pfSense bugtracker: Issueshttps://redmine.pfsense.org/https://redmine.pfsense.org/favicon.ico?16780521162024-03-05T19:53:06ZpfSense bugtracker
Redmine pfSense Packages - Bug #15313 (Confirmed): Zabbix server 6.4.12 requires Zabbix proxies to be ver...https://redmine.pfsense.org/issues/153132024-03-05T19:53:06ZAndrew Almond
<p>There seems to be a bug/change with Zabbix server and Zabbix proxy where both need to be running 6.4.12.<br />If the versions don't match, then the proxy is unable to receive configuration changes from the server and shows this message in the log:</p>
<pre>
cannot process received configuration data from server at "192.168.1.8": unexpected field "httptest.status"
</pre>
<p>There are 3 bug reports with Zabbix about this issue:<br /><a class="external" href="https://support.zabbix.com/browse/ZBX-24162">https://support.zabbix.com/browse/ZBX-24162</a><br /><a class="external" href="https://support.zabbix.com/browse/ZBX-24161">https://support.zabbix.com/browse/ZBX-24161</a><br /><a class="external" href="https://support.zabbix.com/browse/ZBX-23232">https://support.zabbix.com/browse/ZBX-23232</a></p>
<p>It looks like this issue was addressed in Zabbix 6.4.12:<br /><a class="external" href="https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/28b3672d114">https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/28b3672d114</a></p>
<p>We are running 23.05.1 and the package manager installs Zabbix 6.4.1 (revision 546e284fd7c).<br />Would it be possible to have the Zabbix proxy and agent packages updated to 6.4.12?</p>
<p>It looks like the packages were updated to 6.4.8 for pfSense 23.09, so even upgrading to that will not solve the issue.<br /><a class="external" href="https://redmine.pfsense.org/issues/14913">https://redmine.pfsense.org/issues/14913</a></p> pfSense Packages - Bug #15274 (Incomplete): HAProxy Configuration Changes Require pfSense Reboot ...https://redmine.pfsense.org/issues/152742024-02-20T21:51:14ZZachary Cohen
<p>As originally reported here (<a class="external" href="https://forum.netgate.com/topic/172972/haproxy-config-changes-not-loaded-pfsense-restart-needed">https://forum.netgate.com/topic/172972/haproxy-config-changes-not-loaded-pfsense-restart-needed</a>), changes made to the HAProxy configuration require a reboot to take effect.</p>
<p>I'm consistently able to reproduce this issue when adding new backends.</p>
<p>When browsing to the new backend, I receive a 503 - "no server is available to handle this request". After rebooting, it works as expected.</p>
<p>Other users have been able to validate that this issue was present starting with pfSense 2.6.0 and HAProxy version haproxy-devel 0.62.10.</p>
<p>While I was able to replicate that issue starting on that version, I'm currently replicating it in pfSense 2.7.2-RELEASE (amd64) and haproxy-devel 0.63_2.</p> pfSense Packages - Feature #15218 (New): Allow manual ordering of generated ruleshttps://redmine.pfsense.org/issues/152182024-01-30T19:01:53ZRonald Antonyrcfa+pfsense.org@cubiculum.com
<p>Under Firewall > pfBlockerNG in the IP tab's IP Interface/Rules Configuration section, there's the "Firewall 'Auto' Rule Order" setting.</p>
<p>Whats's needed here is a "manual" option, where new rules are simply appended at the bottom, and the user can then reorder them where they should be on the Firewall Rules setting page.<br />I have a rather specific ordering of my rules, and each time something updates the auto rules, my rule order is messed up, and I must reorder them, which is frankly a major PITA.</p>
<p>In particular I have certain pass rules that MUST always be at first place, but then I want all the blocking and filter rules, and last I want the regular passing rules. e.g. I want spammers filtered before they get passed to the mail server, but I want anti-lockout rules to always pass traffic to my admin software interfaces, no matter what.</p>
<p>So the auto rules must go between pfSense pass rules, and that won't work. To prevent getting potentially locked out, I must use the order "pfSense Pass/Match | pfb_Pass/Match | pfB_Block/Reject | pfSense Block/Reject" auto-order, but my actual order is more like "pfSense Pass/Match | pfSense Block/Reject | pfb_Pass/Match | pfB_Block/Reject | pfSense Pass/Match" where obviously only I know what goes where.</p>
<p>So manual ordering is a key option that should be provided...</p> pfSense Packages - Bug #15131 (Incomplete): OpenVPN client export issues with iPhone and IPV6 con...https://redmine.pfsense.org/issues/151312024-01-02T18:38:40ZJonathan Lee
<p>I have researched and found an issue within the OpenVPN's client export config file for iPhones (OpenVPN Connect (iOS/Android))</p>
<p>it exports with udp4 listed and this does not work with iPhones because of ipv6 in the config (.ovpn) file and must be changed to udp for iOS iPhones to work with OpenVPN and pfSense.</p>
<p>That is the only adaption needed to fix this issue.</p> pfSense Packages - Feature #15056 (New): Feature Request: Donate to Package Maintainer Button https://redmine.pfsense.org/issues/150562023-12-01T20:31:37ZJonathan Lee
<p>Maybe the packages, should have a button so donate button to send some money to maintainers. I recently learned that Snort was built with donated time. I was really confused about this. It kind of confused me.</p> pfSense - Bug #15015 (New): Static routes not workinghttps://redmine.pfsense.org/issues/150152023-11-20T17:53:07ZSilviu Bajenaru
<p>Hello,</p>
<p>This morning I updated to PFSense 2.7.1 from 2.7.0. Now, I just tried to add a dynamic gateway and a static route. Unfortunately, the static route is not being added to the routing table. I restored the VM backup from this morning, before I updated, added the same gateway and static route and it was added to the routing table, and everything works fine.<br />I've set the priority to Urgent since this is quite bad for a router...?</p>
More info about my setup: I've got three sites, let's call them A, B and C. There is an IPSec tunnel between A and B, and one between B and C. Both tunnels are set with Mode VTI. I've assigned the ipsec interfaces and set the gateways and routes:<br />Site A has a gateway set on the IPSec interface and a route for site C that uses that gateway.<br />Site B has two gateways (one for each IPSec tunnel) and the following routes:
<ul>
<li>route to site A via the IPSec interface - gateway - going to site A</li>
<li>route to site B via the IPSec interface - gateway - going to site B<br />Site C has a gateway set on the IPSec interface and a route for site A that uses that gateway.<br />Site A was updated this morning to PFSense 2.7.1, while Site C is running 2.7.0.<br />Site A DOES NOT have the static routes added to the routing table.<br />Site C does have the static routes added to the routing table.</li>
</ul>
<p>Once I reverted Site A to 2.7.0, I did the same config again and the routes were added to the routing table.</p>
<p>Thank you.</p> pfSense Packages - Todo #14971 (New): Add text about the limit to use only Network type alias for...https://redmine.pfsense.org/issues/149712023-11-11T21:45:43ZWolfgang Thegreat
<p>Hello,</p>
<p>At the UI path of pfBlockerNG > IP > IPv4 > edit of a table object > the section of "Advanced Inbound Firewall Rule Settings" > "Custom Destination" - I tried to add an Alias object I already had, but he auto-complete didn't work nor forcing the full exact name and saving.</p>
<p>Searching around I found this post<br /><a class="external" href="https://forum.netgate.com/topic/178444/advanced-inbound-firewall-rule-settings-custom-destination-only-takes-alias-of-typ-network/2">https://forum.netgate.com/topic/178444/advanced-inbound-firewall-rule-settings-custom-destination-only-takes-alias-of-typ-network/2</a></p>
<p>Which solved my issue.<br />This field of "Custom Destination" probably accept only alias objects of a type of "Network".</p>
<p>It was a frustrating exercise...</p>
<p>Pleassse - Add to the text below this field - a prominent warning that this field only accepts Network type alias objects (god knows why).<br />It will save many users.</p>
<p>Thank you!</p> pfSense Packages - Feature #14941 (New): add directdomains list in GUIhttps://redmine.pfsense.org/issues/149412023-11-03T09:46:08ZClaude-Axel Piller
<p>Is it possible to add directly in the GUI a directdomains category like whitelist or blacklist ...<br />this directdomains won't use the proxy and can access directly to internet.<br />Some apps like vrchat don't work with proxy.<br />thanks</p> pfSense Packages - Feature #14838 (New): Full support for AdBlock-style listshttps://redmine.pfsense.org/issues/148382023-10-04T21:57:19ZAndre Braitandrebrait@gmail.com
<p>The AdBlock syntax allows for both blacklisting and whitelisting, as well as using wildcards and sometimes plain regular expressions. Many popular lists make use of such features. Currently, pfBlockerNG only supports parsing simple non-wildcard blacklist entries, as long as they obey the format `^[|]{2}.*[^]$`.</p>
<p>Support can be improved, especially for the Python mode.</p>
<ul>
<li>Unbound mode:
<ul>
<li>Whitelist entries with wildcards (limited)
<ul>
<li>Using grep with regexes to rule out entries from the blacklists</li>
</ul>
</li>
</ul>
</li>
<li>Python mode
<ul>
<li>Blacklist entries with wildcard support
<ul>
<li>Requires filtering 100% inside Python</li>
</ul>
</li>
<li>Whitelist entries with wildcard support
<ul>
<li>Probably better and easier if done 100% inside Python</li>
<li>Default "re" engine might be too slow, better to import "regex"</li>
</ul></li>
</ul></li>
</ul>
<p>References: <br />1. <a class="external" href="https://help.adblockplus.org/hc/en-us/articles/360062733293-How-to-write-filters">https://help.adblockplus.org/hc/en-us/articles/360062733293-How-to-write-filters</a><br />2. <a class="external" href="https://adguard.com/kb/general/ad-filtering/create-own-filters/">https://adguard.com/kb/general/ad-filtering/create-own-filters/</a></p>
<p>Some of it is already implemented in this PR: <a class="external" href="https://github.com/pfsense/FreeBSD-ports/pull/1302">https://github.com/pfsense/FreeBSD-ports/pull/1302</a></p> pfSense Packages - Regression #14764 (New): HAProxy local syslog not workinghttps://redmine.pfsense.org/issues/147642023-09-09T19:08:28ZMichael Vincent
<p>HAProxy package v0.63_1</p>
<p>Setting the syslog host to <code>/var/run/log</code> in the HAProxy settings doesn't produce any entries in the pfSense system logs.</p>
<p>Following the suggestion in <a href="https://serverfault.com/a/1141223" class="external">this post</a> fixes the issue by making syslogd listen to a UDP socket:</p>
<ol>
<li>Edit <code>/etc/defaults/rc.conf</code> (Diagnostics -> Edit File).</li>
<li>Change <code>syslogd_flags="-s"</code> to <code>syslogd_flags="-s -b localhost -C"</code></li>
<li>Restart the syslogd service (Status -> Services).</li>
</ol>
<p>They also reference this forum post with more details:<br /><a class="external" href="https://forums.freebsd.org/threads/haproxy-not-logging.76876/#post-477067">https://forums.freebsd.org/threads/haproxy-not-logging.76876/#post-477067</a></p> pfSense - Bug #14741 (New): PHP error in DNS Forwarder host overrides when the language is set to...https://redmine.pfsense.org/issues/147412023-09-02T10:26:29ZNicolas PISTER
<p>A PHP error occur when a user try to add or modify Host Override in DNS Forwarder module</p>
<pre>
amd64
14.0-CURRENT
FreeBSD 14.0-CURRENT #1 RELENG_2_7_0-n255866-686c8d3c1f0: Wed Jun 28 04:21:19 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/obj/amd64/LwYAddCr/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-REL
Crash report details:
PHP Errors:
[02-Sep-2023 11:55:24 Europe/Paris] PHP Fatal error: Uncaught ValueError: Unknown format specifier "p" in /usr/local/www/classes/Form/Input.class.php:127
Stack trace:
#0 /usr/local/www/classes/Form/Input.class.php(127): sprintf('Nom de domaine ...', '<br />')
#1 /usr/local/www/services_dnsmasq_edit.php(85): Form_Input->setHelp('Domain of the h...', '<br />')
#2 {main}
thrown in /usr/local/www/classes/Form/Input.class.php on line 127
[02-Sep-2023 11:58:37 Europe/Paris] PHP Fatal error: Uncaught ValueError: Unknown format specifier "p" in /usr/local/www/classes/Form/Input.class.php:127
Stack trace:
#0 /usr/local/www/classes/Form/Input.class.php(127): sprintf('Nom de domaine ...', '<br />')
#1 /usr/local/www/services_dnsmasq_edit.php(85): Form_Input->setHelp('Domain of the h...', '<br />')
#2 {main}
thrown in /usr/local/www/classes/Form/Input.class.php on line 127
[02-Sep-2023 11:58:46 Europe/Paris] PHP Fatal error: Uncaught ValueError: Unknown format specifier "p" in /usr/local/www/classes/Form/Input.class.php:127
Stack trace:
#0 /usr/local/www/classes/Form/Input.class.php(127): sprintf('Nom de domaine ...', '<br />')
#1 /usr/local/www/services_dnsmasq_edit.php(85): Form_Input->setHelp('Domain of the h...', '<br />')
#2 {main}
thrown in /usr/local/www/classes/Form/Input.class.php on line 127
</pre>
<p>I think it come from a french translation file because when i use original language, everithing works.</p> pfSense - Bug #14734 (New): Alias FQDN resolving issue results in incomplete tableshttps://redmine.pfsense.org/issues/147342023-08-31T13:59:20ZRobert Gijsen
<p>In CE 2.7.0, there are still issues when FQDN are used in aliasses. Vonsider an alias with 3 entries, 2 static IP's and one FQDN, pointing to one of those IP's as well. When the FQDN changes to the other IP, the IP it had initially is gone from the table.</p>
<p>Steps to reproduce:</p>
Create an alias
<ul>
<li>add 1.1.1.1</li>
<li>add 8.8.8.8</li>
<li>add a (public) dns entry you created, pointing to 1.1.1.1, ie pfsensetest.domain.com</li>
<li>monitor the table-entry for the alias, all will be ok</li>
<li>now change the DNS entry for pfsensetest.domain.com from 1.1.1.1 to 8.8.8.8 and wait for it to be replicated and pfSense to pick it up</li>
<li>in my setups, 1.1.1.1 got deleted from the table. So while 8.8.8.8 is in there 'twice' now, and 1.1.1.1 only once statically, it's not there anymore</li>
<li>killing filterdns and reloading filters repopulates the tables correctly it seems.</li>
</ul>
<p>It looks like when the FQDN is resolved, it overrules the static entry if one with the same value exists, and when the FQDN changes, the static entry is not put back in to the table. I tailed resolver.log while reproducing the issue, but it made no notion at all of resolving the FQDN to another IP. So I don't know what log to add, or which log to enable verbose logging for.</p>
<p>I consider this high priority, as it has high potential of actually functionally breaking an environment.</p> pfSense Packages - Bug #13544 (New): SquidGuard either denying everything or proxying everythinghttps://redmine.pfsense.org/issues/135442022-10-05T01:40:03ZJimmy Michaelson
<p>Hey,</p>
<p>I truly doubt this is a configuration issue as I've tried all the possible combinations.</p>
<p>Relevant images and config:</p>
<p><a class="external" href="https://forum.netgate.com/topic/175057/10-btc-bounty-squid-proxy-whitelist-per-source-ip/6">https://forum.netgate.com/topic/175057/10-btc-bounty-squid-proxy-whitelist-per-source-ip/6</a></p>
<p>FYI: The bounty has been bumped to $20 and is also valid here.</p> pfSense - Bug #9295 (New): IPv6 PD does not work with PPPOE (Server & Client)https://redmine.pfsense.org/issues/92952019-01-29T11:51:01ZDirk Steingäßer
<p>Hi,</p>
<p>as encountering DHCPv6 with Prefix delegation does not work together with PPPOE Server vice versa it is not possible to get a prefix with an interface where the IPv4 Uplink is PPPOE.</p> pfSense - Bug #7730 (New): 2.3.4_1 greX: loop detected when hit save on filter rules or interfaceshttps://redmine.pfsense.org/issues/77302017-07-27T07:16:59ZRichie M
<p>upgraded from 2.2.6<br />anytime we hit save in the GUI for interface or filter rules, even if no change was made, we start getting Jul 25 14:50:02 <histname> kernel: greX: loop detected spam in dmesg/system.log. Our GRE tunnel goes down.</p>
<p>Any cluster sync activity from the Primary to Secondary also causes this issue.</p>
<p>We have to do a save on the GRE interface in the web GUI (this downs/ups the interface) and the tunnel starts working again.</p>
<p><code><br />Jul 25 14:50:01 hostname kernel: gre0: loop detected<br />Jul 25 14:50:02 hostname kernel: gre1: loop detected<br />Jul 25 14:50:02 hostname kernel: gre0: loop detected<br />Jul 25 14:50:02 hostname kernel: gre1: loop detected<br />Jul 25 14:50:02 hostname kernel: gre0: loop detected<br />Jul 25 14:50:03 hostname kernel: gre1: loop detected<br />Jul 25 14:50:03 hostname kernel: gre0: loop detected<br />Jul 25 14:50:03 hostname kernel: gre1: loop detected<br /></code></p>
<p>Original Forum Thread: <a class="external" href="https://forum.pfsense.org/index.php?topic=134258.0">https://forum.pfsense.org/index.php?topic=134258.0</a></p>