference in t, often time, which would be worked out as t1 - t0 ...
- 16.4k
4
votes
Accepted
What does 'parent interface' mean with respect to VLANs?
As you've already guessed, the parent interface is the physical interface the virtual subinterfaces are created on. It's the one doing the actual transport to other physical devices. The igb0 bit most ...
- 88.1k
3
votes
How WANs work and why it is it bad to run DNS and DHCP on a router?
WAN is a very subjective term. Routers have interfaces. Some types of router interfaces are more likely to be used as or called WAN interfaces. For example, PPP, HDLC, Frame relay, etc. are rarely ...
- 101k
3
votes
Accepted
Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?
9.9.192.1 is an address owned by IBM - so unless they've given it to you, you can't use it on your LAN without causing problems.
A subnet mask of 255.255.240.0 or /20 is completely fine as long as ...
- 88.1k
3
votes
IP VLANS and SUBNETS on Cisco and PFSENSE
Your Cisco L3 switch is acting as a router between various LAN segments.
pfSense has to be made aware of the 192.168.3.0/24 network and any other LAN segment, to do the right thing™.
Please register ...
- 333
3
votes
Accepted
Issues trunking VLANs from pfSense to Cisco switch
This has to do with how FreeBSD (the source OS for pfSense) handles interfaces. What you are labeling as "LAN" is the "VLAN parent interface" and when you perform a shut or "if down" on that ...
- 101
3
votes
Accepted
How to force users to authenticate to get IP adress from DHCP?
There's a standard to achieve this: 802.1X.
Basically the switch request authentication from the computer, then contact an authentication server to validate the credentials and depending on the ...
- 19.8k
3
votes
Accepted
Access pfSense LAN through OpenVPN
You're going down the correct path, you need a route for your local LAN. But you need a route back from your LAN machine. At the moment it only has a default route of X.Y.Z.254 so sends all its ...
- 161
3
votes
Accepted
Why would pfSense ignore arp requests?
It turns out that the paravirtualized network ports need to be put in promiscuous mode. Once that's done, everything works as expected.
- 161
3
votes
How does pfSense control network traffic when plugged into a switch?
There are a couple of possibilities.
Your firewall does not control internal traffic between your PCs. Only traffic between you and the Internet.
If you have a few VLANs, the firewall can control ...
- 68k
3
votes
Accepted
No route to host for IPs in same subnet being routed by bgp
The problem is because the destination is in the same subnet the client arps for the destination IP, not the IP of your pfsense box. By default your pfsense box does not respond to arp requests for ...
- 13.8k
3
votes
Accepted
How to perform an inbound and outbound NAT at the same time in Pfsense?
Generally, source NAT (SNAT, NAPT) and destination NAT (DNAT, reverse NAT, port forwarding) are each stateful. That means that if you permit packets in one direction, packets belonging to the same ...
- 88.1k
3
votes
Accepted
Server with multiple NICs takes different route when answering
This is all working "as designed". The client doesn't know anything about Server 2's configuration, so to reach it (and any other 5.x) the default route to Server 1 applies. When that ...
- 32.6k
2
votes
Accepted
High traffic caused by DHCPv6
I have seen this behaviour before. It tends to happen when you set the M (Managed) flag in the RA (Router Advertisement) but have a DHCPv6 server that doesn't provide the client with IA_NA (basically ...
- 6,780
2
votes
How WANs work and why it is it bad to run DNS and DHCP on a router?
What is the purpose of the WAN interface and how does it separate a
local virtual environment from the public internet? And how is it
similar to a cable modem?
WAN interface is a vague term but it ...
- 1,241
2
votes
Accepted
Assign public IP of /29 block directly to a connected device in pfSense
I found my answer in the pfSense The Definitive Guide Version 2.1.
Small WAN IP subnet with larger LAN IP subnet
Some ISPs will give you a small IP subnet as the "WAN side" assignment, and ...
- 141
2
votes
Accepted
Per VLAN DNS Host Override Using Same Name
Yes, it is possible.
You can manually set your name server in your box.
You have to connect to a same server that has a capability of deep packet inspection such that the DNS reply depends on the ...
- 1,237
2
votes
Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?
QUESTION: Can anybody explain why a pfSense router's subnet mask
wouldn't be all 24 bits (255.255.255.0) like any regular router is?
What is the advantage or any reason that could justify this
/...
- 101k
2
votes
pfSense IPv6 NAT
I know, many of you told that IPv6 has no NAT. But my server provider told me, that it is possibile. I have no idea how...
IPv4 and IPv6 are fundamentally quite similar. The basic principles of NAT ...
- 13.8k
2
votes
Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?
Personally I prefer to not change anything until I know what is meant to work
You seem to have two subnets in the same system - I dont know why (as in what is the functional requirement for two ...
- 374
2
votes
Accepted
Setting up a hypervisor network
Should I get a smart switch and create VLANs to segment the hypervisor network?
Yes, if you need to segment the VMs for security or QoS. Or if you have an MPLS network. But if not, then no. A ...
- 68k
Only top scored, non community-wiki answers of a minimum length are eligible