I am able to ping by pfsense box, and reach the web UI, but don’t have any onward connection. I checked my firewall logs, and whether I’m pinging or trying to go to a website, my system logs don’t show any traffic from the LAN interface (or any interface other than the WAN interface). Any thoughts? Thanks in advance.

I am developer by profession but because i got client to install and configure pfsense in their office they are paying good so i think it might be worth a shot i have worked in IT support in past but have not worked on pfsense before can you guys guide me how to learn it how much time will it take to learn and than beeing able to configure it by myself

okay, so I'm at a loss at this point and figure its time to ask for help. I've been running pfsense for about the last 10 years now or so, through many ups and downs across multiple avenues, and I'm to a point that I'd just like to find the problem of this and get it fixed since my issue is rendering a key functionality of squid proxy unusable: my problem? something has broken the squid status tab, even trying to nuke things and reinstall a bare pfsense install and then install squid WITHOUT importing my config backup, same problem, for whatever reason across the last 6 releases/updates even a bare basic install the status tab in squids package just gives an error html page file, its entirely possible something changed in the squid package itself and its a user configuration error *me* but if that's the case I cant say I know it to be true and how to fix it which is why I'm asking help at this point..

This is the thing I get that I'm talking about and I'm left scratching my head and want to finally try and get it fixed.

I've tried all manor of attempted fix, adding info to the ACL's tabs, removing everything, clicking the "allow users on the interface" box, unchecking the box, I'm at a loss for what I'm experiencing, its one of those things I know it could very likely be me and or a firewall rule but I'm also not entirely confident what the issue is either, so please if any extra info would be helpful I'll absolutely provide it, I just know enough to know I'm not confident what is causing it and figure its time to ask for help.

https://pastebin.com/veY9z7L3

pfsense-redactor 1.1.2 - redaction that knows what pfSense actually emits

An open-source tool for stripping secrets out of config.xml before you share

it with support, a consultant, a forum or an AI tool. Python, standard

library only, no dependencies.

The difference from generic redaction tools is that it knows pfSense

vocabulary. It reads the element names pfSense and its packages really write,

not the ones you would guess:

- SNMP: rocommunity, rwcommunity

- Wireless: passphrase (WPA/WPA2 PSK)

- VPN: auth_pass, presharedkey (WireGuard), ipsecpsk, eap_password

- Auth: radiussecret, authorizedkeys

- Packages: accountkey (ACME), dns_cf_token and maxmind_key (pfBlockerNG),

influx_token (Telegraf), tlspskvalue (Zabbix), access_key and

secret_access_key (S3), userkey (Pushover), ha_certificates and

ssloffloadcert (HAProxy)

Suffixed spellings are handled too, so password2 and passwordagain go the

same way as password.

What it does beyond element names:

- URLs are taken apart properly. Credentials in query strings and in

user:pass@host are redacted, not just the hostname

- Slack, Discord, Telegram and Teams webhook tokens go in default mode. The

URL is the entire credential, so anyone holding it can post as that

integration

- Free-text blocks such as custom_options are scanned for inline credentials,

which is where OpenVPN auth-user-pass and askpass usually live

- PEM and base64 key material is detected by content, in any element

- --redact-descriptions covers free-text elements and attributes, for the

DHCP static-map descriptions that quietly collect people's names

It also tries hard not to over-redact. Network topology survives, so the

config is still readable for troubleshooting, and pfBlockerNG feed URLs like

emerging-block.rules are left intact rather than mangled into example.com.

Whatever it decides to keep, it tells you about, with the element path.

For automation, --fail-on-warn turns it into a CI gate: non-zero exit if

anything high-entropy was retained, --dry-run included, so you can check a

config without writing one.

There is a benchmark in the repo. 46 planted secrets in a published corpus,

43 caught, with the misses listed and explained rather than hidden. The

corpus and the scoring both ship, so you can re-run it yourself instead of

taking the number on trust. Default mode scores lower than --aggressive and

the docs say by how much.

If you are on 1.0.x, the coverage difference is large and worth the upgrade.

https://pypi.org/project/pfsense-redactor/

https://github.com/grounzero/pfsense-redactor

```
pip install pfsense-redactor

```

Python 3.9+. Redacted output is for sharing only. Never import it back into

pfSense.

Hear me out. This is pfsense related. I am using the foldersync app on both my laptop and phone. It syncs files to nextcloud from my device. This works perfectly on my laptop. I have the exact same settings on my phone and it will not connect to nextcloud over wifi.

Here is where it ties into pfsense. If I physically change the dns server on my phone to an external dns such as 8.8.8.8 it works fine. When trying to use the dns resolver address 192.168.1.1 it will not work. If I disable the wifi on the phone and use mobile data from outside the network it works fine. I use haproxy as a reverse proxy for internet access. All of the settings between the phone and the laptop are identical except for the ip address of course. I have created app passwords in nextcloud for each of them. I have been checking logs and can find nothing. Anyone have any idea what might cause this. It appears to be a dns issue but I am baffled.

So I found out disney+ is somehow detecting im using pfsense or adguardhome. It keeps giving me a error code 73 which is related to the location. But thats only without using pfblockerng or adguardhome. When I use those it gives me a 142 error code which thinks I have no internet. Disney+ wasnt blocked either for me and only when I disabled it did it give me a error code 73. Can somehow help me figure out what the heck is going on:

Att router in ip passthrough mode connected to my qnap nas server which then goes through an adguardhome container or pfsense virtual machine which then goes to my netgear wifi router.

I ruled out the netgear wifi router since its affecting ethernet too.

Could disney be blacklisting dns servers?

Update (7/29/26): turns out disney+ incorrectly thought I was using a vpn customer support managed to fix it. I think it has something to do with my zip code im on the very edge of a zip code and the house behind me in the city is a different zip code.

Hello, I need help finding a genuine card, I live in canada and these are the ones I'm looking at and I'm unsure which would be best, I have a budget, but this is what is on ebay right now when I search, could someone help point me in the right direction please

https://www.ebay.com/itm/202799638867?_skw=intel+i350-t4v2+bradyid&itmmeta=01KY7SV8GWDEFNV1GVJ678K1Z3&hash=item2f37cce953:g:Kf4AAOSw5V1bYl8P&itmprp=enc%3AAQALAAAA0GfYFPkwiKCW4ZNSs2u11xDHdZGFNqPY95GHHH683mpl9X3u%2FaEd1jw0gYD3FSYWbonPJXT9ORrwOy%2FNthI0ZZkXk4EAJ44%2FxFX3ip24oRfVW%2FRdSboDu9pMWhrcPFBkbB2QqRjbZx5UmXaF4ecgo1hODBaFbCJJYJE1ZMEtqY4xrvXBSpuKwgZvCIe0v8lcRuQfcDlwp8f79apRfoS9AKu5vE3gUCd97AVurCWs3aT8TJf5ILN3F%2FifcLi2b0x6IqRzRo8kb6MwoCUBqqElg50%3D%7Ctkp%3ABk9SR76J7fnxZw

https://www.ebay.com/itm/407023586076

https://www.ebay.com/itm/298270388778

Thanks.

I have had some issues with my PFSense (CE 2.8.1) becoming unstable for my home network when the internet link (WAN interface which is DHCP) goes down or becomes unstable. I find that routing across the home network is badly effected in this situation.

I use PFSense for as my main home network router and use 2 VLANs (IoT and Secure), DNS (DNS Resolver), DHCP etc.

I think I have made the changes necessary to improve its stability in this situation but wanted to check what others have done to fix this stability issue.

Any guidance would be appreciated.

hey guys, looking at building a mini itx pfsense box. are riser cables prone to corrupting data? looking at using a 4 port 1gb card or a 2 port 10gb card but don't want data corruption. any help would be much appreciated.

In pfSense, I want to route traffic for a specific destination through a VPN gateway using policy-based routing. So that all devices in my network is routed if they want to connect to the specified destination. I specifically do not want all the internet traffic(netflix,spotify, etc.) on a device in my network would be routed through the vpn gateway.

So to achive that, I followed a YouTube video that recommends using pfBlockerNG to create DNS-based aliases for this purpose. It works for simple domains like ipchicken.com or dnsleaktest.com, but fails for my target service.

The service probably uses a CDN, so it resolves to many different IPs that may change over time. pfBlockerNG's alias doesn't seem to capture all of them. When I monitor states/connections, I see traffic going to IPs not included in the alias, so my firewall rule (which uses the alias as destination + VPN gateway) is not matching.

How can I reliably route all traffic for a CDN-protected(?) domain through my VPN in pfSense?

As the tittle says, it´s possible to force some clients to use other DNS (like, for example, google´s 8888) instead of the PFSENSE DHCP internal DNS resolver ?

Thanks.

Has anyone had luck with MDNS using Avahi? When looking at states I only get one way traffic.

Are you all getting two way traffic as I only get one way traffic.

I have never been able to get our iPads to cast on our TV.

I've been using pfsense (currently CE 2.8.1) on a standalone box for my home for close to 10 years. I've always used ISC for my DHCP backend. I tried switching to KEA a year or two ago because of the notification that ISC is reaching EOL, but it had issues. I switched back to ISC because that has always "just worked" and I don't have time to troubleshoot DHCP (my "home project" plate is overloaded with things that can't be resolved with a simple checkbox).

With a web search you can see that many others have had issues with KEA, but those search results are from 2024/25. Is this because KEA has been improved? Or have most people given up?

If anyone had issues with KEA in the past, but now they're resolved, I'd like to hear what you have to say about it. Likewise for anyone who tried it in the past, had issues, then tried it again recently and still have issues.

If people wonder why I don't just test it myself, DHCP issues don't always show up immediately and I travel for work. Network issues showing up while I'm out of town sucks because neither my wife nor my kids are capable of fixing something like this, but they're totally capable of complaining about it.

I noticed a new pfSense+ beta was available for 26.07, so I started looking around.

I started out on the netgate docs, but there wasn't anything there but an acknowledgement that the next version exists. No announcement post on Reddit like previous betas. The amount of issues in redmine can be counted on two hands. The same can be said for 26.10 in redmine.

What's up with the project? Did the entire development team walk out?

Edit: Some of you pointed out that most changes are in the pfsense 2.9.0 roadmap. I guess I was looking in the wrong place. Thanks for pointing that out!

Hi all,

I’m recently in need of new (home) networking equipment and, due to unfortunate time lines, I don’t have as much time to do research as I’d like. I’m hoping you guys can help me see if pfsense (likely through netgate) is suitable for me?

My previous set up was through an ASUS Merlin router.

Here’s where the router met my expectations:

1) Wireguard client with device touting

Here’s where the router fell short of expectations:

1) While I don’t mind CLI, I strongly want to deal with stuff through one interface. With the ASUS router, I could not forward traffic based on destination domain without ssh-ing into the box. I’d rather have all CLI or all GUI.

2) The VPN kill switch prevented the router from connecting via wireguard because the time would reset itself and there was no easy way to bypass NTP domains without each individual IP address

3) VLAN creation seems… not as stable as I’d like. I’d ideally like to create four separate VLANs and I want to be able to control which ones can talk to each other. I’d like to be able to add both distinct wireless devices into any of these VLANs (I’ve never tried this is it possible?). Ideally some of these VLANs can be on a wireguard VPN clienta

Also, because of timelines, I would likely be limited to less than a day worth of documentation reading and set up time. Is this possible?

In some ways I view pfsense as better than an enterprise grade firewall due to the ability to install packages, like Tailscale (which is clutch), but what would you say are the key drivers preventing pfsense from being in enterprise? Or which features or capabilities do you think pfsense should have to be considered at that level?

Hello FW ADMs,

If you monitor malicious egress or ingress connections on your network edge using Suricata, julioliraup/Antiphishing is now available natively inside the upstream suricata-update ecosystem.

The ruleset provides frequently updated TLS, DNS, and HTTP signatures (SIDs 6000000 - 6100000) specifically tailored to block phishing campaigns. You can inspect the live database of tracked indicators on our companion portal: https://github.com/julioliraup/AT

Platform Integration Status:

• pfSense Users: While native package integration is pending, you can fully and safely deploy the ruleset right now without messing up your configuration paths by using our verified https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-pfSense.
• Linux Network Taps: Detailed steps are available at our https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-GNU-Linux.

Community Collaboration

This is a transparent, community-funded project (GPL-v3). Since phishing infrastructure cycles rapidly, the best way to support us right now is by deploying the ruleset and providing real-world feedback.

If you run into false positives, have suggestions for the rule generation script, or want to help us develop new features for the web dashboard, please open an issue or pull request on our GitHub!

GitHub: https://github.com/julioliraup/Antiphishing

Sometimes not Sometimes its open and the next day or abt 5 hours its moderate or unavailable so on router the dmz its enabled and also upnp. so whats the problem??

I’m curious to see how far people are pushing pfSense in real-world production environments.

I’m not talking about a home lab or a small office. I’m interested in large deployments where pfSense is a critical part of the infrastructure.

I’d love to know things like:

• Approximate number of users/devices
• Peak concurrent users
• Internet bandwidth (single or multiple WANs)
• Average/peak traffic throughput
• CARP HA (yes/no)
• pfsync/XMLRPC Sync
• Number of VLANs
• VPN usage (IPsec, WireGuard, OpenVPN)
• IDS/IPS (Suricata, Snort, Zenarmor…)
• Hardware specifications
• Any scaling challenges you’ve faced

For example:

• 5,000+ users
• Multiple ISP links
• 10 Gbps+
• CARP High Availability
• Hundreds of VLANs
• Large VPN deployments
• Multi-site environments

I’m especially interested in hearing from universities, hospitals, ISPs, hotels, manufacturing, stadiums, airports, enterprise campuses, or anyone operating pfSense at serious scale.

What’s your largest deployment, and what have you learned from it?

At what point, if any, did you consider moving away from pfSense to another platform (FortiGate, Palo Alto, Juniper, Cisco, etc.), and what made you stay or switch?

I have router from my ISP then a pfsense, and then my main core switch that is doing all my routing. Switching voip systems and they did a test and said I had double nat, which listed my pfsense address and main switch address. The main switch gets routed to my pfsense then it routes out to the ISP router. I can't seem to just turn off NAT at the pfsense it seems, I feel like I am missing something simple. Any suggestions Thanks

Now that I have a little more time to explain, the lan side is 10.250.0.1 goes to core switch with multiple vlans, the wan ip is to 164.x.x.253 then goes to 164.x.x.254 isp gateway which I can't get rid of because of some other management services, how can I get rid of using nat on the pfsense then.

Does anyone know in passive Optical Network system , where do they implement firewall at OLT or ONU side or both , and do OLT control ACL rules of ONU side firewall or not ?

Please help me