Activity

30 days up to

User

Subprojects

Activity

From 02/11/2021 to 03/12/2021

03/12/2021

10:31 PM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: Sounds like this issue might be causing my problem but I can't tell 100% from the description.
One of our sites ha... Eduard Rozenberg
12:38 PM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: Updating subject for release notes.
Also made it more general since this can affect more than port forwards. Jim Pingle
10:50 AM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: Just to update. The nat rule on 2.4.5p1 for 1:1 Nat is... Greg Hulands
09:32 PM pfSense Packages Bug #11366 (New): Arpwatch Cron Notification every 15 minutes: Jim Pingle
07:55 PM pfSense Packages Bug #11366: Arpwatch Cron Notification every 15 minutes: Thanks, your fix seems to have done the job, I haven't received any useless emails so far.
Edward Thomas wrote:
... Abdul Khaliq
07:38 PM pfSense Packages Bug #11366: Arpwatch Cron Notification every 15 minutes: I found the bug in arpwatch.
The bug is in the file: /usr/local/arpwatch/sendmail_proxy.php
In the statement:
... Edward Thomas
03:19 PM Revision 591b3cba: Include wildcard setting in dyndns refresh: Every 25th day, my dyndns forcibly updates, and the wildcard entry is gone.
This should fix that, as far as I can te... Thomas Lovén
01:52 PM Bug #11667 (Closed): Automatic 25-day forced Dynamic DNS update removes wildcard domain: What I'm trying to do:
Use Dynamic DNS with a wildcard subdomain.
What I expect to happen:
DNS entry is refreshe... Thomas Lovén
12:57 PM Bug #11583: dashboard nginx 504 Gateway time-out error: Ultimately disabling bzip2 fixed the issue. Bzip2 is the new format in 2.5.0, prior versions were uncompressed. Adam Esslinger
12:53 PM Regression #11519: Incorrect DHCP failover IP address configured on peer after XMLRPC sync: Updating subject for release notes. Jim Pingle
12:52 PM Bug #11638: PHP error in logs from XMLRPC if no sections are selected to sync: Updating subject for release notes. Jim Pingle
12:49 PM pfSense Packages Bug #11465: Input validation does not prevent multiple conflicting WireGuard peers on a single tunnel from attempting to act as default route: Updating subject for release notes. Jim Pingle
12:45 PM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Updating subject for release notes. Jim Pingle
12:41 PM Bug #11600: WireGuard interfaces should have MSS clamping enabled by default: Updating subject for release notes. Jim Pingle
12:39 PM Bug #11464: Requests to ``ews.netgate.com`` do not honor proxy configuration: Updating subject for release notes. Jim Pingle
12:36 PM Regression #11565: Saved state timeout values not loaded into GUI fields on system_advanced_firewall.php: Updating subject for release notes. Jim Pingle
12:31 PM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Updating subject for release notes. Jim Pingle
12:29 PM Bug #11578: Error when removing automatic DNS server route: Updating subject for release notes. Jim Pingle
12:27 PM Regression #11594: IPv6 routes with a prefix length of 128 result in an invalid route table entry: Updating subject for release notes. Jim Pingle
12:25 PM Bug #11617: Unexpected Operator error on console at boot with ZFS and RAM Disks: Updating subject for release notes. Jim Pingle
11:25 AM Bug #11666 (New): GUI Firewall log search not parsing filter.log beyond hard coded limit: Currently the Safety belt limit is set to 10K for release v2.5
This is preventing the GUI search from parsing any lo... Nick Zee
11:07 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Updating subject for release notes. Jim Pingle
11:05 AM Feature #7077: Display negotiated data encryption algorithm in OpenVPN connection status: Updating subject for release notes. Jim Pingle
10:58 AM Bug #11104: OpenVPN does not start with several authentication sources selected: Updating subject for release notes. Jim Pingle
10:57 AM Bug #11382: OpenVPN client configuration page displays Shared Key option when set for SSL/TLS: Updating subject for release notes. Jim Pingle
10:56 AM Bug #11448: Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: Updating subject for release notes. Jim Pingle
10:54 AM Regression #11500: OpenVPN using the wrong OpenSSL command to list digest algorithms: Updating subject for release notes. Jim Pingle
10:51 AM Bug #11554: Selected Data Encryption Algorithms list items reset when an input validation error occurs: Updating subject for release notes. Jim Pingle
10:49 AM Bug #11559: OpenVPN does not start with a long list of Data Encryption Algorithms: Updating subject for release notes. Jim Pingle
10:48 AM Regression #11561: ACLs generated from RADIUS reply attributes do not parse ``{clientip}`` macro: Updating subject for release notes. Jim Pingle
10:48 AM Bug #11569: ACLs generated from RADIUS reply attributes have incorrect syntax: Updating subject for release notes. Jim Pingle
10:45 AM Bug #11476: Telegram and Pushover notification API calls do not respect proxy configuration: Updating subject for release notes. Jim Pingle
10:44 AM Bug #11639: Entries from rotated log files may be displayed out of order when log display includes contents from multiple files: Updating subject for release notes. Jim Pingle
10:41 AM Bug #11105: IPv6 RA RDNSS lifetime is too short, not compliant with RFC 8106: Updating subject for release notes. Jim Pingle
10:40 AM Regression #11442: Distinguished Name (FQDN) IPsec peer identifier type is not formatted properly in ``swanctl.conf`` secrets: Updating subject for release notes. Jim Pingle
10:36 AM Bug #11446: Mobile IPsec DNS server input validation does not reject unsupported IPv4-mapped IPv6 addresses: Updating subject for release notes. Jim Pingle
10:33 AM Bug #11474: Broken help link on IPsec Advanced Settings tab: Updating subject for release notes. Jim Pingle
10:33 AM Regression #11486: Connect and disconnect buttons on the IPsec status page do not work for all tunnels: Updating subject for release notes. Jim Pingle
10:32 AM Regression #11487: IPsec tunnels using expanded IKE connection numbers do not have proper child SA names in ``swanctl.conf``: Updating subject for release notes. Jim Pingle
10:31 AM Bug #11488: IPsec tunnel definitions have ``pools =`` entry in ``swanctl.conf`` with no value: Updating subject for release notes. Jim Pingle
10:30 AM Regression #11526: Mobile IPsec broken when using strict certificate revocation list checking: Updating subject for release notes. Jim Pingle
10:26 AM Regression #11555: IPsec peer ID of "Any" does not generate a proper remote definition or related secrets: Updating subject for release notes. Jim Pingle
10:21 AM Bug #11643: IPsec tunnel does not function when configured on a 6RD interface: Updating subject for release notes. Jim Pingle
10:20 AM pfSense Plus Feature #10804: Interface Status page information for switch uplinks may be replaced by switch port data when media state monitoring is set: Updating subject for release notes. Jim Pingle
10:19 AM Bug #11091: Interfaces set as disabled in the configuration have an UP status in the operating system at boot: Updating subject for release notes. Jim Pingle
09:23 AM Bug #11091 (Resolved): Interfaces set as disabled in the configuration have an UP status in the operating system at boot: Jim Pingle
10:18 AM Bug #11409: IPv4 MSS value is incorrectly applied to IPv6 packets: Updating subject for release notes. Jim Pingle
10:16 AM Bug #11602: Delayed packet transmission in cxgbe driver can lead to latency and reduced performance: Updating subject for release notes. Jim Pingle
10:14 AM Regression #11633: DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: Updating subject for release notes. Jim Pingle
10:12 AM Bug #11483: Installer does not add required module to loader.conf when using ZFS: Updating subject for release notes. Jim Pingle
10:00 AM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: Updating subject for release notes. Jim Pingle
09:57 AM Regression #11316: Unbound crashes with signal 11 when reloading: Updating subject for release notes.
If Unbound doesn't find/fix the issue in 1.13.1 soon we may consider rolling U... Jim Pingle
09:45 AM Bug #11403: DNS Resolver does not add a ``local-zone`` type for ``ip6.arpa`` domain override: Updating subject for release notes. Jim Pingle
09:42 AM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: Updating subject for release notes. Jim Pingle
09:41 AM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: Updating subject for release notes. Jim Pingle
09:40 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: Updating subject for release notes. Jim Pingle
09:38 AM Bug #11489: Invalid certificate data can cause a PHP error: Updating subject for release notes. Jim Pingle
09:36 AM pfSense Plus Regression #11504: CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: Updating subject for release notes. Jim Pingle
09:16 AM pfSense Plus Regression #11504 (Resolved): CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: Jim Pingle
09:35 AM Bug #11514: Renewing a self-signed CA or certificate does not update the serial number: Updating subject for release notes. Jim Pingle
07:59 AM Bug #11665 (Rejected): All interfaces going down / up on DHCP server change: I can't replicate this as stated, DHCP Server saving triggers a filter reload and restarts the DHCP daemon (and maybe... Jim Pingle
07:39 AM Bug #11665 (Rejected): All interfaces going down / up on DHCP server change: Changing anything related to DHCP server (including adding a static mapping) even on a different subnet is cycling al... Derek Wuelfrath
07:53 AM Bug #11663: XMLRPC does not sync MSS clamping value under IPsec Advanced Settings tab: Manuel M. wrote:
> So the only way is to set up this manually on both machines?
Correct
> Is there a overview ... Jim Pingle
07:41 AM Bug #11663: XMLRPC does not sync MSS clamping value under IPsec Advanced Settings tab: Jim Pingle wrote:
> That is specific to that option and not a general XMLRPC problem.
> The MSS options are @$confi... Manuel M.
07:37 AM Bug #11663: XMLRPC does not sync MSS clamping value under IPsec Advanced Settings tab: That is specific to that option and not a general XMLRPC problem.
The MSS options are @$config['system']['maxmss_e... Jim Pingle
05:28 AM Bug #11663 (Duplicate): XMLRPC does not sync MSS clamping value under IPsec Advanced Settings tab: High Availability Sync is not syncing all settings from for example the IPSec Configuration option.
Tested with t... Manuel M.
07:47 AM Bug #11661 (Not a Bug): OpenVPN L2 TAP tunnel mac routing table: That is up to OpenVPN to maintain/expire internally. I don't see any configuration options in the OpenVPN man page wh... Jim Pingle
01:46 AM Bug #11661 (Not a Bug): OpenVPN L2 TAP tunnel mac routing table: Scenario: OpenVPN: [sense1 client] -> [sense2 server] [sense2 client] -> [sense3 server]
- Servers and clients are... jo ko
07:28 AM Bug #11664 (Duplicate): Openvpn-Client (2.5) connected but not communicating with the remote network: Likely a duplicate of #11575
This site is not for support or diagnostic discussion.
For assistance in solving p... Jim Pingle
07:27 AM Bug #11664 (Duplicate): Openvpn-Client (2.5) connected but not communicating with the remote network: I have openvpn 2.5 clients that normally connect to the tunnel I created, however even with the green openvpn-gui con... Victor França Machado de Araújo
07:24 AM Regression #11524: Using SHA1 or SHA256 with AES-NI may fail if AES-NI attempts to accelerate hashing: There have been multiple additional confirmations of this from customers and forum users, and in each case thus far, ... Jim Pingle
01:52 AM Bug #11662 (Resolved): QinQ using OpenVPN ``ovpn`` interface as a parent is not configured at boot time: QinQ interfaces created on top of ovpns or ovpnc disappears after reboot.
(for example ovpns1.100.2000 or ovpnc2.100... jo ko

03/11/2021

08:20 PM Revision 8f5dbb0c: Show switch tagging ports on status_interfaces page. Implements #10804: (cherry picked from commit 4e5e99a61d422941e69b2caa11e948363409e48c) Viktor Gurov
08:18 PM Revision 77cc3108: DHCP6 interfaces bootup fix. Issue #11633: (cherry picked from commit 1a6189611f68eb6ed9a1aa803999de81287386af) Viktor Gurov
08:07 PM Revision c67222fc: OpenVPN auth sources strlen validation. Issue #11104: (cherry picked from commit 3006473268acfc7068ade04ad7e2befbd8af8f81) Viktor Gurov
08:07 PM Revision 035e7029: Do not clean dmesg.boot on Reset Log Files. Fixes #11428: (cherry picked from commit f3fd77ee3cbb6e547b6154d13eab5019f36025d6) Viktor Gurov
08:06 PM Revision 4e2d1ee8: WireGuard default route Allowed IPs validation. Issue #11465: (cherry picked from commit 29b2cdb4e1d0cd9c2be98819d0e07dbf5b696308) Viktor Gurov
08:04 PM Revision 6790dc8c: route_del() optimization. Issue #11475: (cherry picked from commit 07b780c84305142e2f3af8587b909bf004f11568) Viktor Gurov
08:04 PM Revision 7a42c5d0: route_get() optimization. Fixes #11475: (cherry picked from commit 7990de53bfc8267d1dd96636a175929a35cbe664) Viktor Gurov
08:03 PM Revision 8c0d54f3: Move interfaces_ipsec_vti_configure() to the end of interfaces_configure(). Issue #11537: (cherry picked from commit 9b39f8de4b2e7b3d9732080356382dce80a461fa) Viktor Gurov
08:03 PM Revision a85a5809: IPsec VTI interfaces bootup fix. Issue #11537: (cherry picked from commit cfff0f351c74599d61286ce0161e570e587e5aac) Viktor Gurov
08:02 PM Revision cabb3465: Fix removing automatic DNS server route. Issue #11578: (cherry picked from commit 11338b8701bf6185ba34c1a387b1e1318afe19e0) Viktor Gurov
08:01 PM Revision ce5c4d24: Static IPv6 /128 routes fix. Issue #11594: (cherry picked from commit d9818e01479718efa5e02d8b0d32a87cfcaabf5a) Viktor Gurov
08:01 PM Revision 0f432ac4: WireGuard default TCP MSS clampling. Issue #11600: (cherry picked from commit 6efc02a141106b0274e7e27320d5f0abc111378a) Viktor Gurov
08:00 PM Revision fad7873b: Unmount var and tmp ZFS on boot. Fixes #11617: (cherry picked from commit edff0a3cf010e5c251c4b1c8930b2d302de5a36f) Viktor Gurov
08:00 PM Revision b4843c48: XMLRPC no section fix. Issue #11638: (cherry picked from commit a35da2ea9157d1a032521a22e0b3eaeda1b35c32) Viktor Gurov
07:59 PM Revision 55965086: Correct source IP for IPsec on 6RD/6to4 interfaces. Fixes #11643: (cherry picked from commit f6f121a28b4be1457535a5120e978544e55330c3) Viktor Gurov
07:59 PM Revision d834e893: IPsec IKEv1 mixed Phase 2 IP protocols support. Issue #11643: (cherry picked from commit 81949bee72813bbd8b57b75563cd40b9cdaf68e0) Viktor Gurov
06:48 PM Bug #11091: Interfaces set as disabled in the configuration have an UP status in the operating system at boot: After reboot the interface is not UP in ipconfig
[2.5.1-RC][admin@pfSense.home.arpa]/root: ifconfig em2
em... Alhusein Zawi
05:59 PM Bug #11407 (Resolved): Removing a WireGuard tunnel in a middle position can break Add button behavior: fixed.
Adding/removing WireGuard tunnels have been done without any issue.
2.5.1-RC (amd64)
built on Thu Mar 1... Alhusein Zawi
03:30 PM Regression #11555: IPsec peer ID of "Any" does not generate a proper remote definition or related secrets: To reproduce the problem, restore the attached IPsec config section to a system without IPsec. Edit/save/apply on the... Jim Pingle
03:25 PM Regression #11442: Distinguished Name (FQDN) IPsec peer identifier type is not formatted properly in ``swanctl.conf`` secrets: To reproduce the problem, restore the attached IPsec config section to a system without IPsec. Edit/save/apply on the... Jim Pingle
03:19 PM Bug #11488: IPsec tunnel definitions have ``pools =`` entry in ``swanctl.conf`` with no value: To reproduce the problem, restore the "IPsec config section":https://redmine.pfsense.org/attachments/3503/ipsec-confi... Jim Pingle
03:17 PM Regression #11486: Connect and disconnect buttons on the IPsec status page do not work for all tunnels: To reproduce the problem, restore the "IPsec config section":https://redmine.pfsense.org/attachments/3503/ipsec-confi... Jim Pingle
03:15 PM Regression #11435: IPsec status incorrect for entries using expanded IKE connection numbers: To reproduce the problem, restore the "IPsec config section":https://redmine.pfsense.org/attachments/3503/ipsec-confi... Jim Pingle
03:09 PM Regression #11487: IPsec tunnels using expanded IKE connection numbers do not have proper child SA names in ``swanctl.conf``: To reproduce the problem, restore the attached IPsec config section to a system without IPsec. Edit/save/apply on the... Jim Pingle
02:32 PM pfSense Plus Bug #11630: WireGuard MultiWAN Not Failing Back to Tier 1: Christian,
Nope! I explored that line of thought as well. I did have it set up at one point, but then I removed i... James Blanton
07:57 AM pfSense Plus Bug #11630: WireGuard MultiWAN Not Failing Back to Tier 1: If anybody from Netgate would like to jump into a Zoom meeting so that they can observe this edge case, just reach ou... Christian McDonald
07:38 AM pfSense Plus Bug #11630: WireGuard MultiWAN Not Failing Back to Tier 1: Christian,
What I've found is that unless you do something to interfere with WireGuard, such as disabling and re-e... James Blanton
07:23 AM pfSense Plus Bug #11630: WireGuard MultiWAN Not Failing Back to Tier 1: I'm seeing this on 2.5.0 as well. I have a failover group set as default gateway IPv4. WAN1 dropped out and WG starte... Christian McDonald
02:20 PM pfSense Plus Feature #10804 (Feedback): Interface Status page information for switch uplinks may be replaced by switch port data when media state monitoring is set: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:18 PM Regression #11633: DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:00 PM Regression #11633: DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:07 PM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:07 PM Bug #11104: OpenVPN does not start with several authentication sources selected: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:06 PM pfSense Packages Bug #11465: Input validation does not prevent multiple conflicting WireGuard peers on a single tunnel from attempting to act as default route: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:05 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Likely related #11605 and #11551 Marcos M
01:26 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Updating bug report to focus on PHP issue, given that the snort sig 10 issue is unlikely related, and this seems to a... Marcos M
02:04 PM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:03 PM Regression #11537: IPsec VTI tunnel between IPv6 peers may not configure correctly: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:02 PM Bug #11578: Error when removing automatic DNS server route: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:02 PM Regression #11594: IPv6 routes with a prefix length of 128 result in an invalid route table entry: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:01 PM Revision 41e0d95f: Refine help/error text for system domain. Fixes #11658: Jim Pingle
02:01 PM Bug #11600: WireGuard interfaces should have MSS clamping enabled by default: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:01 PM Bug #11617: Unexpected Operator error on console at boot with ZFS and RAM Disks: Cherry-picked to RELENG_2_5_1 Renato Botelho
02:00 PM Bug #11638: PHP error in logs from XMLRPC if no sections are selected to sync: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:59 PM Bug #11643: IPsec tunnel does not function when configured on a 6RD interface: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:58 PM pfSense Packages Bug #11605: Suricata can trigger PHP crash on SG-3100: Tested on [21.02.2 built on Thu Mar 11 09:10:56 EST 2021] with Suriata 4.1.9_5 on a fresh install.
# Enable ETOpen r... Marcos M
01:49 PM Bug #7721: NTPd stops using external peers if listening on one interface only in a muliwan setup: I've got this exact issue on 20.02-p1.
NTP is stuck in INIT if one or more interfaces are selected, in a dual wan en... Andrew Stuart
01:35 PM Regression #11568 (Resolved): Alias name change is not reflected in firewall rules: new alias name appears after changing the name.
targets are displayed
tested on IP & IP aliases.
2.5.1-RC ... Alhusein Zawi
01:12 PM pfSense Plus Regression #11504: CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: Confirmed working on 21.02.2 Marcos M
10:40 AM pfSense Plus Regression #11504: CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: Tested on 21.02p1 and it showed as invalid. After updating to latest dev build image (Mar 10), the cert no longer sho... Marcos M
10:55 AM Bug #11448: Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: This can be prevented by implementing https://redmine.pfsense.org/issues/10347 Pippin MMD
09:45 AM pfSense Packages Bug #10983: pfBlockerNG not cleaning everything behind it: Just stumbled upon this error message from dhcpd, took a while to figure out I had a virtual IP set on that IP that I... Bug Reporter
08:10 AM Bug #11658 (Feedback): Ambiguous text in help and input validation error for system domain name: Applied in changeset commit:41e0d95f274acbfe20064adfa224b8a1df334b4c. Jim Pingle
07:44 AM Feature #11660 (Rejected): no routing group in DNS Server Settings: The gateway option is on the page but only appears when the system has more than one available gateway of either IPv4... Jim Pingle
02:17 AM pfSense Packages Regression #11634: bind hangs when pfsense is reconnecting as an openvpn client to a TUN openvpn server: The problem seems worse than I thought : as soon as you restart an openvpn service, even as a server, or as soon as a... Stéphane BARBARAY

03/10/2021

08:15 PM Revision 81949bee: IPsec IKEv1 mixed Phase 2 IP protocols support. Issue #11643: Viktor Gurov
08:14 PM Revision 29b2cdb4: WireGuard default route Allowed IPs validation. Issue #11465: Viktor Gurov
07:18 PM Feature #11660 (Rejected): no routing group in DNS Server Settings: As of today, there isn't a way to choose a Gateway Group in DNS settings under General Setup, when you have a multiWA... Kristian Krautwald
07:15 PM Revision d7247886: Display negotiated cipher on Status / OpenVPN page. Implements #7077: (cherry picked from commit f5736d9827cf1997b648481c50993d69e3caedff) Viktor Gurov
07:14 PM Revision b0f77980: Down disabled interfaces on boot. Fixes #11091: (cherry picked from commit 9115501d6ab5197d9caf499e90779c020d711dca) Viktor Gurov
07:14 PM Revision e97c1e4a: RADVD set AdvRDNSSLifetime. Fixes #11105: (cherry picked from commit 54b3109f0b1978e22866117b6d93715eb8d78c29) Viktor Gurov
07:14 PM Revision 2c4ce8b1: Hide Shared Key field on OpenVPN client page in SSL/TLS mode. Fixes #11382: (cherry picked from commit f22b21557e6a745dbb447ea488b97424e595efd7) Viktor Gurov
07:13 PM Revision a16b4d53: Unbound ip6.arpa local-zone type. Fixes #11403: (cherry picked from commit 8673ae11ac96fbd2934133268d56829d6225b1c5) Viktor Gurov
07:13 PM Revision d49dd060: Set correct TCP MSS for IPv6. Fixes #11409: (cherry picked from commit 1d378c4ec6c440dabffba41bf5e4ef291acb9aa2) Viktor Gurov
07:12 PM Revision 36ef00b5: WireGuard interface friendly description. Fixes #11437: (cherry picked from commit 4fef1c109de562f9f97d7c04d4cf8f0f041811e0) Viktor Gurov
07:12 PM Revision 9d9cd873: System Information widget fix. Issue #11443: (cherry picked from commit 19866d78540d498f23b750ab02379b3c06333d96) Viktor Gurov
07:11 PM Revision b19bb324: IPsec Mobile EAP-RADIUS additional configuration fix. Issue #11447: (cherry picked from commit c03a2049b11304f592d0de78aa4bfb568e9a13ae) Viktor Gurov
07:10 PM Revision 97af9f20: Put OpenVPN route-nopull option after custom options. Fixes #11448: (cherry picked from commit 969574b6dbb124e98595ca537c0d176d908707d0) Viktor Gurov
07:09 PM Revision 523f931b: Use set_curlproxy() function for cURL proxy configuration. Issue #11476: (cherry picked from commit 8b424bca02372246210fba3cf36045a704c11ae3) Viktor Gurov
07:09 PM Revision 1fa63e8d: Fixed #11464 by adding proxy configuration to web service calls: (cherry picked from commit 2cb3c56db2366c9cadb04757bd3143ea0d7e7378) Steve Beaver
07:06 PM Revision b656061a: Fix openssl digest algorithm param in openvpn.inc: At least in OpenSSL 1.1.1i-freebsd, used by pfsense 2.5, there is no longer a "list-message-digest-algorithms" parame... mschiegl
07:06 PM Revision 82690894: Set correct DHCP failover peer IP on XMLRPC sync. Fixes #11519: (cherry picked from commit 490b5b480f1b46a6f93e0ba99fff578a61f3293c) Viktor Gurov
07:05 PM Revision 85799d56: Restart unbound on interface recover. Fixes #11547: (cherry picked from commit a1fe814421904ca00b6a04431d62ba18dcebf607) Viktor Gurov
07:04 PM Revision c68bc678: OpenVPN ncp_enable checkbox fix. Issue #11554: (cherry picked from commit f725132eac3d6dbada8b7bc48effdf768fccb341) Viktor Gurov
07:04 PM Revision f1864df6: IPsec peer ID Any fix. Issue #11555: (cherry picked from commit 4a51b9cd8fd58b26c5c30784b0736cc5757e86fc) Viktor Gurov
07:02 PM Revision 5b638980: OpenVPN data-ciphers option length validation. Issue #11559: (cherry picked from commit 44baf5a77b618f2c67587029c87b03887e2f35e9) Viktor Gurov
07:02 PM Revision 6cba83ab: Cisco AVPair parse {clientip}. Fixes #11561: (cherry picked from commit f4d883dadee6e339997b29f5b4623a88b190b840) Viktor Gurov
07:01 PM Revision 0b1fe66b: Show changed NAT timeouts on the system_advanced_firewall page. Issue #11565: (cherry picked from commit 95e599a115669cf336971bbf3720f4843d52107a) Viktor Gurov
07:01 PM Revision 3dc01871: Fixed bug parsing netmask cisco acl: (cherry picked from commit 321fbbdb5bffe5d331aea5330241d42b0ab8d250) Dmitry Bashkarev
07:00 PM Revision d76f5796: Use correct parameters when adding WG IPv6 tunnel addr. Fixes #11618: (cherry picked from commit 8579d26bfb0dea0386c61008ade222c0ea29aa98) Jim Pingle
06:59 PM Revision 15f2424f: Typo fix. Issue #11624: (cherry picked from commit 779daee9695bb5a2b3cde262da4619c29a8473a2) Danilo Zrenjanin
06:58 PM Revision 6140f34e: Correct rsort_log_filename() behavior. Fixes #11639: (cherry picked from commit b9c1679dae94fb2d406cfc386f667eed2378b6d2) Jim Pingle
06:57 PM Revision 644a5333: Fix handling of renewing cert w/o SAN. Fixes #11652: (cherry picked from commit 09d3fe621a56292817a85a54916e8b99e2b26c00) Jim Pingle
06:56 PM Revision ac135c6a: Reverse x509 escape cert subjects on renewal page. Fixes #11654: (cherry picked from commit a473d89738b03bf336d4d2591821062759b30dbe) Jim Pingle
06:16 PM Feature #11659 (Closed): Support for UEFI HTTP Boot option in DHCPv4 Server: PXE had an epic run, but it's deprecation has been planned by major silicon vendors and UEFI HTTPS boot is the replac... Ben Breard
06:15 PM Revision 30064732: OpenVPN auth sources strlen validation. Issue #11104: Viktor Gurov
06:13 PM Revision f3fd77ee: Do not clean dmesg.boot on Reset Log Files. Fixes #11428: Viktor Gurov
06:11 PM Revision 07b780c8: route_del() optimization. Issue #11475: Viktor Gurov
06:08 PM Revision 9b39f8de: Move interfaces_ipsec_vti_configure() to the end of interfaces_configure(). Issue #11537: Viktor Gurov
06:07 PM Revision 11338b87: Fix removing automatic DNS server route. Issue #11578: Viktor Gurov
06:05 PM Revision d9818e01: Static IPv6 /128 routes fix. Issue #11594: Viktor Gurov
06:04 PM Revision 6efc02a1: WireGuard default TCP MSS clampling. Issue #11600: Viktor Gurov
06:03 PM Revision edff0a3c: Unmount var and tmp ZFS on boot. Fixes #11617: Viktor Gurov
06:01 PM Revision 1a618961: DHCP6 interfaces bootup fix. Issue #11633: Viktor Gurov
05:58 PM Revision a35da2ea: XMLRPC no section fix. Issue #11638: Viktor Gurov
05:56 PM Revision f6f121a2: Correct source IP for IPsec on 6RD/6to4 interfaces. Fixes #11643: Viktor Gurov
05:20 PM Bug #11658 (Resolved): Ambiguous text in help and input validation error for system domain name: I'm really sorry if this is the wrong place to put this.
Setting up my first pfsense netgate box and going through... andy suarez
05:05 PM Revision a473d897: Reverse x509 escape cert subjects on renewal page. Fixes #11654: Jim Pingle
05:05 PM Revision 09d3fe62: Fix handling of renewing cert w/o SAN. Fixes #11652: Jim Pingle
04:30 PM Bug #11657 (New): netmap_ring_reinit error: These errors had appeared in the past and were solved. After upgrading to v2.5.0, they have reappeared. I receive... P L
03:48 PM Regression #11447: EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes: To test:
* Setup mobile IPsec using IKEv2 and EAP-RADIUS against a RADIUS server
* Leave the Virtual Address Pool... Jim Pingle
01:11 PM Regression #11447 (Feedback): EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes: Cherry-picked to RELENG_2_5_1 Renato Botelho
03:12 PM Revision 8579d26b: Use correct parameters when adding WG IPv6 tunnel addr. Fixes #11618: Jim Pingle
03:05 PM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: To test:
On a system without the fix:
* Check System Information Widget on the Dashboard for "AES-NI CPU Crypto... Jim Pingle
12:20 PM Bug #11428 (Feedback): CPU details are incorrect in the System Information widget after resetting log files: Applied in changeset commit:f3fd77ee3cbb6e547b6154d13eab5019f36025d6. Viktor Gurov
12:14 PM Bug #11428 (Waiting on Merge): CPU details are incorrect in the System Information widget after resetting log files: PR has been merged. Thanks! Renato Botelho
02:50 PM Bug #11514: Renewing a self-signed CA or certificate does not update the serial number: To test, on 2.5.0 or 21.02-p1:
* Generate a fresh self-signed GUI cert at an SSH or console shell prompt: @pfSsh.p... Jim Pingle
12:49 PM Bug #11514 (Feedback): Renewing a self-signed CA or certificate does not update the serial number: Needed to be tested on 2.5.1-RC Renato Botelho
02:37 PM pfSense Plus Regression #11504: CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: Needs re-tested on snapshots.
If needed, I have a user-supplied certificate which can replicate the problem and ca... Jim Pingle
02:31 PM Regression #11568 (Feedback): Alias name change is not reflected in firewall rules: Needs re-tested on snapshots. Jim Pingle
02:29 PM Bug #11489 (Feedback): Invalid certificate data can cause a PHP error: Needs testing on snapshots.
To test, add an obviously broken/unparseable cert to the config:... Jim Pingle
02:22 PM Bug #11474 (Feedback): Broken help link on IPsec Advanced Settings tab: Needs tested again on snapshots.
Simple to test, load vpn_ipsec_settings.php click the ? icon in the breadcrumb ba... Jim Pingle
02:21 PM Revision 004cd054: Make repository description more generic: Renato Botelho
02:15 PM Bug #11651 (Feedback): Error when adding both IPv4 and IPv6 P2 under an IPv4 or IPv6 only IKEv1 P1: PR has been merged. Thanks! Renato Botelho
08:49 AM Bug #11651: Error when adding both IPv4 and IPv6 P2 under an IPv4 or IPv6 only IKEv1 P1: After the PR is merged this whole docs page can go away: https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/ipv6.ht... Jim Pingle
08:47 AM Bug #11651 (Pull Request Review): Error when adding both IPv4 and IPv6 P2 under an IPv4 or IPv6 only IKEv1 P1: Jim Pingle
08:42 AM Bug #11651: Error when adding both IPv4 and IPv6 P2 under an IPv4 or IPv6 only IKEv1 P1: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/182 Viktor Gurov
08:41 AM Bug #11651 (Closed): Error when adding both IPv4 and IPv6 P2 under an IPv4 or IPv6 only IKEv1 P1: GUI complains when adding both IPv4 and IPv6 P2 under a IPv4 or IPv6 only IKEv1 P1 (There is a Phase 2 using IPv6, ca... Viktor Gurov
02:14 PM pfSense Packages Bug #11465 (Feedback): Input validation does not prevent multiple conflicting WireGuard peers on a single tunnel from attempting to act as default route: PR has been merged. Thanks! Renato Botelho
12:59 PM pfSense Packages Bug #11465: Input validation does not prevent multiple conflicting WireGuard peers on a single tunnel from attempting to act as default route: When testing, attempt these configurations in order without removing anything unless noted otherwise:
* Create a t... Jim Pingle
01:41 PM Revision 62a1cbc3: Keep using FreeBSD-src branch RELENG_2_5_0: Renato Botelho
01:22 PM Bug #11602 (Feedback): Delayed packet transmission in cxgbe driver can lead to latency and reduced performance: Fixes cherry-picked to 2.5.1 / 21.02.2 repositories Renato Botelho
01:16 PM Revision 73a1434a: Welcome pfSense CE 2.5.1-RELEASE: Renato Botelho
01:15 PM Feature #7077 (Feedback): Display negotiated data encryption algorithm in OpenVPN connection status: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:15 PM Bug #11091 (Feedback): Interfaces set as disabled in the configuration have an UP status in the operating system at boot: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:14 PM Bug #11105 (Feedback): IPv6 RA RDNSS lifetime is too short, not compliant with RFC 8106: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:14 PM Bug #11382 (Feedback): OpenVPN client configuration page displays Shared Key option when set for SSL/TLS: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:13 PM Bug #11403 (Feedback): DNS Resolver does not add a ``local-zone`` type for ``ip6.arpa`` domain override: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:13 PM Bug #11409 (Feedback): IPv4 MSS value is incorrectly applied to IPv6 packets: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:12 PM Bug #11437 (Feedback): WireGuard group is not printed in the interface column of the NAT rule list: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:12 PM Regression #11443 (Feedback): Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:11 PM Bug #11448 (Feedback): Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:10 PM Bug #11464 (Feedback): Requests to ``ews.netgate.com`` do not honor proxy configuration: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:10 PM Bug #11476 (Feedback): Telegram and Pushover notification API calls do not respect proxy configuration: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:08 PM Bug #11483 (Feedback): Installer does not add required module to loader.conf when using ZFS: Cherry-picked to FreeBSD-src RELENG_2_5_0 Renato Botelho
01:06 PM Regression #11500 (Feedback): OpenVPN using the wrong OpenSSL command to list digest algorithms: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:06 PM Regression #11519 (Feedback): Incorrect DHCP failover IP address configured on peer after XMLRPC sync: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:05 PM Bug #11547 (Feedback): DNS Resolver does not bind to an interface when it recovers from a down state: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:04 PM Bug #11554 (Feedback): Selected Data Encryption Algorithms list items reset when an input validation error occurs: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:04 PM Regression #11555 (Feedback): IPsec peer ID of "Any" does not generate a proper remote definition or related secrets: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:03 PM Bug #11559 (Feedback): OpenVPN does not start with a long list of Data Encryption Algorithms: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:02 PM Regression #11561 (Feedback): ACLs generated from RADIUS reply attributes do not parse ``{clientip}`` macro: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:01 PM Regression #11565 (Feedback): Saved state timeout values not loaded into GUI fields on system_advanced_firewall.php: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:01 PM Bug #11569 (Feedback): ACLs generated from RADIUS reply attributes have incorrect syntax: Cherry-picked to RELENG_2_5_1 Renato Botelho
01:00 PM pfSense Packages Bug #11618 (Feedback): WireGuard using incorrect IPv6 tunnel address prefix length: Cherry-picked to RELENG_2_5_1 Renato Botelho
09:21 AM pfSense Packages Bug #11618 (Waiting on Merge): WireGuard using incorrect IPv6 tunnel address prefix length: Jim Pingle
09:20 AM pfSense Packages Bug #11618 (Feedback): WireGuard using incorrect IPv6 tunnel address prefix length: Applied in changeset commit:8579d26bfb0dea0386c61008ade222c0ea29aa98. Jim Pingle
09:16 AM pfSense Packages Bug #11618: WireGuard using incorrect IPv6 tunnel address prefix length: That's easy enough to reproduce and check:
* Set WG instance tunnel address to include @2001:db8:1:ee71::1/64@ and... Jim Pingle
12:59 PM Bug #11624 (Feedback): Typo on Router Advertisements page: Cherry-picked to RELENG_2_5_1 Renato Botelho
12:58 PM Bug #11639 (Feedback): Entries from rotated log files may be displayed out of order when log display includes contents from multiple files: Cherry-picked to RELENG_2_5_1 Renato Botelho
12:57 PM Bug #11652 (Feedback): Unable to renew a certificate without a SAN: Cherry-picked to RELENG_2_5_1 Renato Botelho
11:18 AM Bug #11652 (Waiting on Merge): Unable to renew a certificate without a SAN: Small fix and very likely to be hit in the wild (See https://forum.netgate.com/post/971557 for one example), so good ... Jim Pingle
11:15 AM Bug #11652 (Feedback): Unable to renew a certificate without a SAN: Applied in changeset commit:09d3fe621a56292817a85a54916e8b99e2b26c00. Jim Pingle
11:00 AM Bug #11652: Unable to renew a certificate without a SAN: Narrowed it down further. The real problem is that a certificate without a SAN cannot be renewed.
Certificates wit... Jim Pingle
10:51 AM Bug #11652: Unable to renew a certificate without a SAN: This isn't exclusive to space, it also affects other characters which must be escaped for x509 such as "+". Jim Pingle
09:41 AM Bug #11652 (Resolved): Unable to renew a certificate without a SAN: If a certificate entry has a CN which contains a space, attempting to renew the certificate will result in an error:
... Jim Pingle
12:57 PM Bug #11654 (Feedback): Certificates with escaped x509 characters display the escaped version when renewing: Cherry-picked to RELENG_2_5_1 Renato Botelho
11:19 AM Bug #11654 (Waiting on Merge): Certificates with escaped x509 characters display the escaped version when renewing: Cosmetic only, safe, and easily tested/verified.
Jim Pingle
11:15 AM Bug #11654 (Feedback): Certificates with escaped x509 characters display the escaped version when renewing: Applied in changeset commit:a473d89738b03bf336d4d2591821062759b30dbe. Jim Pingle
11:04 AM Bug #11654 (Resolved): Certificates with escaped x509 characters display the escaped version when renewing: The certificate renewal page is displaying the x509 escaped version of certificate values when it should be removing ... Jim Pingle
12:30 PM Bug #11638 (Feedback): PHP error in logs from XMLRPC if no sections are selected to sync: Renato Botelho
12:00 PM Bug #11638 (Waiting on Merge): PHP error in logs from XMLRPC if no sections are selected to sync: PR has been merged. Thanks! Renato Botelho
12:30 PM Regression #11633 (Feedback): DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: Renato Botelho
12:01 PM Regression #11633 (Waiting on Merge): DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: PR has been merged. Thanks! Renato Botelho
12:29 PM Bug #11600 (Feedback): WireGuard interfaces should have MSS clamping enabled by default: Renato Botelho
12:05 PM Bug #11600 (Waiting on Merge): WireGuard interfaces should have MSS clamping enabled by default: PR has been merged. Thanks! Renato Botelho
12:29 PM Regression #11594 (Feedback): IPv6 routes with a prefix length of 128 result in an invalid route table entry: Renato Botelho
12:06 PM Regression #11594 (Waiting on Merge): IPv6 routes with a prefix length of 128 result in an invalid route table entry: PR has been merged. Thanks! Renato Botelho
12:29 PM Bug #11578 (Feedback): Error when removing automatic DNS server route: Renato Botelho
12:07 PM Bug #11578 (Waiting on Merge): Error when removing automatic DNS server route: PR has been merged. Thanks! Renato Botelho
12:29 PM Regression #11537 (Feedback): IPsec VTI tunnel between IPv6 peers may not configure correctly: Renato Botelho
12:09 PM Regression #11537 (Waiting on Merge): IPsec VTI tunnel between IPv6 peers may not configure correctly: PR has been merged. Thanks! Renato Botelho
12:29 PM Regression #11475 (Feedback): Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Renato Botelho
12:11 PM Regression #11475 (Waiting on Merge): Route tables with many entries can lead to PHP errors and timeouts when looking up routes: PR has been merged. Thanks! Renato Botelho
12:28 PM Bug #11104 (Feedback): OpenVPN does not start with several authentication sources selected: Renato Botelho
12:16 PM Bug #11104 (Waiting on Merge): OpenVPN does not start with several authentication sources selected: PR has been merged. Thanks! Renato Botelho
12:10 PM Bug #11617 (Feedback): Unexpected Operator error on console at boot with ZFS and RAM Disks: Applied in changeset commit:edff0a3cf010e5c251c4b1c8930b2d302de5a36f. Viktor Gurov
12:03 PM Bug #11617 (Waiting on Merge): Unexpected Operator error on console at boot with ZFS and RAM Disks: PR has been merged. Thanks! Renato Botelho
11:24 AM Bug #11617 (Pull Request Review): Unexpected Operator error on console at boot with ZFS and RAM Disks: Jim Pingle
10:21 AM Bug #11617: Unexpected Operator error on console at boot with ZFS and RAM Disks: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/183 Viktor Gurov
12:05 PM Bug #11643 (Feedback): IPsec tunnel does not function when configured on a 6RD interface: Applied in changeset commit:f6f121a28b4be1457535a5120e978544e55330c3. Viktor Gurov
11:57 AM Bug #11643 (Waiting on Merge): IPsec tunnel does not function when configured on a 6RD interface: PR 181 was merged. Thanks!
Please open a separate redmine ticket to cover proposed changes on PR 182 Renato Botelho
08:46 AM Bug #11643: IPsec tunnel does not function when configured on a 6RD interface: That is our private/internal git, so it's expected. Jim Pingle
08:12 AM Bug #11643: IPsec tunnel does not function when configured on a 6RD interface: Viktor Gurov wrote:
> https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/182
gitlab.netgate.com resolves... Sietse van Zanen
07:58 AM Bug #11643 (Pull Request Review): IPsec tunnel does not function when configured on a 6RD interface: The first PR for the main issue is OK, the other part about mixing IPv4/IPv6 on IKEv1 needs its own separate Redmine ... Jim Pingle
04:57 AM Bug #11643: IPsec tunnel does not function when configured on a 6RD interface: Sietse van Zanen wrote:
> Another minor issue is that the GUI complains when adding both IPv4 and IPv6 P2 under a IP... Viktor Gurov
04:09 AM Bug #11643: IPsec tunnel does not function when configured on a 6RD interface: Sietse van Zanen wrote:
> pfSense does not generate a correct swanctl.conf when adding IPv6 or dual stack tunnels ov... Viktor Gurov
02:53 AM Bug #11643 (Closed): IPsec tunnel does not function when configured on a 6RD interface: pfSense does not generate a correct swanctl.conf when adding IPv6 or dual stack tunnels over a 6RD interface. The IPv... Sietse van Zanen
11:33 AM pfSense Docs Todo #11655: Feedback on Packages: s/stiff/still/ ahem. Chris Linstruth
11:33 AM pfSense Docs Todo #11655 (Closed): Feedback on Packages: *Page:* https://docs.netgate.com/pfsense/en/latest/packages/index.html
*Feedback:*
Receiving negative forum fee... Chris Linstruth
11:08 AM Bug #11653: Duplicate ``comconsole_port`` lines in ``/boot/loader.conf``: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/184 Viktor Gurov
10:51 AM Bug #11653 (Resolved): Duplicate ``comconsole_port`` lines in ``/boot/loader.conf``: In my loader.conf file there are several identical lines with
comconsole_port ="0x2F8"
and after each reboot a... Guido Glaus
09:11 AM pfSense Packages Bug #11640: Ntopng configuration and data loss when shutting down Redis: Jim Pingle wrote:
> There is also https://github.com/pfsense/FreeBSD-ports/pull/1053 for this -- not sure which way ... Viktor Gurov
08:14 AM pfSense Packages Bug #11640: Ntopng configuration and data loss when shutting down Redis: There is also https://github.com/pfsense/FreeBSD-ports/pull/1053 for this -- not sure which way is better in the end. Jim Pingle
07:28 AM pfSense Packages Bug #11640 (Pull Request Review): Ntopng configuration and data loss when shutting down Redis: Jim Pingle
06:10 AM pfSense Packages Bug #11640: Ntopng configuration and data loss when shutting down Redis: fix:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/70 Viktor Gurov
09:01 AM Bug #11642: IPSEC mode-cfg exchange refused because of invalid INTERNAL_IP4_NETMASK: Jim Pingle wrote:
> Yeah that seems like the same thing to me. Though it's redundant to send clients a network list ... Sietse van Zanen
07:47 AM Bug #11642 (Duplicate): IPSEC mode-cfg exchange refused because of invalid INTERNAL_IP4_NETMASK: Yeah that seems like the same thing to me. Though it's redundant to send clients a network list if that network list ... Jim Pingle
05:02 AM Bug #11642: IPSEC mode-cfg exchange refused because of invalid INTERNAL_IP4_NETMASK: #11539 seems related Viktor Gurov
02:41 AM Bug #11642 (Duplicate): IPSEC mode-cfg exchange refused because of invalid INTERNAL_IP4_NETMASK: Some clients, Forticlient is one, will reject the mode-cfg exchange as offered by pfSense.
This is because there is ... Sietse van Zanen
08:50 AM pfSense Packages Bug #11650: FRR configuration broken on restore of manually edited FRR config sections: Jim Pingle wrote:
> Unless you can replicate this without any sections there at all (Remove them, don't leave them t... Andrew Green
08:19 AM pfSense Packages Bug #11650: FRR configuration broken on restore of manually edited FRR config sections: Unless you can replicate this without any sections there at all (Remove them, don't leave them there but empty), I'm ... Jim Pingle
06:51 AM pfSense Packages Bug #11650 (New): FRR configuration broken on restore of manually edited FRR config sections: SG-3100
21.02-RELEASE-p1 (arm)
built on Mon Feb 22 09:38:52 EST 2021
FRR package version 1.1.0_8
I could not... Andrew Green
08:24 AM Bug #11644: Unreachable LDAP server for SSH auth causes boot process to stop at 'Synchronizing user settings' and no user can login over SSH: Rare enough case, and not in our code, that it's going to be a more long-term correction, if there is anything we can... Jim Pingle
06:56 AM Bug #11644 (Confirmed): Unreachable LDAP server for SSH auth causes boot process to stop at 'Synchronizing user settings' and no user can login over SSH: auth.inc is ok,
issue in pam_ldap module
related to #8698 Viktor Gurov
03:18 AM Bug #11644 (Closed): Unreachable LDAP server for SSH auth causes boot process to stop at 'Synchronizing user settings' and no user can login over SSH: When the configured LDAP server is unreachable pfSense will get stuck on 'synchronizing user settings' indefinitely d... Sietse van Zanen
08:21 AM pfSense Packages Bug #11377: FRR deinstall: That would likely cause more harm in the long run, very few people would ever need to completely purge the configurat... Jim Pingle
06:54 AM pfSense Packages Bug #11377: FRR deinstall: Jim Pingle wrote:
> Removing the leftover files is fine but I don't think this package needs the ability to reset/wi... Andrew Green
08:12 AM pfSense Plus Bug #11626: Google LDAP connections fail due to lack of SNI for TLS 1.3: Not that I like the idea of downgrading to a lower TLS version but I wonder if it would work if we forced off TLS 1.3... Jim Pingle
05:45 AM pfSense Plus Bug #11626: Google LDAP connections fail due to lack of SNI for TLS 1.3: Using the STunnel package as a workaround helps:
https://docs.netgate.com/pfsense/en/latest/recipes/auth-google-gsui... Viktor Gurov
08:01 AM Regression #11316: Unbound crashes with signal 11 when reloading: Christian Borchert wrote:
> Here's the logs from a second signal 11 crash a few hours later
>
> @Mar 10 03:44:09 ... Jim Pingle
05:08 AM Regression #11316: Unbound crashes with signal 11 when reloading: Here's the logs from a second signal 11 crash a few hours later
@Mar 10 03:44:09 router kernel: pid 87756 (unbound... Christian Borchert
07:42 AM pfSense Packages Bug #11620 (Resolved): OSPF Route Redistribution shows numbers instead of route map names: Jim Pingle
01:41 AM pfSense Packages Bug #11620: OSPF Route Redistribution shows numbers instead of route map names: Tested on the latest release. It looks good now. Ticket resolved. Danilo Zrenjanin
07:26 AM Feature #2358: NAT64 support: Even that is unlikely, it's just an estimate -- it's a major change that needs significant review and testing, and ul... Jim Pingle
07:13 AM pfSense Packages Bug #11185 (Feedback): Redis service stopping before NtopNg: merged to 2.5/Plus branch:
https://github.com/pfsense/FreeBSD-ports/commit/892ed4669268ee7392eb3132a5c4179126e8f6dc#... Viktor Gurov
06:32 AM pfSense Docs Correction #11649 (Resolved): Feedback on System Monitoring — Routing Logs: *Page:* https://docs.netgate.com/pfsense/en/latest/monitoring/logs/routing.html
*Feedback:*
This log contains e... Viktor Gurov
06:30 AM pfSense Docs Todo #11648 (Closed): Feedback on Packages — AWS VPC Wizard — pfSense Plus Configuration Details: *Page:* https://docs.netgate.com/pfsense/en/latest/packages/aws-vpc-wizard/pfsense-configuration-details.html
*Fee... Viktor Gurov
06:28 AM pfSense Docs Correction #11647 (Closed): Feedback on Virtual Private Networks — IPsec — Routed IPsec (VTI): *Page:* https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/routed-vti.html
*Feedback:*
"The assigned IPsec in... Viktor Gurov
06:25 AM pfSense Docs Todo #11646 (Closed): Feedback on Virtual Private Networks — OpenVPN — OpenVPN and Multi-WAN: *Page:* https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/multi-wan.html
*Feedback:*
Replace Quagga with F... Viktor Gurov
06:24 AM pfSense Docs Todo #11645 (Closed): Feedback on pfSense Configuration Recipes — Dynamic Routing Protocol Basics: *Page:* https://docs.netgate.com/pfsense/en/latest/recipes/dynamic-routing-basics.html
*Feedback:*
- Quagga and... Viktor Gurov

03/09/2021

08:56 PM Regression #11316: Unbound crashes with signal 11 when reloading: here's a Level 5 log (attached and forum link) from a signal 11 crash on unbound (1.13.1):
https://forum.netgate.c... Christian Borchert
12:48 PM Regression #11316: Unbound crashes with signal 11 when reloading: Assuming this is the same segfault others are hitting with Unbound they are still investigating it upstream: https://... Jim Pingle
07:21 PM Revision b6aec58f: Report full product version, including -pN: (cherry picked from commit feefcc31b78c1ef99ffd9deb509b05ccdb1e61ef) Renato Botelho
07:03 PM Revision 0d8a9270: Do not build node_exporter on armv7 since lang/go14 is broken: Renato Botelho
06:42 PM Bug #11641 (New): On xn based interfaces without the VLANMTU flag the first VLAN tag defined does not follow the parent interface MTU settings. All subsequent VLAN tags follow the parent interface's MTU.: With the recent release of pfSense 2.5 and the removal of the VLANMTU flag requirement per [[https://redmine.pfsense.... Andre Baugh
06:40 PM Feature #2358: NAT64 support: 2.6 now? Wow.. Might as well officially at least make a TAYGA package.. Seems to work well enough, because this will ... Brandon Jackson
06:37 PM pfSense Packages Bug #11640 (Closed): Ntopng configuration and data loss when shutting down Redis: In addition to monitoring information, ntopng stores configuration/customization performed using the ntopng GUI in th... Denny Page
06:03 PM Revision feefcc31: Report full product version, including -pN: Renato Botelho
03:26 PM Revision 2428d0a9: Revise firewall_nat_edit for MVC: Steve Beaver
03:00 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Tested on:... Marcos M
12:28 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Has anyone tried this on a 21.05 snapshot with PHP 7.4.16? The release notes for PHP 7.4.16 mention they fixed a segf... Jim Pingle
02:56 PM Revision b9c1679d: Correct rsort_log_filename() behavior. Fixes #11639: Jim Pingle
01:50 PM Regression #11545: Primary interface address is not always used when VIPs are present: Should at least take a stab at this to see if we can come up with a workaround for now. Jim Pingle
01:49 PM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Would be nice to at least suppress this console message since it's not useful. Jim Pingle
01:48 PM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: gnn is taking a look at this to see if he can track it down. Jim Pingle
01:33 PM Bug #11624 (Waiting on Merge): Typo on Router Advertisements page: Jim Pingle
01:32 PM Bug #11569 (Waiting on Merge): ACLs generated from RADIUS reply attributes have incorrect syntax: Jim Pingle
01:32 PM Regression #11565 (Waiting on Merge): Saved state timeout values not loaded into GUI fields on system_advanced_firewall.php: Jim Pingle
01:30 PM Regression #11561 (Waiting on Merge): ACLs generated from RADIUS reply attributes do not parse ``{clientip}`` macro: Jim Pingle
01:30 PM Regression #11555 (Waiting on Merge): IPsec peer ID of "Any" does not generate a proper remote definition or related secrets: Jim Pingle
01:30 PM Bug #11547 (Waiting on Merge): DNS Resolver does not bind to an interface when it recovers from a down state: Jim Pingle
01:29 PM Regression #11519 (Waiting on Merge): Incorrect DHCP failover IP address configured on peer after XMLRPC sync: Jim Pingle
01:29 PM Regression #11500 (Waiting on Merge): OpenVPN using the wrong OpenSSL command to list digest algorithms: Jim Pingle
01:28 PM Bug #11483 (Waiting on Merge): Installer does not add required module to loader.conf when using ZFS: Jim Pingle
01:28 PM Bug #11476 (Waiting on Merge): Telegram and Pushover notification API calls do not respect proxy configuration: Jim Pingle
01:27 PM Bug #11464 (Waiting on Merge): Requests to ``ews.netgate.com`` do not honor proxy configuration: Jim Pingle
01:27 PM Bug #11448 (Waiting on Merge): Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: Jim Pingle
01:27 PM Regression #11447 (Waiting on Merge): EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes: Jim Pingle
01:27 PM Regression #11443 (Waiting on Merge): Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: Jim Pingle
01:26 PM Bug #11409 (Waiting on Merge): IPv4 MSS value is incorrectly applied to IPv6 packets: Jim Pingle
01:24 PM Bug #11403 (Waiting on Merge): DNS Resolver does not add a ``local-zone`` type for ``ip6.arpa`` domain override: Jim Pingle
01:19 PM Bug #11382 (Waiting on Merge): OpenVPN client configuration page displays Shared Key option when set for SSL/TLS: Jim Pingle
01:18 PM Bug #11105 (Waiting on Merge): IPv6 RA RDNSS lifetime is too short, not compliant with RFC 8106: Jim Pingle
01:17 PM Bug #11091 (Waiting on Merge): Interfaces set as disabled in the configuration have an UP status in the operating system at boot: Jim Pingle
01:16 PM pfSense Plus Feature #10804 (Waiting on Merge): Interface Status page information for switch uplinks may be replaced by switch port data when media state monitoring is set: Jim Pingle
01:14 PM Feature #7077 (Waiting on Merge): Display negotiated data encryption algorithm in OpenVPN connection status: Jim Pingle
01:06 PM Bug #11554 (Waiting on Merge): Selected Data Encryption Algorithms list items reset when an input validation error occurs: Jim Pingle
09:48 AM Bug #11554 (Resolved): Selected Data Encryption Algorithms list items reset when an input validation error occurs: Tested on the latest release. The issue is fixed.
Ticket resolved. Danilo Zrenjanin
01:05 PM Bug #11559 (Waiting on Merge): OpenVPN does not start with a long list of Data Encryption Algorithms: Jim Pingle
10:05 AM Bug #11559 (Resolved): OpenVPN does not start with a long list of Data Encryption Algorithms: Tested on the latest release. It doesn't allow selecting too many data ciphers.
Ticket resolved. Danilo Zrenjanin
01:02 PM Revision 99cef76e: Catch up with rename of Coreboot upgrade package to Firmware: Renato Botelho
11:49 AM Bug #11188: MultiWAN setup NAT issue: Possibly related to #11436 Marcos M
10:00 AM pfSense Packages Bug #11580 (Resolved): FTP client proxy - source and destination bypass limitation: Tested on the latest release. I was able to define an alias in both Proxy Bypass: Source and Proxy Bypass: Destinati... Danilo Zrenjanin
09:12 AM Bug #11639 (Waiting on Merge): Entries from rotated log files may be displayed out of order when log display includes contents from multiple files: With the commit applied the order is correct for both uncompressed and compressed log files:... Jim Pingle
09:05 AM Bug #11639 (Feedback): Entries from rotated log files may be displayed out of order when log display includes contents from multiple files: Applied in changeset commit:b9c1679dae94fb2d406cfc386f667eed2378b6d2. Jim Pingle
08:50 AM Bug #11639 (Closed): Entries from rotated log files may be displayed out of order when log display includes contents from multiple files: The code in @rsort_log_filename()@ is making faulty assumptions about the log filenames. It is not only testing the w... Jim Pingle
08:44 AM Bug #11383: pfSense Proxy Authentication not working: Michael Samer wrote:
> Jim Pingle wrote:
> > From a much older release, yes, but not from the last public release. ... Michael Samer
06:38 AM Bug #11638 (Pull Request Review): PHP error in logs from XMLRPC if no sections are selected to sync: Jim Pingle
03:32 AM Bug #11638: PHP error in logs from XMLRPC if no sections are selected to sync: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/180 Viktor Gurov
02:56 AM Bug #11638 (Closed): PHP error in logs from XMLRPC if no sections are selected to sync: if no sections is selected on the HA sync configuration page (used only for pkg xmlrpc sync, for example), php error ... Viktor Gurov
02:16 AM pfSense Packages Bug #11582: FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: Alexis Mestag wrote:
> Viktor Gurov wrote:
> > fix:
> > https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_r... Viktor Gurov
01:54 AM pfSense Packages Bug #11582: FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: Viktor Gurov wrote:
> fix:
> https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/69
If you can pro... Alexis Mestag

03/08/2021

09:02 PM pfSense Packages Bug #11637 (Resolved): Preprocs - possible to create two defaults: When creating a new server configuration, if you use the +Aliases button for the Bind-To Address and/or the Ports fie... Max Leighton
08:19 PM Revision beac9a1c: Remove obsolete vars for MVC: Steve Beaver
08:11 PM Revision ec0e144d: Revise firewall_nat.php for MVC: Steve Beaver
07:40 PM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: Site to Site OpenVPN is broken for me in 2.5.0. The tunnel encryption is setup, but running openvpn at verbosity leve... Greg Hulands
09:46 AM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: the last filter generating change is https://github.com/pfsense/pfsense/commit/fce8a99bffae47c965c692dbe763ae9732092f... Viktor Gurov
09:17 AM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: Same issue here after upgrade to v21.02,
MultiWan wont NAT properly on both wan.
A new message to let you know this... R M
05:02 PM Feature #11395: Option to switch IPsec filtering modes to choose between ``enc`` and ``if_ipsec`` filtering: tested and working for me. Jeremy Mordkoff
01:46 PM pfSense Packages Bug #11135: HAproxy OCSP reponse crontab bug: Can this same fix be applied to the regular haproxy package as well as the -devel variant? Christopher Sutcliff
12:32 PM Bug #11636 (Pull Request Review): Unused Limiter entries with schedules create unnecessary cron jobs: Jim Pingle
11:29 AM Bug #11636: Unused Limiter entries with schedules create unnecessary cron jobs: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/179 Viktor Gurov
10:14 AM Bug #11636 (Resolved): Unused Limiter entries with schedules create unnecessary cron jobs: If you create a Limiter with a schedule but do not apply it to any firewall rules,
it will create a cron job: "0,15,... Viktor Gurov
12:31 PM pfSense Packages Bug #11582 (Pull Request Review): FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: Jim Pingle
07:23 AM pfSense Packages Bug #11582 (New): FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: Alexis Mestag wrote:
> Sorry, there are still some issues, even after I successfully applied the patch, using the <c... Viktor Gurov
04:25 AM pfSense Packages Bug #11582: FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: Sorry, there are still some issues, even after I successfully applied the patch, using the ... Alexis Mestag
12:30 PM pfSense Packages Bug #11627 (Pull Request Review): rc file is not deleted: Jim Pingle
03:42 AM pfSense Packages Bug #11627: rc file is not deleted: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/68 Viktor Gurov
12:30 PM pfSense Packages Bug #11628 (Pull Request Review): ftp-proxy error messages in logs: Jim Pingle
02:34 AM pfSense Packages Bug #11628: ftp-proxy error messages in logs: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/67 Viktor Gurov
12:29 PM Regression #11537 (Pull Request Review): IPsec VTI tunnel between IPv6 peers may not configure correctly: Jim Pingle
12:50 AM Regression #11537: IPsec VTI tunnel between IPv6 peers may not configure correctly: improved:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/177 Viktor Gurov
12:28 PM Regression #11633 (Pull Request Review): DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: Jim Pingle
12:54 AM Regression #11633: DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/176 Viktor Gurov
12:04 AM Regression #11633: DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: correct example:... Viktor Gurov
11:29 AM pfSense Plus Bug #11630: WireGuard MultiWAN Not Failing Back to Tier 1: This also appears to be related to Bug #11613, where the user had to reboot pfSense to get WireGuard to follow the st... James Blanton
11:21 AM pfSense Plus Bug #11630: WireGuard MultiWAN Not Failing Back to Tier 1: FYI - The "nightly" build I was using during testing was 2.5.0.a.20210122.2350. James Blanton
10:58 AM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Victor- Any idea when this is going to get some attention? This issue really ripples thru out the system (e.g. Gatewa... Greg Shaffer
07:03 AM Bug #10708: ZFS bootpool boot symlink issue: I believe this is the root cause of the issue I hit when upgrading 2.4.5 to 2.5.0.
The original install was perfor... Boycee .
04:35 AM Bug #11635 (Duplicate): Changing alias resolves in broken rules: Duplicate of #11568 Viktor Gurov
03:56 AM Bug #11635 (Duplicate): Changing alias resolves in broken rules: After changing a alias's name from alias01 to alias02, all rules regarding this is broken. Also the source changes fr... Kristian Krautwald
01:04 AM pfSense Packages Regression #11634 (Resolved): bind hangs when pfsense is reconnecting as an openvpn client to a TUN openvpn server: I encounter a problem with bind since 2.5.0, it stops responding to queries each time an openvpn disconnection/connec... Stéphane BARBARAY

03/07/2021

11:42 PM Regression #11633 (Closed): DHCP6 interfaces are reconfigured multiple times at boot when more than one interface is set to Track: DHCP6 interface is restarted multiple times on boot if there is > 1 track interfaces that use it:... Viktor Gurov
11:36 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: see also #11187 Viktor Gurov
11:32 PM pfSense Plus Bug #11630: WireGuard MultiWAN Not Failing Back to Tier 1: see also #11570 and #6370 Viktor Gurov
11:11 PM pfSense Packages Bug #11511 (Resolved): OSPF distribute List always empty: Viktor Gurov
11:11 PM pfSense Packages Bug #11517 (Resolved): Zebra Access List Names don't prevent spaces, but a whitespace in the name will stop FRR from starting: Viktor Gurov
11:11 PM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: Stéphane BARBARAY wrote:
> I encounter a similar problem with bind which stop responding each time an openvpn discon... Viktor Gurov
05:08 PM Bug #11631: OpenVPN client "Custom options" field drop end of line: In that case I propose that it also tread newlines as a separator. It would be more consistent with other similar fie... Patrick Northon
09:52 AM Bug #11631 (Not a Bug): OpenVPN client "Custom options" field drop end of line: Newlines are not meant to be respected there -- read the description on the field. Jim Pingle
12:11 AM Bug #11631 (Not a Bug): OpenVPN client "Custom options" field drop end of line: Whenever I restart one of my OpenVPN client, the "Custom options" field changes.
For example:
```
remote-cert-... Patrick Northon
03:11 PM Todo #10464: Don't change the current update repo when new releases are available: Steve Yates wrote:
> Perhaps a note at the top of the package pages...could be quickly added with limited testing.
... Steve Y
10:56 AM Todo #10464: Don't change the current update repo when new releases are available: I had a similar issue, with even less of an input from me.
To test my backup process, I saved a config.xml locally... Dr. Phil
11:21 AM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: It looks like the reply traffic is not matching the state created by the inbound connection on the WAN.
The firewa... Steve Wheeler
11:09 AM Bug #9190: host override for pfsense box DNS name does not override IP of LAN interface: Jim Pingle wrote:
> I understood it correctly, and it's behaving exactly as expected. The system adds an internal "o... Andrew Bobulsky
04:42 AM pfSense Packages Bug #11632 (Duplicate): unbound service not restarted on pfBlocker-devel install/reinstall: SG-3100 running 21.02_1 pfB-devel 3.0.0_15
I noticed on my upgrade from 2.5.4-p1 that unbound wasn't running after... Loh Phat

03/06/2021

07:12 PM pfSense Packages Bug #11511: OSPF distribute List always empty: ACLs are shown up in OSPF GUI
fixed Alhusein Zawi
04:29 PM pfSense Docs New Content #9608: Add note about disabling secure boot when configuring a Hyper-V Gen 2 VM: Fred Bergeron wrote:
> *Page:* https://docs.netgate.com/pfsense/en/latest/recipes/virtualize-hyper-v.html
>
> *Fe... Michael Spears
04:14 PM pfSense Docs Correction #11145: Screenshots in "Virtualizing pfSense with Hyper-V" recipe are incorrect and outdated: Michael Spears wrote:
> James Eisele wrote:
> > *Page:* https://docs.netgate.com/pfsense/en/latest/recipes/virtuali... Michael Spears
04:12 PM pfSense Docs Correction #11145: Screenshots in "Virtualizing pfSense with Hyper-V" recipe are incorrect and outdated: James Eisele wrote:
> *Page:* https://docs.netgate.com/pfsense/en/latest/recipes/virtualize-hyper-v.html
>
> *Fee... Michael Spears
04:05 PM pfSense Docs Correction #11399: SG-3100 M.2 Installation Guide Reinstall Corrections: Kris Phillips wrote:
> Marcos Mendoza wrote:
> > 1. I believe "run recovery" wipes emmc, so separate instructions h... Michael Spears
03:37 PM Bug #11187: WAN_DHCP6 down, but IPv6 actually works: I'm seeing this too. Unless I hardcode a monitoring address (I use my ISP's linklocal end of the connection) the IPV... Loh Phat
10:20 AM pfSense Plus Regression #11504: CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: bdaa35dcf31def521ba8c60c0aa9c41bf5005311 is working when applied to 21.02p1 on an SG-3100. The change hasn't made it ... Max Leighton
07:55 AM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: I encounter a similar problem with bind which stop responding each time an openvpn disconnection/connection is made..... Stéphane BARBARAY

03/05/2021

10:59 PM Bug #11602: Delayed packet transmission in cxgbe driver can lead to latency and reduced performance: Navdeep wrote in
——
The bug was first fixed in these commits in FreeBSD 14-current and 13:
https://www.google.com... Jim Thompson
09:03 PM pfSense Packages Bug #11517: Zebra Access List Names don't prevent spaces, but a whitespace in the name will stop FRR from starting: Access list does not accept names with spaces
fixed
Alhusein Zawi
04:31 PM pfSense Plus Bug #11630 (Closed): WireGuard MultiWAN Not Failing Back to Tier 1: When using a GW group for WAN failover, WireGuard will fail to Tier2 when the Tier1 GW is down. However, when Tier1 i... James Blanton
02:18 PM pfSense Packages Bug #11614: ACME certificate renewal/creation fails with multiple DNS providers: Right, and there is also no solution yet, but it's all the same problem with multiple (different) credentials.
Dep... Jim Pingle
02:04 PM pfSense Packages Bug #11614: ACME certificate renewal/creation fails with multiple DNS providers: Workaround in #8560 does not reliably work for this scenario of the bug. So effectively, there is no workaround. Ben Tyger
12:43 PM Bug #11629: PPPoE WAN IP address different than expected when set static by ISP: Perhaps this is another variation of #11545 and not a unique issue Jim Pingle
12:35 PM Bug #11629: PPPoE WAN IP address different than expected when set static by ISP: It seems like the IPs are assigned to the interface in ascending order no matter what pppoe server gives
(reverse ... Marcos M
08:33 AM Bug #11629: PPPoE WAN IP address different than expected when set static by ISP: Requested info has been added to the support ticket. Dan Rice
08:17 AM Bug #11629: PPPoE WAN IP address different than expected when set static by ISP: Our IP block and router status output is aleady attached to the support ticket. I will also attached the other info t... Dan Rice
08:14 AM Bug #11629 (Feedback): PPPoE WAN IP address different than expected when set static by ISP: We will need a lot more information here since it isn't happening to others that we're aware of yet.
Things like P... Jim Pingle
08:03 AM Bug #11629 (Resolved): PPPoE WAN IP address different than expected when set static by ISP: As per support ticket: #INC-77927
Hi, we've had this box and a previous one connecting to our service provider for... Dan Rice
11:21 AM Revision 779daee9: Typo fix. Issue #11624: Danilo Zrenjanin
10:23 AM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: Marcos Mendoza wrote:
[...]
>
> I noticed the PPPoE gateway that was automatically created was outside of the sub... Grzegorz Krzystek
09:59 AM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: Another report:
Port forward and firewall rules are in place on a secondary PPPoE WAN interface. Traffic comes in,... Marcos M
08:36 AM Bug #11624 (Feedback): Typo on Router Advertisements page: PR has been merged. Thanks! Renato Botelho
08:09 AM Bug #11624 (Pull Request Review): Typo on Router Advertisements page: Jim Pingle
05:24 AM Bug #11624: Typo on Router Advertisements page: Fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/175 Danilo Zrenjanin
08:33 AM pfSense Packages Feature #11349 (Feedback): Allow to set minimum TLS version: PR has been merged. Thanks! Renato Botelho
08:33 AM pfSense Packages Bug #11582 (Feedback): FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: PR has been merged. Thanks! Renato Botelho
08:29 AM pfSense Packages Bug #11580 (Feedback): FTP client proxy - source and destination bypass limitation: PR has been merged. Thanks! Renato Botelho
08:26 AM pfSense Packages Bug #8827 (Feedback): Squidguard: ACL redirect modes 'redirect' and 'err page' send unresolvable URLs to the client.: PR has been merged. Thanks! Renato Botelho
08:25 AM pfSense Packages Bug #11620 (Feedback): OSPF Route Redistribution shows numbers instead of route map names: PR has been merged. Thanks! Renato Botelho
08:08 AM Feature #11164 (Pull Request Review): Input validation to prevent setting a load balancing gateway group as default: Jim Pingle
05:11 AM Feature #11164: Input validation to prevent setting a load balancing gateway group as default: Fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/174 Danilo Zrenjanin
08:06 AM pfSense Plus Bug #11626: Google LDAP connections fail due to lack of SNI for TLS 1.3: If OpenLDAP ldapsearch fails directly it's unlikely to be related to #9417
All the references I see to SNI seem fa... Jim Pingle
02:07 AM pfSense Plus Bug #11626: Google LDAP connections fail due to lack of SNI for TLS 1.3: may be related to #9417 Viktor Gurov
02:02 AM pfSense Plus Bug #11626 (Resolved): Google LDAP connections fail due to lack of SNI for TLS 1.3: https://forum.netgate.com/topic/161725/google-ldap-connection-failed:
I have a problem after update my Netgate XG-... Viktor Gurov
08:00 AM Bug #11428 (Pull Request Review): CPU details are incorrect in the System Information widget after resetting log files: Jim Pingle
12:26 AM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: Jim Pingle wrote:
> The dmesg.boot file is the copy of the kernel message buffer for that purpose.
>
> Resetting ... Viktor Gurov
06:59 AM Regression #11570: Gateway monitoring services is not always restarted on interface events, which may prevent a WAN from recovering back to an online state: related to #10716 and #11298 (?) Viktor Gurov
06:31 AM pfSense Packages Bug #11628 (Resolved): ftp-proxy error messages in logs: Disabled ftp-proxy package causes errors in log:... Viktor Gurov
06:29 AM pfSense Packages Bug #11627 (Resolved): rc file is not deleted: After disabling the arpwatch service, `/usr/local/etc/rc.d/arpwatch.sh` still exists
and you can see errors in log:
... Viktor Gurov
04:52 AM pfSense Packages Feature #11405 (Resolved): add RPKI route map in GUI: frr 1.1.0_7 Viktor Gurov
04:51 AM pfSense Packages Feature #11405: add RPKI route map in GUI: already there ('Enable BGP RPKI' option)
works as expected:... Viktor Gurov
04:21 AM pfSense Packages Feature #11405 (New): add RPKI route map in GUI: "-M rpki" must be added to bgpd daemon command line,
see https://docs.frrouting.org/en/latest/bgp.html#enabling-rpki... Viktor Gurov
02:58 AM Bug #11619: Unable to upgrade 2.4.4-p3 to 2.5/21.02-p1: same issue with updating 2.3.5 to 2.4.4-p3/2.4.5-p1:... Viktor Gurov
02:38 AM pfSense Packages Feature #9315: Add Package: dnscrypt-proxy: According to "DNSCrypt Options" at https://nlnetlabs.nl/documentation/unbound/unbound.conf/ it seems the DNScrypt in ... Idar Lund
12:35 AM Feature #11625 (New): Cisco-AVPair aliases support: It would be very helpful to enable the use of aliases in the Cisco-AVPair parser.
This will allow to create quick an... Viktor Gurov

03/04/2021

11:47 PM Bug #11624 (Resolved): Typo on Router Advertisements page: Small typo on services_router_advertisements.php page. under "Router Lifetime" it says "The default is 3 * *Maximim* ... Mischa De Pol
11:03 PM pfSense Packages Bug #11546 (Resolved): incorrect 'set as-path' command: Viktor Gurov
09:08 PM pfSense Packages Bug #11546: incorrect 'set as-path' command: "Set" option is not in options list.
Alhusein Zawi
06:40 PM Regression #11316: Unbound crashes with signal 11 when reloading: I'm losing DNS every day or so with pfsense 2.5. I'm using the latest from "pkg update".
If there's anything I can d... Mike Farmwald
05:42 PM Feature #11164: Input validation to prevent setting a load balancing gateway group as default: Seems simple enough to fix (with the message) and the GUI is misleading. Jim Thompson
04:25 PM Revision 4f1eb41c: Do not run post-install during build: (cherry picked from commit 2524d5483f97c5b6594b623113056408291b1ae1) Renato Botelho
04:25 PM Revision 2524d548: Do not run post-install during build: Renato Botelho
03:05 PM Bug #11539 (Feedback): Mobile IPsec ``split_include`` value of ``0.0.0.0/0`` causes some clients to fail: Jim Pingle
03:05 PM Bug #11539: Mobile IPsec ``split_include`` value of ``0.0.0.0/0`` causes some clients to fail: I can't find a client that can reproduce this so I can't confirm a fix. Attached is a patch which will omit 0.0.0.0/0... Jim Pingle
02:19 PM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: The dmesg.boot file is the copy of the kernel message buffer for that purpose.
Resetting log files should not be n... Jim Pingle
01:44 PM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: Would it work to just copy the file to dmesg.boot.current or whatever, after each boot, and then parse that? It shou... Steve Y
09:52 AM pfSense Packages Bug #11449 (Resolved): BIND fails during/after upgrade to 21.02/2.50: Renato Botelho
09:16 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: It did fix the issue for me. Tchello Mello
08:47 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: Is this bug fixed with the new version of the bind package release for pfsense ? Stefan Andersson
09:35 AM pfSense Docs Todo #11623 (Duplicate): Update AWS VPC Wizard Documentation: Duplicate of #11622 Jim Pingle
09:31 AM pfSense Docs Todo #11623 (Duplicate): Update AWS VPC Wizard Documentation: The documentation for the AWS VPC wizard is out of date on its screenshots and missing information. See attached cur... Kris Phillips
09:23 AM pfSense Docs Todo #11597 (Closed): Feedback on Troubleshooting — Troubleshooting Upgrades: Fixed, will show up momentarily when the docs rebuild.
Jim Pingle
09:21 AM pfSense Docs Todo #11597 (In Progress): Feedback on Troubleshooting — Troubleshooting Upgrades: Yes, that should be updated to the new name. Thanks!
Jim Pingle
09:14 AM pfSense Packages Bug #11620 (Pull Request Review): OSPF Route Redistribution shows numbers instead of route map names: Jim Pingle
05:23 AM pfSense Packages Bug #11620: OSPF Route Redistribution shows numbers instead of route map names: fix:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/66 Viktor Gurov
05:09 AM pfSense Packages Bug #11620 (Resolved): OSPF Route Redistribution shows numbers instead of route map names: Routing using routing protocols has basically been broken to some extent. In my case I'm doing advanced routing with ... Viktor Gurov
09:12 AM pfSense Docs Correction #11154 (Closed): Feedback on Cellular Wireless — Known Working 3G-4G Modems: PR merged Jim Pingle
03:59 AM pfSense Docs Correction #11154: Feedback on Cellular Wireless — Known Working 3G-4G Modems: https://gitlab.netgate.com/docs/pfSense-docs/-/merge_requests/8 Viktor Gurov
09:11 AM pfSense Docs Todo #11622: Update pfSense VPC VPN Configuration Wizard docs: https://docs.netgate.com/pfsense/en/latest/packages/aws-vpc-wizard/using-the-wizard.html#using-the-wizard Danilo Zrenjanin
09:10 AM pfSense Docs Todo #11622 (New): Update pfSense VPC VPN Configuration Wizard docs: The screenshots are outdated.
There is a new field Assume Role ARN, which is not explained in our docs. Danilo Zrenjanin
08:11 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: This patch should also take ovpn_auth_verify_async into consideration, right? i do have the issue, but not because of... Thomas Högemann
06:07 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Summer Sea wrote:
> Viktor Gurov wrote:
> > You need to install the System Patches package and paste the content of... Viktor Gurov
05:02 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Viktor Gurov wrote:
> You need to install the System Patches package and paste the content of 154.diff
> see https:... Summer Sea
04:36 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Summer Sea wrote:
> Viktor Gurov wrote:
> > Summer Sea wrote:
> > > In the pfsense FE 21.02 the issue is still pre... Viktor Gurov
04:20 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Viktor Gurov wrote:
> Summer Sea wrote:
> > In the pfsense FE 21.02 the issue is still present, but I don't get ho... Summer Sea
05:57 AM pfSense Docs Todo #11621 (Closed): Feedback on High Availability: already there Viktor Gurov
05:34 AM pfSense Docs Todo #11621 (Closed): Feedback on High Availability: *Page:* https://docs.netgate.com/pfsense/en/latest/highavailability/index.html
*Feedback:*
Add the https://do... Viktor Gurov
04:10 AM Bug #11619 (New): Unable to upgrade 2.4.4-p3 to 2.5/21.02-p1: issue with upgrading 2.4.4-p3 to 2.5/21.02-p1:... Viktor Gurov

03/03/2021

09:24 PM Revision 89b1338a: Fix typo: (cherry picked from commit 361ad87b85fdc0f97a2d7f3dcb6ec439e105e320) Jim Pingle
09:24 PM Revision 361ad87b: Fix typo: Jim Pingle
07:53 PM Revision e85c56b3: Add missing break: (cherry picked from commit f26a816b7080f0ef45a8cb3938cfd878dbaef71e) Renato Botelho
07:53 PM Revision f26a816b: Add missing break: Renato Botelho
07:15 PM Revision ae3d3397: Rework WOL page a bit. Fixes #11616: * Eliminate duplicate code
* Fix output encoding
* Additional validation
* Use POST when waking all devices
(cherry ... Jim Pingle
07:14 PM Revision 2e94828c: Rework WOL page a bit. Fixes #11616: * Eliminate duplicate code
* Fix output encoding
* Additional validation
* Use POST when waking all devices Jim Pingle
04:23 PM Bug #9460: OpenVPN local auth failing due to fcgicli output: Applying the patch from #4521 fixed the certificate verify before the AUTH_FAILED for me and applying ce76f299853dccb... Elon l
03:38 PM Bug #9460: OpenVPN local auth failing due to fcgicli output: Another report of this issue. Setup is pfSense 21.02p1 OpenVPN + RADIUS + Yubikey. Logs show:... Marcos M
04:17 PM pfSense Packages Bug #11618 (Closed): WireGuard using incorrect IPv6 tunnel address prefix length: Example; if I specify a tunnel with address fc00:bbbb:bbbb:bb01::9:xxxx/128, this is how it gets configured:... Reza Arbab
03:41 PM Bug #11609 (Pull Request Review): CLI interface configuration without IPv6 leaves RA enabled: Jim Pingle
07:51 AM Bug #11609: CLI interface configuration without IPv6 leaves RA enabled: related to #11367
fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/172 Viktor Gurov
04:40 AM Bug #11609 (Closed): CLI interface configuration without IPv6 leaves RA enabled: This occurred on a completely new install, version 2.5.0-RELEASE.
Specs:
Mainboard: ASUS ROG MAXIMUS IX FORMULA
... George Doe
03:39 PM pfSense Packages Bug #8827 (Pull Request Review): Squidguard: ACL redirect modes 'redirect' and 'err page' send unresolvable URLs to the client.: Jim Pingle
04:12 AM pfSense Packages Bug #8827: Squidguard: ACL redirect modes 'redirect' and 'err page' send unresolvable URLs to the client.: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/65 Viktor Gurov
03:38 PM Bug #11600 (Pull Request Review): WireGuard interfaces should have MSS clamping enabled by default: Jim Pingle
03:21 AM Bug #11600: WireGuard interfaces should have MSS clamping enabled by default: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/171 Viktor Gurov
03:38 PM Bug #11104 (Pull Request Review): OpenVPN does not start with several authentication sources selected: Jim Pingle
02:51 AM Bug #11104: OpenVPN does not start with several authentication sources selected: input validation:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/170 Viktor Gurov
03:31 PM pfSense Packages Feature #11349 (Pull Request Review): Allow to set minimum TLS version: Jim Pingle
12:09 AM pfSense Packages Feature #11349: Allow to set minimum TLS version: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/64 Viktor Gurov
03:17 PM Bug #11606 (Rejected): Wireguard AllowedIPs filtering issue: I can't replicate this as stated. I have a tunnel with multiple peers and the peers can only communicate with the add... Jim Pingle
02:52 PM pfSense Plus Bug #11615: OpenVPN + Ldap broken in 21.02-RELEASE-p1: Read all of the recent notes, it's a general problem with fcgicli that manifests in multiple ways, including validati... Jim Pingle
02:46 PM pfSense Plus Bug #11615: OpenVPN + Ldap broken in 21.02-RELEASE-p1: I do not believe this is a duplicate
here the longest cert
1) ST=CA, OU=XXXXXX, O=XXXXXX Technologies Inc, L=XXXX... Luc Suryo
11:22 AM pfSense Plus Bug #11615 (Duplicate): OpenVPN + Ldap broken in 21.02-RELEASE-p1: Almost certainly a duplicate of #4521 (See notes there with attached patches to try).
If that doesn't help, please... Jim Pingle
11:20 AM pfSense Plus Bug #11615 (Duplicate): OpenVPN + Ldap broken in 21.02-RELEASE-p1: We recently upgraded to 21.02-RELEASE-p1 (AWS)
And since we see an odd behavior that prevent user to login
OpenLD... Luc Suryo
02:39 PM Bug #11617 (Closed): Unexpected Operator error on console at boot with ZFS and RAM Disks: after mounting filesystems, the console returns the following error at boot:... Steve R
01:25 PM pfSense Packages Bug #10642 (Duplicate): ACME certificate renewal with DNS-Gandi method fails when using multiple Gandi keys: Same root problem as #8560 Jim Pingle
01:25 PM Bug #11616 (Feedback): Potential stored XSS vulnerability in services_wol.php: Applied in changeset commit:2e94828cd021a8f0fd1a89475f6e0f4bb2f5805f. Jim Pingle
12:21 PM Bug #11616 (Closed): Potential stored XSS vulnerability in services_wol.php: There is a potential stored XSS in services_wol.php.
When waking all devices (@services_wol.php?wakeall=true@) the... Jim Pingle
01:25 PM pfSense Packages Bug #11614 (Duplicate): ACME certificate renewal/creation fails with multiple DNS providers: Same root problem as #10642 and #8560 Jim Pingle
09:50 AM pfSense Packages Bug #11614 (Duplicate): ACME certificate renewal/creation fails with multiple DNS providers: When trying to issue/renew ACME certificates to multiple different DNS providers with the DNS verification method, th... Ben Tyger
11:57 AM Bug #2218: CARP VIPs can become master too early at boot time: Jim Pingle wrote:
> Read the text you quoted again. Eventually a better solution may come along. It's entirely mitig... Le Cygne
08:47 AM Bug #2218: CARP VIPs can become master too early at boot time: Read the text you quoted again. Eventually a better solution may come along. It's entirely mitigated by maintenance m... Jim Pingle
08:24 AM Bug #2218: CARP VIPs can become master too early at boot time: Jim Pingle wrote:
> I didn't close the ticket and say it wouldn't be addressed eventually. When this old ticket was ... Le Cygne
11:10 AM Bug #7138: Pfsense wide dhcpv6 client doesn't recognise ifid statement: Hello,
this would also fix a problem on the PPPoE interface. My provider only supports DHCPv6-IA_PD and not DHCPv6-I... Jost Schoenleben
08:37 AM Bug #11613 (Rejected): Pushing WireGuard traffic out a specific GW using static routes requires a reboot to revert.: I initially had my WireGuard traffic going out a secondary WAN using a static route with the remote wireguard endpoin... Christian McDonald
08:12 AM Bug #11612 (Duplicate): CARP-based master takes over before it fully syncs required data: Same root problem as #2218 Jim Pingle
08:04 AM Bug #11612 (Duplicate): CARP-based master takes over before it fully syncs required data: Hello there! I have two pfsense 2.4.5p1. They are set up for failover via CARP. Everything works fine including the f... Le Cygne
07:38 AM Bug #11611 (Duplicate): Multi WAN Static Routes & NAT failure on multiple interfaces: Likely the same root cause as #11436
Though that has a lot more information, so this isn't necessary. Jim Pingle
07:30 AM Bug #11611 (Duplicate): Multi WAN Static Routes & NAT failure on multiple interfaces: I just discovered that pFsense 2.6.0.a.20210302.0100
fails to route traffic on static routes configured on multiple... Shepherd Nhongo
07:13 AM Bug #11607 (Duplicate): Clicking Connect VPN on the IPsec Status page establish the tunnel: Duplicate of #11486 Jim Pingle
05:29 AM pfSense Packages Bug #11610: NET-SNMP is not setting the correct permissions on AgentX: Unable to reproduce with FRR pkg 1.1.0_8 -
frr starts successfully with the "Enable agentx" option:... Viktor Gurov
05:11 AM pfSense Packages Bug #11610 (New): NET-SNMP is not setting the correct permissions on AgentX: When we go to FRR -> Global Settings -> (Scroll down to "Modules" and tick the "Enable agentx support for accessing F... Yif Swery
03:01 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Thanks a lot for the patch! After updating to 21.02-RELEASE-p1, the OpenVPN failed to connect. I use an own CA with d... Foo Bar
02:57 AM Bug #6880: Multiple DHCP6 WAN connections leads to multiple dhcp6c clients: This issue still isn't fixed with 2.5.0. Car F
02:06 AM pfSense Docs New Content #11608 (Closed): Interfaces order of XG-7100 Quad-Port 10GbE Fiber SFP+ Installation Kit: It's not documented what would be the order of the interface once this card is deployed in XG-7100-1u.
https://doc... Danilo Zrenjanin

03/02/2021

10:48 PM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: With patch 7990de53bfc8267d1dd96636a175929a35cbe664
and patch 169.diff applied, the errors didn't show anymore.
T... Dirk Meyer
08:58 AM Regression #11475 (Pull Request Review): Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Jim Pingle
06:57 AM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Please try this patch
extra fix for route_get() and route_del():
https://gitlab.netgate.com/pfSense/pfSense/-/m... Viktor Gurov
06:00 AM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Thanks, I can verify now the dashboard works again.
But while on system_gateways.php I pressed Save:... Dirk Meyer
05:01 AM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Dirk Meyer wrote:
> note: The patch is an improvement, but it doesn't solve the issue.
You need to apply patch ID... Viktor Gurov
04:53 AM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: note: The patch is an improvement, but it doesn't solve the issue.
Dirk Meyer
08:49 PM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: I'm having the same exact issue after updating aws pfsense appliance to 21.02_1. The only branches I see on the Syste... Alex P
04:46 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Summer Sea wrote:
> In the pfsense FE 21.02 the issue is still present, but I don't get how to fix it:
Please tr... Viktor Gurov
02:03 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: In the pfsense FE 21.02 the issue is still present, but I don't get how to fix it:
```
[21.02-RELEASE]/root: /us... Summer Sea
08:36 PM pfSense Packages Bug #11590: pfBlocker Issue when IPv6 is disabled: Fixed in pfBlockerNG-devel v3.0.0_14 BBcan177 .
06:50 PM Bug #11607 (Duplicate): Clicking Connect VPN on the IPsec Status page establish the tunnel: In 21.02, interesting traffic has to be generated to bring up an IPsec tunnel. Regardless of whether pfSense itself c... Max Leighton
05:26 PM Feature #11589: Fix iftop experimental traffic fetcher, unify and improve output style: Rounding was fixed to display no decimals with bits or exactly one decimal when kilobits or larger units are used.
... Ashus CZ
04:20 PM Bug #11606 (Rejected): Wireguard AllowedIPs filtering issue: There is potential problem with filtering AllowedIPs in Wireguard server.
To demonstrate it is enough to setup basic... Sylwester Baranski
03:22 PM Bug #11595: Unbound responds with SERVFAIL when resolving DNS record through more than 8 CNAMEs due to hardcoded limit: Tyler Szabo wrote:
> Query Name Minimization was disabled for me and I just checked both states and it appears to st... Jim Pingle
03:19 PM Bug #11595: Unbound responds with SERVFAIL when resolving DNS record through more than 8 CNAMEs due to hardcoded limit: Query Name Minimization was disabled for me and I just checked both states and it appears to still occur. It's possib... Tyler Szabo
07:53 AM Bug #11595 (Not a Bug): Unbound responds with SERVFAIL when resolving DNS record through more than 8 CNAMEs due to hardcoded limit: Turn off "Query Name Minimization" in the Unbound advanced settings. With that off I can resolve the host you show, w... Jim Pingle
01:59 AM Bug #11595: Unbound responds with SERVFAIL when resolving DNS record through more than 8 CNAMEs due to hardcoded limit: Title should read "Unbound" not sure how I got "Unblound" in there. Tyler Szabo
01:58 AM Bug #11595 (Not a Bug): Unbound responds with SERVFAIL when resolving DNS record through more than 8 CNAMEs due to hardcoded limit: Query to pfSense:... Tyler Szabo
02:27 PM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Jim Pingle wrote:
> Not that I'd expect that to cause a problem, but why would you set that to 1? It doesn't make mu... Ryan Fitton
01:59 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Greg Shaffer wrote:
> I noticed that both /tmp/em0_routerv6 and /tmp/em0_defaultgwv6 were empty while the ipv4 versi... Eric B
01:33 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Mike Loiterman wrote:
> When you reference /tmp/*_defaultgwv6 and /tmp/*_routerv6, or you actually creating a file c... Anonymous
12:07 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Dennis P wrote:
> Greg Shaffer wrote:
> > I believe both of these files will be rewritten if you make a change to y... Mike Loiterman
11:05 AM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Greg Shaffer wrote:
> I believe both of these files will be rewritten if you make a change to your WAN or you reboot... Anonymous
11:01 AM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Dennis P wrote:
> Greg Shaffer wrote:
> > #echo $2 > /tmp/em0_routerv6
> > echo "fe80::X:X:X:X" > /tmp/em0_routerv... Greg Shaffer
07:58 AM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Greg Shaffer wrote:
> UPDATE:
>
> Here is a diff of my changes to /etc/inc/interfaces.inc
Thank you Greg.
T... Pete C
12:57 PM Bug #11603 (Rejected): Pfsense 2.5.0 : MultiWan with rules default gateway not work: This site is not for support or diagnostic discussion.
For assistance in solving problems, please post on the "Net... Jim Pingle
12:23 PM Bug #11603 (Rejected): Pfsense 2.5.0 : MultiWan with rules default gateway not work: Hi,
I have a problem with updating pfsense. Everything works fine on version 2.4.X
I have a configured multiwan ... Lars Lars
12:30 PM Bug #11602: Delayed packet transmission in cxgbe driver can lead to latency and reduced performance: Also see: https://forum.netgate.com/topic/160974/upgraded-to-2-5-0-now-seeing-ping-spikes Steve Wheeler
11:44 AM Bug #11602 (Resolved): Delayed packet transmission in cxgbe driver can lead to latency and reduced performance: In some situations the cxgbe driver can introduce latency in 2.5.
It looks as though that is caused by a driver is... Steve Wheeler
12:27 PM pfSense Packages Bug #11605 (Closed): Suricata can trigger PHP crash on SG-3100: Suricata and SNORT won't start on 21.02p1 SG3100. Appears to be an issue related to PHP see the following post for mo... Justin P
12:26 PM Feature #11604 (New): WireGuard Dynamic Listen Port Randomization: In CGNAT situations, like failing over to an LTE WAN for instance, it can be problematic to have the listen address o... Christian McDonald
12:17 PM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Jim Pingle wrote:
> Mark Howells wrote:
> > Maybe - I may be just conflating the matchaddr issue with my issue.
> ... Mark Howells
11:22 AM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Mark Howells wrote:
> Maybe - I may be just conflating the matchaddr issue with my issue.
>
> Do you need me to r... Jim Pingle
11:18 AM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Maybe - I may be just conflating the matchaddr issue with my issue.
Do you need me to raise a fresh issue?
Mark Howells
11:02 AM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: That looks unrelated to this issue. I can connect multiple clients and ping them, but with the remotes being dynamic ... Jim Pingle
10:28 AM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Jim Pingle wrote:
> Adam Esslinger wrote:
> > I noticed that there were additional "LAN" network that weren't defin... Mark Howells
07:18 AM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Adam Esslinger wrote:
> I noticed that there were additional "LAN" network that weren't defined in the WireGuard all... Jim Pingle
07:11 AM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Kevin Mychal Ong wrote:
> This is not isolated to when using multiple peers. It also happens to many people with jus... Jim Pingle
07:10 AM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: I was able to resolve this issue however I'm not sure which thing I did that resolved it so here is what I changed.
... Adam Esslinger
11:19 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: Hello everybody,
I became aware of this bug report after finding this forum thread via googling: https://forum.net... Andreas Grommek
10:25 AM pfSense Packages Feature #11601: Ability to disable/stop Service Watchdog: There is no need for two separate issues for the same problem. Any work to solve the other issue should stay on that ... Jim Pingle
10:21 AM pfSense Packages Feature #11601: Ability to disable/stop Service Watchdog: Jim Pingle wrote:
> Duplicate of #11490
#11490 describes symptoms, this request suggest a solution. Yuri Weinstein
10:15 AM pfSense Packages Feature #11601 (Duplicate): Ability to disable/stop Service Watchdog: Duplicate of #11490 Jim Pingle
10:09 AM pfSense Packages Feature #11601 (Duplicate): Ability to disable/stop Service Watchdog: Use case: before upgrading a package like pfBlockerNG I remove `pfb_dnsbl`, `pfb_filter` and `unbound` from Service W... Yuri Weinstein
09:12 AM Bug #11600 (Not a Bug): WireGuard interfaces should have MSS clamping enabled by default: It would seem that there is an upstream bug with wireguard icmp and path discovery (?) : https://git.kernel.org/pub/s... Christian McDonald
09:12 AM Bug #11599 (Resolved): Modifying static routes results in a logged error, changes are not reflected in routing table: When modifying an existing static route, e.g. changing subnet to be routed, the modified route is added to the curren... Roland Volkmann
08:57 AM Feature #11596 (Pull Request Review): Support for Cisco AVPair ``{clientipv6}`` template in firewall rules returns by RADIUS: Jim Pingle
03:24 AM Feature #11596: Support for Cisco AVPair ``{clientipv6}`` template in firewall rules returns by RADIUS: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/168 Viktor Gurov
03:13 AM Feature #11596 (Closed): Support for Cisco AVPair ``{clientipv6}`` template in firewall rules returns by RADIUS: Currently it's possible to use template variable "{clientip}", that is replaced with the connecting clients VPN IP (#... Viktor Gurov
08:56 AM Regression #11594 (Pull Request Review): IPv6 routes with a prefix length of 128 result in an invalid route table entry: Jim Pingle
01:51 AM Regression #11594: IPv6 routes with a prefix length of 128 result in an invalid route table entry: Using `-net` argument with /128 netmask produces invalid routes, i.e.:... Viktor Gurov
12:58 AM Regression #11594 (Closed): IPv6 routes with a prefix length of 128 result in an invalid route table entry: After adding fc00:1234::1234/128 via fc00:129::bbbb route, I see an invalid route in the routing table:... Viktor Gurov
08:11 AM pfSense Packages Bug #11543 (Duplicate): SquidGuard 1.16.18_15 - returning wrong page: duplicate of #8827 Viktor Gurov
04:40 AM pfSense Packages Bug #11543: SquidGuard 1.16.18_15 - returning wrong page: I can reproduce this issue in SSL/MITM Mode = "Splice Whitelist, Bump Otherwise"
in "Splice All" mode returns the co... Viktor Gurov
08:10 AM Bug #11583: dashboard nginx 504 Gateway time-out error: 1. The log parser has no idea how far back it needs to go to find enough usable entries and it has to include rotated... Jim Pingle
07:00 AM Bug #11583: dashboard nginx 504 Gateway time-out error: I still believe this to be a bug, here is why:
1. When the firewall logs widget is on the dashboard its set to only ... Adam Esslinger
07:42 AM Regression #11550 (New): Segmentation fault when loading ALTQ traffic shaping rules using FAIRQ: OK, thanks for checking on that. I've updated the subject to reflect that it's specific to FAIRQ. Jim Pingle
01:07 AM Regression #11550: Segmentation fault when loading ALTQ traffic shaping rules using FAIRQ: Jim Pingle wrote:
> Have you tried only using FAIRQ instead of only using PRIQ? It's not clear from the symptom beha... Thorsten Zitterell
05:04 AM pfSense Packages Bug #11582: FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: Alexis Mestag wrote:
> It seems I don't have access to https://gitlab.netgate.com/.
> Is there a way for me to see ... Viktor Gurov
03:40 AM pfSense Packages Bug #11582: FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: It seems I don't have access to https://gitlab.netgate.com/.
Is there a way for me to see the patch (out of curiosit... Alexis Mestag
04:31 AM pfSense Docs Todo #11597 (Closed): Feedback on Troubleshooting — Troubleshooting Upgrades: *Page:* https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html
*Feedback:*
I recently upgrade... Jamison Guyton
04:00 AM pfSense Packages Bug #10608 (Feedback): Update squid port to 4.11-p2: Squid version in pfSense 2.5/21.02 is 4.13:... Viktor Gurov
03:58 AM pfSense Packages Feature #11060 (Resolved): Block access to consumer Google accounts: works as expected on Squid pkg 0.4.45_3 - it blocks access to google accounts and adds youtube safesearch restrictions Viktor Gurov
02:56 AM Bug #11593 (Duplicate): NAT / Port Forward Stop Working: pfblocker php error - duplicate of #11590
port forwarding issue - duplicate of #11436 Viktor Gurov
12:16 AM Bug #11593 (Duplicate): NAT / Port Forward Stop Working: Good Morning,
Since upgrading to 2.5, which otherwise works very well, I have the issue that Port Forwarding stops... Martin Kusch

03/01/2021

11:44 PM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: This is not isolated to when using multiple peers. It also happens to many people with just 1 peer (site to site). Do... Kevin Mychal Ong
02:15 PM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: I have the same issue. Loads of "matchaddr failed" messages and any WG tunnel with more than a single peer fails.
I ... Mark Howells
11:20 PM pfSense Packages Bug #11591 (Duplicate): Could not install node exporter: duplicate of #11515
See fix in the next node_exporter version:
https://github.com/pfsense/FreeBSD-ports/commit/6e... Viktor Gurov
09:58 PM pfSense Packages Bug #11591 (Duplicate): Could not install node exporter: I tried to install node_exporter and whilst the install appeared to complete successfully, I noticed it did not appea... Mark De Souza
10:01 PM pfSense Packages Bug #11592 (New): Node exporter can not read system statistics: Each time I curl <ip of router>:9100 I receive the following log error:
level=error ts=2021-03-02T03:55:34.739Z ca... Mark De Souza
09:06 PM pfSense Packages Bug #11572: Auto created firewall rules have IPv4 as protocol only - even for IPv6 lists.: There are a couple items to iron out in devel, so don't think too long. BBcan177 .
04:02 PM pfSense Packages Bug #11572: Auto created firewall rules have IPv4 as protocol only - even for IPv6 lists.: Confirmed - created as an IPv6 rule in beta. Just means that all those out there using the "release" version are at r... Dave Tickem
09:01 PM pfSense Packages Bug #11590 (Closed): pfBlocker Issue when IPv6 is disabled: I noticed a crash report this morning when I logged into pfsense. I have ipv6 disabled on my pfsense box but it appea... Mark De Souza
06:52 PM Feature #11589 (Pull Request Review): Fix iftop experimental traffic fetcher, unify and improve output style: There were several problems with iftop fetcher.
Although it offered IPv6 unlike "rate" tool, its output is limited... Ashus CZ
06:34 PM pfSense Packages Bug #11585: WireGuard kernel panic when changing peer port on assigned WireGuard interface: Interestingly enough, I haven't had any panics on my cloud instances hosted on Vultr, though my instances hosted on-p... Christian McDonald
02:24 PM pfSense Packages Bug #11585: WireGuard kernel panic when changing peer port on assigned WireGuard interface: Parts of the backtrace are similar to #11586 but it's not an exact match. Jim Pingle
02:22 PM pfSense Packages Bug #11585 (New): WireGuard kernel panic when changing peer port on assigned WireGuard interface: Jim Pingle
02:22 PM pfSense Packages Bug #11585 (Closed): WireGuard kernel panic when changing peer port on assigned WireGuard interface: Jim Pingle
02:19 PM pfSense Packages Bug #11585: WireGuard kernel panic when changing peer port on assigned WireGuard interface: That does appear to be one we haven't seen yet:... Jim Pingle
02:06 PM pfSense Packages Bug #11585: WireGuard kernel panic when changing peer port on assigned WireGuard interface: Also hitting this when changing the port on the local wg interface...sometimes. Sometimes changing the port is fine, ... Christian McDonald
01:59 PM pfSense Packages Bug #11585 (Closed): WireGuard kernel panic when changing peer port on assigned WireGuard interface: All I did was change the port on peer 0. Christian McDonald
05:34 PM Regression #11316: Unbound crashes with signal 11 when reloading: I have the same issue, after updating two of my pfsense boxes I see abut 4 to 5 messages from each per hour
"Ser... Vöggur Guðmundsson
05:29 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Greg Shaffer wrote:
> #echo $2 > /tmp/em0_routerv6
> echo "fe80::X:X:X:X" > /tmp/em0_routerv6
> #echo $2 > /tmp/em... Anonymous
12:12 AM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Thank you @Greg Schaffer, that worked for me! Car F
02:49 PM Bug #11578 (Pull Request Review): Error when removing automatic DNS server route: Jim Pingle
02:30 PM Bug #11578: Error when removing automatic DNS server route: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/166 Viktor Gurov
07:45 AM Bug #11578: Error when removing automatic DNS server route: Looks like that route command is missing @-inet6@ somehow.
Fixed up subject and category. Jim Pingle
02:25 AM Bug #11578 (Closed): Error when removing automatic DNS server route: The log stats:
/system.php: The command '/sbin/route -q delete -host 2001:4860:4860::8888 'dynamic'' returned exit... Kristian Krautwald
02:47 PM pfSense Packages Bug #11582 (Pull Request Review): FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: Jim Pingle
02:13 PM pfSense Packages Bug #11582: FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: fix:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/63 Viktor Gurov
09:25 AM pfSense Packages Bug #11582 (Resolved): FreeRADIUS XML-RPC Sync doesn't sync all configuration sections: Using the XML-RPC Sync feature of the FreeRADIUS package doesn't sync all configuration sections.
For example:
* ... Alexis Mestag
02:45 PM Bug #11581 (Pull Request Review): Cannot configure WAN IP address with ``/32`` CIDR mask via console menu: Jim Pingle
02:03 PM Bug #11581: Cannot configure WAN IP address with ``/32`` CIDR mask via console menu: Allow to enter /32 netmask and non-local gateway in the console menu:
https://gitlab.netgate.com/pfSense/pfSense/-/m... Viktor Gurov
09:21 AM Bug #11581 (Resolved): Cannot configure WAN IP address with ``/32`` CIDR mask via console menu: I logged in via the serial console and used the '2) Set interfaces(s) IP address' flow. That prompts for a WAN IP and... Ken Bass
02:37 PM Feature #11588 (New): Automatically suggest next IP address in Wireguard interface subnet when creating a peer: When creating a new WireGuard peer, we should suggest/pre-fill the AllowedIPs field with the next IP address in the W... Jim Pingle
02:28 PM Bug #11587 (Closed): WireGuard interfaces do not have data on traffic graphs: Moving over from NG 5522
Sending iperf3 traffic across a wireguard interface from a client on the LAN side to a se... Jim Pingle
02:25 PM Bug #11586: WireGuard panic when saving many times in a row: Textdump from one of the occurences Jim Pingle
02:24 PM Bug #11586: WireGuard panic when saving many times in a row: Parts of the backtrace are similar to #11585 but it's not an exact match. Jim Pingle
02:22 PM Bug #11586 (Not a Bug): WireGuard panic when saving many times in a row: Moving this over from NG 5538
There is still a lingering panic in WireGuard when saving on an interface, but it's ... Jim Pingle
02:25 PM Revision 7990de53: route_get() optimization. Fixes #11475: Viktor Gurov
02:24 PM Revision 490b5b48: Set correct DHCP failover peer IP on XMLRPC sync. Fixes #11519: Viktor Gurov
02:23 PM Revision e89e12e8: Move custom IPSEC NAT-T port settings to Advanced Options. Todo #11518: Viktor Gurov
02:23 PM Revision c08d270e: Set explicit-exit-notify to 1 for new OpenVPN Client instances. Implements #11521: Viktor Gurov
02:18 PM Revision 3939c0e3: IPsec Mobile users swanctl.conf fix. Issue #11564: Viktor Gurov
02:17 PM Revision 4a51b9cd: IPsec peer ID Any fix. Issue #11555: Viktor Gurov
02:17 PM Revision f4d883da: Cisco AVPair parse {clientip}. Fixes #11561: Viktor Gurov
02:16 PM Revision 44baf5a7: OpenVPN data-ciphers option length validation. Issue #11559: Viktor Gurov
02:15 PM Revision f725132e: OpenVPN ncp_enable checkbox fix. Issue #11554: Viktor Gurov
02:14 PM Revision a1fe8144: Restart unbound on interface recover. Fixes #11547: Viktor Gurov
02:13 PM Revision cfff0f35: IPsec VTI interfaces bootup fix. Issue #11537: Viktor Gurov
02:10 PM Revision 296c5881: WPA Enterprise PAP inner method support. Issue #2400: Viktor Gurov
02:06 PM pfSense Docs Correction #11584 (Resolved): Renaming Proxmox to Proxmox Virtual Environment or Proxmox VE: Fixed in https://gitlab.netgate.com/docs/pfSense-docs/-/commit/011d1208863cba0531065173fc63e93da09dcb2a Jim Pingle
01:58 PM pfSense Docs Correction #11584 (Resolved): Renaming Proxmox to Proxmox Virtual Environment or Proxmox VE: Received a request from Proxmox Marketing team to ensure we correctly use their mark in the documentation:
> May I... Jim Pingle
02:05 PM Revision 95e599a1: Show changed NAT timeouts on the system_advanced_firewall page. Issue #11565: Viktor Gurov
02:01 PM Revision 0e432655: Merge pull request #4504 from bashkarev/master: Renato Botelho
02:00 PM Revision f7e4e439: Merge pull request #4505 from woeperbe/patch-1: Renato Botelho
01:36 PM pfSense Packages Bug #11580 (Pull Request Review): FTP client proxy - source and destination bypass limitation: Jim Pingle
11:19 AM pfSense Packages Bug #11580: FTP client proxy - source and destination bypass limitation: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/62 Viktor Gurov
04:40 AM pfSense Packages Bug #11580 (Resolved): FTP client proxy - source and destination bypass limitation: Not able to use alias in Proxy Bypass: Source and Proxy Bypass: Destination.
I tried to manually add to config.xml a... Michal Kubin
01:24 PM Feature #7842 (Feedback): New Dynamic DNS Provider: Mythic-Beasts: Ronald Schellberg wrote:
> Viktor Gurov wrote:
> > Applied in changeset commit:fe6b125233f40f5919746b1cb90c39b459aa... Viktor Gurov
01:18 PM Bug #11583: dashboard nginx 504 Gateway time-out error: That could maybe happen with an excessively large log file size (downright huge if it's 59MB _compressed_) but ultima... Jim Pingle
12:26 PM Bug #11583: dashboard nginx 504 Gateway time-out error: I was finally able to login by deleting the filter.log.x.bz2 files in the /var/log directory. There were 6 of them an... Adam Esslinger
12:16 PM Bug #11583: dashboard nginx 504 Gateway time-out error: once I finally got logged in I see this in the system logs:
2021/03/01 13:12:17 [error] 88327#100711: *20 upstream... Adam Esslinger
12:15 PM Bug #11583 (Not a Bug): dashboard nginx 504 Gateway time-out error: There isn't enough information here to point to one specific issue and this site is not for support or diagnostic dis... Jim Pingle
11:59 AM Bug #11583 (Not a Bug): dashboard nginx 504 Gateway time-out error: Ever since upgrading to version 2.5 logging into the firewall takes a really long time. Once logged in and navigatin... Adam Esslinger
01:14 PM Bug #11187: WAN_DHCP6 down, but IPv6 actually works: Does pfSense track the changes to dhcp6c that are being made by Marjohn56 on the opn side? Not sure if this is direct... → luckman212
11:59 AM Revision 7b2bca91: Update services.inc: Corrects the error in the dynamic DNS widget
warning: array_combine(): both parameters should have an equal number of... Marc Buffet
11:22 AM Feature #11577: Syslog should not require binding to interface for remote logging: Ter Ted wrote:
> No, you have to bind to the port in order to receive events, not to send them. This is just a very ... Jim Pingle
11:14 AM Feature #11577: Syslog should not require binding to interface for remote logging: No, you have to bind to the port in order to receive events, not to send them. This is just a very basic concept for ... Ter Ted
07:36 AM Feature #11577 (Rejected): Syslog should not require binding to interface for remote logging: Binding to all interfaces is not binding to a specific interface ("All" is not "specific") and "All" is an option in ... Jim Pingle
10:21 AM pfSense Packages Bug #11575: OpenVPN clients cannot pass traffic when reconnecting using the same source port: adding _nobind_ fixes the problems with viscosity on mac big sur not reconnecting after a disconnect. It continues to... IT Support
09:58 AM Bug #11330: IGMP Proxy upgrade to latest version: I did experience the kernel panic/reboot/kernel panic continuous loop again during 2.5 DEV versions a few weeks ago, ... Patrick Monfette
04:58 AM Bug #11330: IGMP Proxy upgrade to latest version: I think that I am currently having the same issues with igmp proxy since upgrading to pfsense 2.5.0:
2.5.0-RELEASE... simon lock
08:35 AM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Applied in changeset commit:7990de53bfc8267d1dd96636a175929a35cbe664. Viktor Gurov
08:25 AM Regression #11475 (Feedback): Route tables with many entries can lead to PHP errors and timeouts when looking up routes: PR has been merged. Thanks! Renato Botelho
08:30 AM Regression #11519: Incorrect DHCP failover IP address configured on peer after XMLRPC sync: Applied in changeset commit:490b5b480f1b46a6f93e0ba99fff578a61f3293c. Viktor Gurov
08:24 AM Regression #11519 (Feedback): Incorrect DHCP failover IP address configured on peer after XMLRPC sync: PR has been merged. Thanks! Renato Botelho
08:30 AM Feature #11521: Set Explicit Exit Notify to ``1`` by default for new OpenVPN client instances: Applied in changeset commit:c08d270edc1f7439de103a205cd2a4262c3eb22d. Viktor Gurov
08:23 AM Feature #11521 (Feedback): Set Explicit Exit Notify to ``1`` by default for new OpenVPN client instances: PR has been merged. Thanks! Renato Botelho
08:25 AM Regression #11561: ACLs generated from RADIUS reply attributes do not parse ``{clientip}`` macro: Applied in changeset commit:f4d883dadee6e339997b29f5b4623a88b190b840. Viktor Gurov
08:17 AM Regression #11561 (Feedback): ACLs generated from RADIUS reply attributes do not parse ``{clientip}`` macro: PR has been merged. Thanks! Renato Botelho
08:24 AM Todo #11518 (Feedback): Move custom IPsec NAT-T port settings to Advanced Options: PR has been merged. Thanks! Renato Botelho
08:20 AM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: Applied in changeset commit:a1fe814421904ca00b6a04431d62ba18dcebf607. Viktor Gurov
08:14 AM Bug #11547 (Feedback): DNS Resolver does not bind to an interface when it recovers from a down state: PR has been merged. Thanks! Renato Botelho
08:18 AM Regression #11564 (Feedback): strongSwan configuration always contains user EAP/PSK values: PR has been merged. Thanks! Renato Botelho
08:18 AM Regression #11555 (Feedback): IPsec peer ID of "Any" does not generate a proper remote definition or related secrets: PR has been merged. Thanks! Renato Botelho
08:16 AM Bug #11559 (Feedback): OpenVPN does not start with a long list of Data Encryption Algorithms: PR has been merged. Thanks! Renato Botelho
08:16 AM Bug #11554 (Feedback): Selected Data Encryption Algorithms list items reset when an input validation error occurs: PR has been merged. Thanks! Renato Botelho
08:14 AM Regression #11537 (Feedback): IPsec VTI tunnel between IPv6 peers may not configure correctly: PR has been merged. Thanks! Renato Botelho
08:11 AM Feature #2400 (Feedback): GUI options for WPA Enterprise with identity/password: PR has been merged. Thanks! Renato Botelho
08:07 AM Feature #11420 (Feedback): New Dynamic DNS Provider: Gandi LiveDNS IPv6: PR has been merged. Thanks! Renato Botelho
08:02 AM Feature #11420 (Pull Request Review): New Dynamic DNS Provider: Gandi LiveDNS IPv6: New PR to fix syntax error introduced by the previous PR:
https://github.com/pfsense/pfsense/pull/4505 Jim Pingle
08:00 AM Feature #11420: New Dynamic DNS Provider: Gandi LiveDNS IPv6: There is an error introduced by this change and fixed by https://github.com/pfsense/pfsense/pull/4505 Renato Botelho
08:07 AM Regression #11565 (Feedback): Saved state timeout values not loaded into GUI fields on system_advanced_firewall.php: PR has been merged. Thanks! Renato Botelho
08:01 AM Bug #11569 (Feedback): ACLs generated from RADIUS reply attributes have incorrect syntax: PR has been merged. Thanks! Renato Botelho
07:56 AM pfSense Packages Bug #11459 (Feedback): pfBlockerNG doesn't include WireGuard interface in outbound floating rules: PR has been merged. Thanks! Renato Botelho
07:52 AM pfSense Packages Feature #11560 (Feedback): add ena(4) to the list of INLINE mode (netmap) supported cards: PR has been merged. Thanks! Renato Botelho
07:51 AM pfSense Packages Feature #11533 (Feedback): add ena(4) to the list of INLINE mode (netmap) supported cards: PR has been merged to 2.6.0/21.05 snapshots and will be cherry-picked to stable branches together with last binary up... Renato Botelho
07:49 AM Regression #11550: Segmentation fault when loading ALTQ traffic shaping rules using FAIRQ: Have you tried only using FAIRQ instead of only using PRIQ? It's not clear from the symptom behavior if the problem i... Jim Pingle
01:13 AM Regression #11550: Segmentation fault when loading ALTQ traffic shaping rules using FAIRQ: Jim Pingle wrote:
> Not that it should cause a segfault, but why are you mixing FAIRQ, PRIQ, and HFSC?
I used PRI... Thorsten Zitterell
07:48 AM pfSense Packages Bug #11546 (Feedback): incorrect 'set as-path' command: PR has been merged. Thanks! Renato Botelho
07:48 AM pfSense Packages Bug #11517 (Feedback): Zebra Access List Names don't prevent spaces, but a whitespace in the name will stop FRR from starting: PR has been merged. Thanks! Renato Botelho
07:48 AM pfSense Packages Bug #11511 (Feedback): OSPF distribute List always empty: PR has been merged. Thanks! Renato Botelho
07:41 AM Feature #11562: Syslog should not require binding to interface for remote logging: It is true as worded ("Any" is not "a specific interface").
Jim Pingle
12:02 AM Feature #11562: Syslog should not require binding to interface for remote logging: Jim Pingle wrote:
> It's to set the source address of the syslog traffic, not to bind the server. It's necessary for... Ter Ted
07:40 AM pfSense Packages Feature #10858 (Feedback): OpenVPN Client silent install: PR has been merged. Thanks! Renato Botelho
07:40 AM pfSense Packages Feature #11520 (Feedback): Add 'explicit-exit-notify' option by default: PR has been merged. Thanks! Renato Botelho
07:36 AM pfSense Packages Bug #11532 (Feedback): LCDproc service is not disabled: PR has been merged. Thanks! Renato Botelho
07:35 AM pfSense Packages Bug #11515 (Feedback): node_exporter 0.18.1_1 - Unable to interact or start the service from web ui: PR has been merged. Thanks! Renato Botelho
05:46 AM Bug #11464: Requests to ``ews.netgate.com`` do not honor proxy configuration: Steve Beaver wrote:
> Applied in changeset commit:2cb3c56db2366c9cadb04757bd3143ea0d7e7378.
I can confirm that th... Florian Apolloner
03:26 AM pfSense Packages Feature #11579 (New): Snort alerts or blocks trigger notifications: I use the default pfSense notifications under System -> Advanced -> Notifications, and I'd love to be able to receive... Offstage Roller
02:06 AM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: Let me share some of mny observartions in the last 3 days.
* hw.ncpu=unset, all non default Packages diabled = Sta... Marco Goetze

02/28/2021

11:58 PM Feature #11577 (Rejected): Syslog should not require binding to interface for remote logging: As of now, it is not possible to log to remote server without binding syslog to local interface. This shouldn't be re... Ter Ted
11:24 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: UPDATE:
Here is a diff of my changes to /etc/inc/interfaces.inc
Greg Shaffer
08:47 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: I noticed that both /tmp/em0_routerv6 and /tmp/em0_defaultgwv6 were empty while the ipv4 versions had the valid route... Greg Shaffer
02:52 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: If ManagedConfigFlag is set in rtsold, managedconf_script (-M) will execute instead of otherconf_script (-O)
pfsen... Tim Dunn
10:28 AM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Michael Virgilio wrote:
> but routing is working. Without specifying a monitoring address, the status on the dashbo... Steve Y
09:45 PM pfSense Packages Bug #11572: Auto created firewall rules have IPv4 as protocol only - even for IPv6 lists.: Please update to pfBlockerNG-devel, as pfBlockerNG is not receiving many updates. This issue is resolved in devel. BBcan177 .
04:19 AM pfSense Packages Bug #11572 (New): Auto created firewall rules have IPv4 as protocol only - even for IPv6 lists.: Using any IPv6 list in pfblocker-ng "IPv6 settings" tab results in a firewall rule with the protocol set to IPv4. Thi... Dave Tickem
04:17 PM pfSense Packages Bug #11575: OpenVPN clients cannot pass traffic when reconnecting using the same source port: OpenVPN 2.5.1 does not appear to make a difference for this. I built a package for FreeBSD and loaded it, as well as ... Jim Pingle
11:15 AM pfSense Packages Bug #11575 (Resolved): OpenVPN clients cannot pass traffic when reconnecting using the same source port: If an OpenVPN client reconnects immediately after disconnecting, in certain cases it cannot pass traffic.
This app... Jim Pingle
04:13 PM Bug #7801: UDP fragments received over IPsec tunnel are not properly reassembled and forwarded: I hit the same issue with EAP-TLS (Wireless authentication) UDP fragmented packages from AP to NPS (Radius) server no... Rai Wol
11:56 AM Feature #11576 (Closed): IPsec GUI option to control Child SA ``start_action``: Currently we set the child SA start option automatically depending on a few different factors, but it would be nice t... Jim Pingle
11:08 AM pfSense Packages Todo #11574 (Duplicate): Add "nobind" to exported OpenVPN configurations by default: Remote access OpenVPN clients should be using @nobind@ in their configurations so they use a random port and appropri... Jim Pingle
09:23 AM Bug #11541 (New): OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: I can replicate that here now even on Remote Access (not P2P) so it appears to be a limitation in OpenVPN itself when... Jim Pingle
09:10 AM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Not that I'd expect that to cause a problem, but why would you set that to 1? It doesn't make much sense.
If you don... Jim Pingle
03:31 AM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: I've found that if I set the 'Concurrent connections' value to anything greater than 1, my client is now shown in the... Ryan Fitton
09:06 AM pfSense Packages Feature #11573: Custom Commands: That wouldn't be something we'd consider for the base system, but we might consider it if someone wanted to make a pa... Jim Pingle
07:17 AM pfSense Packages Feature #11573 (New): Custom Commands: Ability to store custom commands on pfsense, and able to run them from same page.
For example storing this command... Manjot Singh
06:49 AM Todo #10464: Don't change the current update repo when new releases are available: At least now I can't reproduce the spontaneous upgrade, which is good in this case, I suppose. I'm sorry if I was spr... Christian Ullrich

02/27/2021

09:21 PM Revision 321fbbdb: Fixed bug parsing netmask cisco acl: Dmitry Bashkarev
07:55 PM pfSense Packages Bug #10429: Status Traffic Total broken 2.4.5: The patch provided by me above with the instructions works to fix it on 2.4.5, or, you can also update to 2.5.0 which... Chris R
07:53 PM pfSense Packages Bug #10429: Status Traffic Total broken 2.4.5: hello guys.
has this been fixed in 4.5? Andres Mora
06:38 PM Feature #7842 (New): New Dynamic DNS Provider: Mythic-Beasts: Jim Pingle
06:24 PM Feature #7842: New Dynamic DNS Provider: Mythic-Beasts: Viktor Gurov wrote:
> Applied in changeset commit:fe6b125233f40f5919746b1cb90c39b459aa39fd.
The commit looks righ... Ronald Schellberg
05:00 PM Bug #11571 (Rejected): Spoofing MAC address on a WAN interface causes erratic behaviour when using an L2TP tunnel on the spoofed interface: The details here don't quite line up -- please start a forum thread to discuss and diagnose this problem in more deta... Jim Pingle
04:38 PM Bug #11571 (Rejected): Spoofing MAC address on a WAN interface causes erratic behaviour when using an L2TP tunnel on the spoofed interface: I use an L2TP tunnel by Andrews and Arnolds here in the UK, as allows for access to their network without being a ful... Aman Halai
04:49 PM Regression #11570: Gateway monitoring services is not always restarted on interface events, which may prevent a WAN from recovering back to an online state: I forgot to mention... this does problem only seems to occur when you fail the main by way of unplugging the WAN inte... M L
03:40 PM Regression #11570 (Closed): Gateway monitoring services is not always restarted on interface events, which may prevent a WAN from recovering back to an online state: Good evening. This seems to be a new bug in 2.5, and was not a problem in 2.4. In gateway group configured for main... M L
03:41 PM Regression #11565 (Pull Request Review): Saved state timeout values not loaded into GUI fields on system_advanced_firewall.php: Jim Pingle
09:05 AM Regression #11565: Saved state timeout values not loaded into GUI fields on system_advanced_firewall.php: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/164 Viktor Gurov
08:50 AM Regression #11565 (Closed): Saved state timeout values not loaded into GUI fields on system_advanced_firewall.php: In system -> advanced -> Firewall & NAT
UDP timeouts are not saved. Sometimes after setting, they show up correctl... Viktor Gurov
03:40 PM Regression #11564 (Pull Request Review): strongSwan configuration always contains user EAP/PSK values: The pre-shared key tab entries have uses with site-to-site tunnels they aren't solely for mobile setups.
EAP entri... Jim Pingle
08:37 AM Regression #11564: strongSwan configuration always contains user EAP/PSK values: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/163 Viktor Gurov
08:07 AM Regression #11564 (Closed): strongSwan configuration always contains user EAP/PSK values: /var/etc/ipsec/swanctl.conf always contains users eap/psk keys:... Viktor Gurov
03:31 PM Regression #11555 (Pull Request Review): IPsec peer ID of "Any" does not generate a proper remote definition or related secrets: Jim Pingle
06:39 AM Regression #11555: IPsec peer ID of "Any" does not generate a proper remote definition or related secrets: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/162 Viktor Gurov
03:18 PM Bug #11548 (New): "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: It could be a case where the invalid rule is generated when the interface doesn't have IPv4 configured yet. I thought... Jim Pingle
05:19 AM Bug #11548: "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: still unable to reproduce, works fine for me (pppoe0 is vtnet2 with DHCP6):... Viktor Gurov
03:39 AM Bug #11548: "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: Jonas Libbrecht wrote:
> When I look at the /tmp/rules.debug at this moment. I see the (recreated) rule in question ... Jonas Libbrecht
03:37 AM Bug #11548: "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: When I look at the /tmp/rules.debug at this moment. I see the (recreated) rule in question has been assigned a privat... Jonas Libbrecht
03:24 AM Bug #11548: "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: Jim Pingle wrote:
> It's not the port range or NAT reflection, it's the fact that the rule says @inet6@ and uses an ... Jonas Libbrecht
03:14 PM Bug #11569 (Pull Request Review): ACLs generated from RADIUS reply attributes have incorrect syntax: I thought this got fixed with #10803 but apparently not. Jim Pingle
03:07 PM Bug #11569: ACLs generated from RADIUS reply attributes have incorrect syntax: Ready for review: https://github.com/pfsense/pfsense/pull/4504 Dmitry Bashkarev
02:59 PM Bug #11569 (Resolved): ACLs generated from RADIUS reply attributes have incorrect syntax: FreeRADIUS ACLs:... Dmitry Bashkarev
03:05 PM Feature #11562 (Rejected): Syslog should not require binding to interface for remote logging: It's to set the source address of the syslog traffic, not to bind the server. It's necessary for things like tunnel m... Jim Pingle
03:27 AM Feature #11562 (Rejected): Syslog should not require binding to interface for remote logging: As of now, it is not possible to log to remote server without binding syslog to local interface. This shouldn't be re... Ter Ted
03:02 PM Regression #11561 (Pull Request Review): ACLs generated from RADIUS reply attributes do not parse ``{clientip}`` macro: Jim Pingle
02:00 AM Regression #11561: ACLs generated from RADIUS reply attributes do not parse ``{clientip}`` macro: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/161 Viktor Gurov
01:51 AM Regression #11561 (Closed): ACLs generated from RADIUS reply attributes do not parse ``{clientip}`` macro: Template variable "{clientip}" that is replaced with the connecting clients VPN IP (#9206) is not parsed:... Viktor Gurov
02:53 PM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: I don't see any significant differences in the status output contents other than the TCP version you printed has a lo... Jim Pingle
02:47 PM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Yes, still the same result when the system has had a full reboot.
I've also installed a fresh copy of pfSense 2.5 ... Ryan Fitton
05:33 AM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Ryan Fitton wrote:
> Also, I should mention when running 'nc -U /var/etc/openvpn/server2/sock' in TCP mode; it takes... Viktor Gurov
05:10 AM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Also, I should mention when running 'nc -U /var/etc/openvpn/server2/sock' in TCP mode; it takes up to 1 minute for th... Ryan Fitton
05:07 AM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: I can confirm the system location for this server is, /var/etc/openvpn/server2/. Based on the commands you sent; the ... Ryan Fitton
02:48 PM Bug #11559 (Pull Request Review): OpenVPN does not start with a long list of Data Encryption Algorithms: Jim Pingle
12:20 AM Bug #11559: OpenVPN does not start with a long list of Data Encryption Algorithms: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/160 Viktor Gurov
12:03 AM Bug #11559 (Closed): OpenVPN does not start with a long list of Data Encryption Algorithms: If you select too many data ciphers OpenVPN won't start:... Viktor Gurov
02:45 PM Regression #11550: Segmentation fault when loading ALTQ traffic shaping rules using FAIRQ: Not that it should cause a segfault, but why are you mixing FAIRQ, PRIQ, and HFSC?
Does the crash happen if all yo... Jim Pingle
02:42 PM pfSense Packages Feature #11560 (Pull Request Review): add ena(4) to the list of INLINE mode (netmap) supported cards: Jim Pingle
12:30 AM pfSense Packages Feature #11560: add ena(4) to the list of INLINE mode (netmap) supported cards: https://github.com/pfsense/FreeBSD-ports/pull/1047 Viktor Gurov
12:22 AM pfSense Packages Feature #11560 (Resolved): add ena(4) to the list of INLINE mode (netmap) supported cards: add ena(4) to the list of INLINE mode (netmap) supported cards (pfSense 2.5/21.02)
see https://github.com/pfsense/... Viktor Gurov
02:38 PM Regression #11568 (Resolved): Alias name change is not reflected in firewall rules: Already fixed in NG 5685 and commit:6ecf793e0f4a5c3922c5c00a087a1adea104e50a (master) commit:585e7567d0e308ce440ff1b0... Jim Pingle
02:13 PM Regression #11568 (Resolved): Alias name change is not reflected in firewall rules: To reproduce the issue:
- Create an alias ( ip or port )
- Make a firewall rule containing the alias ( source or ... Vendel Cseh
01:55 PM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Replacing fcgicli with php-cgi works for me as well when using self generated cert, intermediate and root CA with len... Rick Frey
01:34 PM Todo #10464: Don't change the current update repo when new releases are available: [First off: This bug currently has priority "low". I suggest raising it to "RED ALERT!"]
Just a quick update: I wr... Christian Ullrich
12:30 PM pfSense Packages Feature #11567 (New): Email report add a note filed request: I think for the email reports it'd be highly useful to have a note filed added.
Here is a use case:
Say a user ... Yuri Weinstein
10:05 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: Hello team,
Any idea when this will be ported to armv7 arch (Netgate SG-3100)?
https://pkg.freebsd.org/FreeBSD... Tchello Mello
03:37 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: manual installation of the latest BIND version fixes the issue:... Viktor Gurov
10:01 AM Bug #11566 (Resolved): Firewall Maximum Table Entries "default size" is whatever is entered: On at least 2.4.5 and 2.5, Firewall Maximum Table Entries has text "On this system the default size is: 2000000." Wh... Steve Y
09:41 AM Feature #11125 (Resolved): Kernel module for RTL8153 driver: Looks good. Module is present and loads correctly:... Steve Wheeler
07:46 AM Bug #11387 (Resolved): Interfaces page displays MAC Address field for interfaces which do not support L2: Tested on the latest release. It looks fine. Ticket resolved. Danilo Zrenjanin
07:11 AM pfSense Packages Bug #11563 (Confirmed): BIND GUI writes TXT records > 255 characters: System: Netgate SG-3100, 2.4.5_1 (I checked the "git log":https://github.com/pfsense/FreeBSD-ports/commits/6209a37396... Bill McGonigle
06:40 AM Bug #11489 (Resolved): Invalid certificate data can cause a PHP error: Danilo Zrenjanin
06:35 AM Bug #11514 (Resolved): Renewing a self-signed CA or certificate does not update the serial number: Tested on the latest release.
Renewed certificate got a new serial number. It works as expected. Ticket resolved. Danilo Zrenjanin
03:01 AM pfSense Packages Bug #11182: NRPE in HA syncs the bind IP: I can confirm that behaviour as well as 2.4.5p1 and 2.5 Pim Pish
02:23 AM pfSense Packages Feature #10739: Update HAproxy-devel package to 2.2 and HAproxy to 2.0: And another point "Health Check Overhaul - now multiply healtchecks are possible for one backend so changes must be u... DRago_Angel [InV@DER]
02:22 AM pfSense Packages Bug #11491: haproxy-devel v0.62_2 - startup error 'httpchk': Because now correct syntax is another:
https://cbonte.github.io/haproxy-dconv/2.2/configuration.html#4.2-http-check%... DRago_Angel [InV@DER]

02/26/2021

10:52 PM pfSense Packages Bug #11477: FRR does not recognize some BFD options: looks ,FRR 7.5 does not have "default" and "label' options
pfSense.home.arpa(config-bfd-peer)#
detect-multiplie... Alhusein Zawi
05:18 PM Bug #11557: OpenVPN fails in tls-validate after upgrading to PfSense 2.5: It's not the cert subject per se but the underlying issue of the data from OpenVPN not passing through fcgicli to PHP... Jim Pingle
05:02 PM Bug #11557: OpenVPN fails in tls-validate after upgrading to PfSense 2.5: I had the error fixed by setting a fixed "Certificate Depth" (check_depth=2) instead of looping over the sequence. I ... Fold right
01:24 PM Bug #11557 (Duplicate): OpenVPN fails in tls-validate after upgrading to PfSense 2.5: Same root cause as #4521 (and a couple other similar issues that already exist)
Jim Pingle
01:23 PM Bug #11557 (Duplicate): OpenVPN fails in tls-validate after upgrading to PfSense 2.5: If OpenVPN server is configured with a "Certificate Depth" higher than 1, the _/usr/local/sbin/ovpn_auth_verify_ will... Fold right
05:10 PM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Nice! Thank you! Worked for me :)
// RESULT=$(/usr/local/sbin/fcgicli -f /etc/inc/openvpn.tls-verify.php -d "se... Robert Rumold
08:42 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Rick Frey wrote:
> Ran into this issue after updating pfsense (+) to 21.02 so appears problem still exists in latest... Viktor Gurov
03:10 PM Bug #11558 (Duplicate): WireGuard Panic: Same backtrace as #11538 Jim Pingle
02:43 PM Bug #11558 (Duplicate): WireGuard Panic: Hello,
While working today, my router randomly crashed and generated a crash report.
During this crash the web inte... Nick M
01:08 PM pfSense Packages Bug #11546: incorrect 'set as-path' command: No need for that, just pick "Set prepend" in the drop-down instead of "Set". The "Set" option is not in FRR now, but ... Jim Pingle
01:05 PM pfSense Packages Bug #11546: incorrect 'set as-path' command: work around:
- Copy commands: "set as-path 65001"
- add "prepend" : set as-path prepend 65001
- go to Service... Alhusein Zawi
07:33 AM pfSense Packages Bug #11546 (Pull Request Review): incorrect 'set as-path' command: Jim Pingle
12:55 AM pfSense Packages Bug #11546: incorrect 'set as-path' command: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/61 Viktor Gurov
12:18 AM pfSense Packages Bug #11546 (Resolved): incorrect 'set as-path' command: If you create a route map with AS Path Option = Set, an error will occur:... Viktor Gurov
01:05 PM Feature #11556: Kill states using the pre-NAT address: Correcting the category and subject
The ask here is for a way to kill based on the NAT address in the state instea... Jim Pingle
01:01 PM Feature #11556 (Resolved): Kill states using the pre-NAT address: Assume you have an external IP XXX
And an OpenVPN net 192.168.200.0/0
After OpenVPN client connects it gets a... Yuri Weinstein
12:50 PM Bug #9270: "Remove all states to and from the filtered address" does not remove all states: That's a different problem since it's a NAT address and not the final source or destination. Unrelated to this. I'm ... Jim Pingle
12:48 PM Bug #9270: "Remove all states to and from the filtered address" does not remove all states: Not sure if this should be added as a new issue
Assume you have an external IP XXX
And an OpenVPN net 192.168.200... Yuri Weinstein
12:33 PM Regression #11555 (Closed): IPsec peer ID of "Any" does not generate a proper remote definition or related secrets: When a peer identifier is set to "Any" the resulting swanctl.conf @remote@ block does not contain an @id@ line. Accor... Jim Pingle
11:47 AM Bug #11553: Unbound does not restart properly sometimes when DHCP Registration is enabled: Some additional info:
To work around the issue in this case this was reported from, one can do either of the follo... Marcos M
10:26 AM Bug #11553 (Duplicate): Unbound does not restart properly sometimes when DHCP Registration is enabled: Not specific to Plus.
The core of this is already covered by #5413 -- there may be some other Unbound bug beyond t... Jim Pingle
09:17 AM Bug #11553 (Duplicate): Unbound does not restart properly sometimes when DHCP Registration is enabled: Running the latest unbound (1.13.1) with the DHCP Registration setting enabled where DHCP entries get inserted in the... Kris Phillips
11:10 AM pfSense Packages Bug #11375 (New): UPS Type <BLANK> for USB APC: Viktor Gurov
11:07 AM Bug #11554 (Pull Request Review): Selected Data Encryption Algorithms list items reset when an input validation error occurs: Jim Pingle
11:01 AM Bug #11554: Selected Data Encryption Algorithms list items reset when an input validation error occurs: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/159 Viktor Gurov
10:34 AM Bug #11554 (Closed): Selected Data Encryption Algorithms list items reset when an input validation error occurs: How to reproduce:
1) Open OpenVPN instance for editing
2) Make any input error
3) Fix it and save
Now Data Ci... Viktor Gurov
10:57 AM Bug #11552 (Confirmed): Incorrect phase 2 entry removed when deleting multiple items consecutively: Confirmed here.
Test 1:
Made 6 P2 entries: 0 1 2 3 4 5
Deleted "1" P2: 0 2 3 4 5
Deleted "3" P2: 0 2 3 5
T... Jim Pingle
08:40 AM Bug #11552 (Resolved): Incorrect phase 2 entry removed when deleting multiple items consecutively: I had a phase1 entry with 6 phase2 entries. 3 of the phase2 entries were for tunnels to LAN and the other 3 were for... Dave Roberts
10:47 AM Bug #11547 (Pull Request Review): DNS Resolver does not bind to an interface when it recovers from a down state: Jim Pingle
10:02 AM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: rare issue, but could be fixed:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/158 Viktor Gurov
08:05 AM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: Ok thanks. Looks like setting it to "All" works for now. This behavior is new with the latest pfsense update. Never h... Frank Gouton
07:55 AM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: It's not a significant concern or it wouldn't be the default behavior. Both the firewall rules AND unbound ACLs preve... Jim Pingle
07:46 AM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: The option "All" includes the WAN interface too. Wouldn't it be a security risk to open the unbound port on the wan i... Frank Gouton
07:21 AM Bug #11547 (New): DNS Resolver does not bind to an interface when it recovers from a down state: Jim Pingle
07:21 AM Bug #11547 (Not a Bug): DNS Resolver does not bind to an interface when it recovers from a down state: This is very similar to #11087 -- Seems like you have specific interfaces selected for the resolver to use, and unbou... Jim Pingle
12:40 AM Bug #11547: DNS Resolver does not bind to an interface when it recovers from a down state: I'm made a mistake selecting the version. It's the latest stable version 2.5. Can you fix that please? Frank Gouton
12:38 AM Bug #11547 (Closed): DNS Resolver does not bind to an interface when it recovers from a down state: Unbound doesn't open a listening socket for an interface that has no active device. If you connect a device later it ... Frank Gouton
10:46 AM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: There may be some specific value in your OpenVPN status output tripping it up but debugging that is a little trickier... Jim Pingle
10:38 AM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Hello,
Thankyou for both your quick replies.
In regards to your questions:
* "Are there any custom options def... Ryan Fitton
01:14 AM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Unable to reproduce
TCP/UDP modes, Shared Key / SSL/TLS - I can always see the client connection on the Status / Op... Viktor Gurov
10:27 AM Bug #10624: Memory leak in Unbound with Python module and DHCP lease registration active: This would likely be fixed by also solving #5413 since it wouldn't restart in this case. Though the actual memory lea... Jim Pingle
09:33 AM pfSense Packages Feature #9238: Add support for Zerotier: @Netgate - Any chance this could be added to 2.5 ? Corey Boyle
09:07 AM Todo #11426 (Resolved): Deprecate old cryptographic accelerator hardware which is not viable on modern systems: Removed from 2.6.0
pfSense 2.4.5-p1:... Viktor Gurov
08:51 AM pfSense Packages Bug #11551: SG-3100 with pfBlockerNG doesn't pass traffic: Jim Pingle wrote:
> The PHP segfault may be similar to, or the same as, #11466
I definitely agree. Something weir... Bill Meeks
08:28 AM pfSense Packages Bug #11551: SG-3100 with pfBlockerNG doesn't pass traffic: The PHP segfault may be similar to, or the same as, #11466 Jim Pingle
08:15 AM pfSense Packages Bug #11551 (Closed): SG-3100 with pfBlockerNG doesn't pass traffic: SG-3100 appliance doesn't pass traffic on boot and I see error messages in `dmesg`:... Viktor Gurov
08:09 AM Regression #11550: Segmentation fault when loading ALTQ traffic shaping rules using FAIRQ: Jim Pingle wrote:
> Can you attach the config.xml entries for the shaper? It would help to see the queue settings an... Thorsten Zitterell
07:52 AM Regression #11550 (Feedback): Segmentation fault when loading ALTQ traffic shaping rules using FAIRQ: Unlikely that this is specific to Plus.
Can you attach the config.xml entries for the shaper? It would help to see... Jim Pingle
07:31 AM Regression #11550 (Resolved): Segmentation fault when loading ALTQ traffic shaping rules using FAIRQ: I have upgraded from 2.4.5p1 to 21.02/21.02p1 on my SG-4860.
Following traffic shaper rule causes an segmentation ... Thorsten Zitterell
08:01 AM Regression #11537 (Pull Request Review): IPsec VTI tunnel between IPv6 peers may not configure correctly: Jim Pingle
07:50 AM Regression #11537: IPsec VTI tunnel between IPv6 peers may not configure correctly: same issue with IPv4 VTI:... Viktor Gurov
07:48 AM Bug #11549 (Duplicate): DHCP relay not work behind gateway: Duplicate of #11523 Jim Pingle
07:31 AM Bug #11549 (Duplicate): DHCP relay not work behind gateway: Hello,
We have 2 XG-7100 and DHCP relay is working on multiple interfaces. Before upgrade (2.4.5_1), all worked fi... Anonymous
07:47 AM Bug #11548: "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: It's not the port range or NAT reflection, it's the fact that the rule says @inet6@ and uses an IPv6 gateway in reply... Jim Pingle
06:28 AM Bug #11548 (Feedback): "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: Jonas Libbrecht wrote:
> There were error(s) loading the rules: /tmp/rules.debug:245: rule expands to no valid combi... Viktor Gurov
01:49 AM Bug #11548: "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: Reddit post: https://www.reddit.com/r/PFSENSE/comments/loir4n/bug_pfsense_goes_in_denyall_after_upgrade_from/ Jonas Libbrecht
01:48 AM Bug #11548 (Closed): "rule expands to no valid combination" error from port forward automatic rule mixing IPv4 and IPv6 elements: After a upgrade from 2.4.5 (pfsense FE) to 21.02 (the new pfsense+), the router (Netgate SG-4860) goes on all network... Jonas Libbrecht
07:41 AM Regression #11545: Primary interface address is not always used when VIPs are present: Sounds more like a new variation or regression of #3997
Doubtful that this is specific to Plus, so moving to pfSense. Jim Pingle
01:00 AM Regression #11545: Primary interface address is not always used when VIPs are present: Could be the same issue as #5999 (service takes the first IP address on the interface, instead of a non-VIP address) Viktor Gurov
07:36 AM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: Marco Goetze wrote:
> Question: Was 21.02.p1 just a quick fix addind a cpu limit to laoder.conf or was the membar al... Jim Pingle
05:42 AM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: What Viktor mentioned could be a reason. In my tested and still failing SG-3100 it also used the pfBlockerNG-dev pack... Marco Goetze
04:18 AM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: same issue after upgrading to 21.02-p1:... Viktor Gurov
02:41 AM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: After the Problem occurred first time I applied the quick fix setting to 1 CPU in the loader.conf > hw.ncpu=1
Now ... Marco Goetze
05:24 AM Bug #11149: DHCP relay won't start with DHCP server behind gateway: John Cinuy wrote:
> I have the same problem after an upgrade with our XG 7100 with 21.02-RELEASE-p1
> The DHCP ser... Mark Lavrijsen
01:04 AM Bug #11149 (Duplicate): DHCP relay won't start with DHCP server behind gateway: see #11523 Viktor Gurov

02/25/2021

11:32 PM Bug #9643: Limiters do not function properly on 2.5 snapshots: I believe I have the same issue, I just upgraded from 2.4.5 to 2.5.0 and upload queues are empty.
I also use multi-W... Ashus CZ
11:20 PM pfSense Docs Todo #11536: Feedback on Virtual Private Networks — OpenVPN — Controlling Client Parameters via RADIUS: + add info about '{clientip}' template variable (#9206) Viktor Gurov
09:57 AM pfSense Docs Todo #11536 (Closed): Feedback on Virtual Private Networks — OpenVPN — Controlling Client Parameters via RADIUS: *Page:* https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/client-parameters-radius.html
*Feedback:*
Parame... Viktor Gurov
09:20 PM Regression #11545: Primary interface address is not always used when VIPs are present: This appears to be a more general issue that can affect IPSec.
In some situations the interface can start to use a... Steve Wheeler
09:15 PM Regression #11545 (Resolved): Primary interface address is not always used when VIPs are present: If you have IP Aliases on a WAN interface that a Site to Site IPSec tunnel is riding over and upgrade from 2.4.5p1 to... Kris Phillips
08:34 PM Regression #11524: Using SHA1 or SHA256 with AES-NI may fail if AES-NI attempts to accelerate hashing: To addto the above: looks like TAC had one that was Plus 21.02 on an XG-7100 on one side and Azure VPN on the other. ... Chris Linstruth
08:31 PM Regression #11524: Using SHA1 or SHA256 with AES-NI may fail if AES-NI attempts to accelerate hashing: Interesting point to mention related to IPSec: If you lower the subnet size to something like a /30 this issue takes ... Kris Phillips
08:26 PM Regression #11524: Using SHA1 or SHA256 with AES-NI may fail if AES-NI attempts to accelerate hashing: This also affects Site to Site VPN tunnels. Please reference internal ticket 76224 for another example of this bug c... Kris Phillips
07:43 PM Regression #11316: Unbound crashes with signal 11 when reloading: Having segfault crashes on 1.13.1:
https://forum.netgate.com/topic/161372/2-5-0-unbound-1-13-1-exited-on-signal-8-... Christian Borchert
07:04 PM Regression #11316: Unbound crashes with signal 11 when reloading: It is normal for Unbound to restart often when DHCP hostname registration is on. This bug is only for the actual cras... Jim Pingle
07:03 PM Regression #11316: Unbound crashes with signal 11 when reloading: Registered just to add to this as DNS is quite important part of the network and needs to be fixed.
I am too having ... Vaidotas Butkus
04:47 PM Regression #11316: Unbound crashes with signal 11 when reloading: I was seeing unbound simply die about once a day since upgrading to 2.5.0-RELEASE. No info as to why in the service's... Scott B
11:46 AM Regression #11316: Unbound crashes with signal 11 when reloading: No need for that now, it's live in the 21.02 repository now that 21.02-p1 has been released to address SG-3100 stabil... Jim Pingle
10:29 AM Regression #11316: Unbound crashes with signal 11 when reloading: On 21.02, in the meantime, the following will upgrade unbound:... Marcos M
06:50 PM Bug #11542 (Rejected): Openvpn does not work correctly after updating to version 2.5.0: There isn't enough information here to suggest it's a bug in pfSense. Please post on the forum to discuss and diagnos... Jim Pingle
04:37 PM Bug #11542: Openvpn does not work correctly after updating to version 2.5.0: openvpn log in atach itfabrica Tech
04:05 PM Bug #11542 (Rejected): Openvpn does not work correctly after updating to version 2.5.0: Good day!
After updating from version 2.4.5-RELEASE-p1 to version 2.5.0, openvpn does not work correctly.
The first... itfabrica Tech
06:49 PM Bug #11544 (Rejected): DHCP relay won't start after upgrade 21.02: There isn't enough information here to classify it as a bug. Post on the forum to diagnose the issue and ensure it is... Jim Pingle
05:49 PM Bug #11544 (Rejected): DHCP relay won't start after upgrade 21.02: I have a problem after an upgrade with our XG 7100 with 21.02-RELEASE-p1
The DHCP server is in another subnet and th... John Cinuy
06:47 PM Revision 2169112c: Basic fiurewall_NAT MVC conversion: Steve Beaver
06:36 PM Bug #11365: dhcpv6 cannot push ipv6 gateway address: pf2.4.5 setup /48 lan is work, and setup in linux is work too. pf2.5 seems is can't work /48.
bgp can only be bro... yon Liu
12:32 PM Bug #11365 (Not a Bug): dhcpv6 cannot push ipv6 gateway address: You would never use a /48 _on an interface_. You can advertise a /48 in BGP without putting a /48 directly on an inte... Jim Pingle
12:08 PM Bug #11365: dhcpv6 cannot push ipv6 gateway address: RDVD log show not allow use /48 ipv6 in LAN interface, but i running bgp must use /48 or above prefixes in LAN interf... yon Liu
11:57 AM Bug #11365: dhcpv6 cannot push ipv6 gateway address: Jim Pingle wrote:
> I can't reproduce this here. radvd is running, clients on LAN get an IPv6 gateway and full conne... yon Liu
11:46 AM Bug #11365: dhcpv6 cannot push ipv6 gateway address: sometime, my devices get ipv6 getways address, but ipv6 still can't normal go to internet, use traceroute show ipv6... yon Liu
05:45 PM Bug #11149: DHCP relay won't start with DHCP server behind gateway: I have the same problem after an upgrade with our XG 7100 with 21.02-RELEASE-p1
The DHCP server is in another subne... John Cinuy
05:12 PM pfSense Packages Bug #11543 (Duplicate): SquidGuard 1.16.18_15 - returning wrong page: I have configurate squid+ squidguard, with autentication ldap, after Renato fixed problem with ldap filter.
So anoth... Robson Ferreira
04:01 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Another day of frustrating, but ultimately not too productive, testing leads me to conclude this is something with 32... Bill Meeks
08:40 AM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Steve Yates wrote:
> Simply out of curiosity I did a quick search and found this "not a bug" from 2008: https://bugs... Bill Meeks
03:53 PM Bug #11541 (Feedback): OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Last time something like this happened the status output changed formats slightly for one reason or another.
It's ... Jim Pingle
03:44 PM Bug #11541: OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Sorry, mistyped the screenshots.
Screenshot 1: OpenVPN Peer to Peer config settings
Screenshot 2: List of openvpn... Ryan Fitton
03:42 PM Bug #11541 (New): OpenVPN status does not work properly when set to TCP and Concurrent Connections = 1: Since updating from 2.4.5 to 2.5 I am having an issue with OpenVPN when using "Peer to Peer (SSL/TLS)" mode.
Netwo... Ryan Fitton
03:42 PM pfSense Plus Bug #11540 (Not a Bug): Nat not working: There isn't nearly enough information there to classify it as a bug, and this site is not for support or diagnostic d... Jim Pingle
03:29 PM pfSense Plus Bug #11540 (Not a Bug): Nat not working: Hello,
After updating to version 21.02 on SG-4860 nat stopped working.
What can we do to make nat work again?
... Alex Adati
02:30 PM Bug #11539 (Rejected): Mobile IPsec ``split_include`` value of ``0.0.0.0/0`` causes some clients to fail: Currently for mobile IPsec the code sets up @subnet@ and @split_include@ entries for IPv4/IPv6 pools based on the GUI... Jim Pingle
02:07 PM Bug #11482 (Pull Request Review): WireGuard interfaces do not always have proper MTU applied: Jim Pingle
11:16 AM Bug #11482: WireGuard interfaces do not always have proper MTU applied: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/156 Viktor Gurov
01:44 PM Bug #11538 (Closed): WireGuard Panic: A "forum user is hitting a panic on several systems when using WireGuard":https://forum.netgate.com/topic/161378/pfse... Jim Pingle
01:31 PM Regression #11537 (Closed): IPsec VTI tunnel between IPv6 peers may not configure correctly: The error in https://forum.netgate.com/post/965928 implies that an IPsec tunnel using VTI between two IPv6 peers may ... Jim Pingle
12:29 PM pfSense Packages Bug #11501: Daily acme "expiring soon" warnings about a test Let's Encrypt certificate that expired > 300 days ago: You delete the entry from the certificate manager, which is where the warning was generated. Not ACME.
Any further... Jim Pingle
11:40 AM pfSense Packages Bug #11501: Daily acme "expiring soon" warnings about a test Let's Encrypt certificate that expired > 300 days ago: When you said, "Delete it" I thought deleting the acme config in the gui would fix it. But no, I did that and still g... Craig Leres
11:11 AM pfSense Plus Regression #11444 (Resolved): SG-3100 doesn't pass traffic after upgrade to 21.02: Jim Pingle
10:52 AM Feature #11439 (Pull Request Review): IPv6 support in ``easyrule`` CLI script: Viktor Gurov
09:26 AM Regression #11535 (Duplicate): Integer Overflow in Certificate Expiration Dates: Duplicate of #11504 which already has a fix checked in. Jim Pingle
09:17 AM Regression #11535 (Duplicate): Integer Overflow in Certificate Expiration Dates: Certificates with very long expiration times displayed correctly before I upgraded to 21.02. In this version, the da... Russell Selph
08:39 AM pfSense Packages Regression #11534 (New): FreeRADIUS EAP anonymous connection forbidden out-of-tunnel: With an LDAP backend but no SQL backend, the virtual server configuration ends up as follows:... Didier Raboud
07:43 AM Feature #11521 (Pull Request Review): Set Explicit Exit Notify to ``1`` by default for new OpenVPN client instances: Jim Pingle
07:40 AM Feature #2400 (Pull Request Review): GUI options for WPA Enterprise with identity/password: Jim Pingle
07:39 AM pfSense Packages Bug #11532 (Pull Request Review): LCDproc service is not disabled: Jim Pingle
03:04 AM pfSense Packages Bug #11532: LCDproc service is not disabled: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/60 Viktor Gurov
03:02 AM pfSense Packages Bug #11532 (Resolved): LCDproc service is not disabled: LCDproc service is not disabled if you uncheck "Enable LCDproc at startup" checkbox
/usr/local/etc/rc.d/lcdproc.sh i... Viktor Gurov
06:36 AM pfSense Packages Feature #11533: add ena(4) to the list of INLINE mode (netmap) supported cards: https://github.com/pfsense/FreeBSD-ports/pull/1046 Viktor Gurov
03:58 AM pfSense Packages Feature #11533 (Resolved): add ena(4) to the list of INLINE mode (netmap) supported cards: add ena(4) to the list of INLINE mode (netmap) supported cards (pfSense 2.5/21.02)
see https://github.com/pfsense/... Viktor Gurov
04:16 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: related to named ACL
see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980786 Viktor Gurov
04:00 AM pfSense Packages Feature #11531: Show netmap compatible cards in IPS Mode note: + add ena(4) to the list of netmap-compatible cards (#11533) Viktor Gurov
03:13 AM pfSense Packages Feature #11531: Show netmap compatible cards in IPS Mode note: see also #10950 Viktor Gurov
02:51 AM pfSense Packages Feature #11531 (Resolved): Show netmap compatible cards in IPS Mode note: https://www.freebsd.org/cgi/man.cgi?query=netmap&sektion=4 ... Danilo Zrenjanin
02:55 AM pfSense Packages Bug #11529 (Rejected): zeek leaves traces after uninstall: fixed in #11381
now it correctly removes `/usr/local/etc/rc.d/zeek.sh`
see https://github.com/pfsense/FreeBSD-por... Viktor Gurov

02/24/2021

11:46 PM Feature #2400: GUI options for WPA Enterprise with identity/password: Tim Cappalli wrote:
> The PAP inner method is missing from EAP-TTLS in the pull request. PAP and MSCHAPv2 are the tw... Viktor Gurov
08:33 PM Feature #2400: GUI options for WPA Enterprise with identity/password: The PAP inner method is missing from EAP-TTLS in the pull request. PAP and MSCHAPv2 are the two most common inner met... Tim Cappalli
10:35 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Simply out of curiosity I did a quick search and found this "not a bug" from 2008: https://bugs.php.net/bug.php?id=45... Steve Y
09:57 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: *Update on this issue*
The problem is somewhere within the PHP base function _preg_match()_.
Here is a PHP code... Bill Meeks
10:17 PM pfSense Packages Bug #11530 (Closed): ntopng 4.2 needs to be updated to 4.3, Bug when accessing a host for details: On pfsense 2.5, installing ntopng from package manager ntop 0.8.13_9 which is 4.2 version of ntopng, after logging in... Max D
10:11 PM pfSense Packages Bug #11529 (Rejected): zeek leaves traces after uninstall: Running latest 2.5 release of pfsense, I installed zeek to test out, but after removing the package, services still s... Max D
07:23 PM Revision f731957f: Correct location and config for Strict CRLs in IPsec. Fixes #11526: (cherry picked from commit 9a5bde87ce9fd0fad3a7f41750782b2dccce38d8) Jim Pingle
07:23 PM Revision 9a5bde87: Correct location and config for Strict CRLs in IPsec. Fixes #11526: Jim Pingle
06:04 PM Bug #11528 (Duplicate): IPsec tunnel status shows wrong status or hangs or doesn't bring up tunnels: Duplicate of #11435 and/or other existing issues that have already been solved for IPsec. Check the forum, there are ... Jim Pingle
06:01 PM Bug #11528 (Duplicate): IPsec tunnel status shows wrong status or hangs or doesn't bring up tunnels: Hi,
I've updated two pfSense instances so far from 2.4.5 to 2.5.0 and both have exhibited the same issues. The fi... Michael Knowles
05:47 PM Bug #11527 (Rejected): Bugs on pfsense 2.5.0: This site is not for support or diagnostic discussion, please post on the "Netgate Forum":https://forum.netgate.com t... Jim Pingle
05:37 PM Bug #11527 (Rejected): Bugs on pfsense 2.5.0: Good day everyone, so I currently have my pfsense running as an appliance in an old ASUS Laptop I have. It was runnin... Julius Caesar Dumaguing
01:30 PM Regression #11526 (Feedback): Mobile IPsec broken when using strict certificate revocation list checking: Applied in changeset commit:9a5bde87ce9fd0fad3a7f41750782b2dccce38d8. Jim Pingle
01:03 PM Regression #11526: Mobile IPsec broken when using strict certificate revocation list checking: This isn't specific to plus, and is a regression from 2.4.5.
Looks like the "parameter format changed":https://wik... Jim Pingle
12:39 PM Regression #11526 (Closed): Mobile IPsec broken when using strict certificate revocation list checking: Enabling Strict CRL Checking under Advanced Settings in IPSec produces the following error:
"loading connection 'c... Kris Phillips
10:53 AM pfSense Packages Bug #11525 (Closed): pfsense 2.5.0 release version for vlan issue to suricata: I have found that pfsense vlans have issues on suricata after updated to 2.5.0 release in esxi 7.0.1 virtual machine.... Ahmed Mohamed
10:49 AM Bug #4521 (Pull Request Review): OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Jim Pingle
10:05 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/154 Viktor Gurov
10:37 AM Todo #11518 (Pull Request Review): Move custom IPsec NAT-T port settings to Advanced Options: Jim Pingle
04:16 AM Todo #11518: Move custom IPsec NAT-T port settings to Advanced Options: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/152 Viktor Gurov
03:20 AM Todo #11518 (Closed): Move custom IPsec NAT-T port settings to Advanced Options: custom IPsec NAT-T port settings (#10870) are very rarely used and in most cases can only confuse users
better to mo... Viktor Gurov
10:32 AM Regression #11523: Incorrect upstream interface: Feels to me like @guess_interface_from_ip()@ if it keeps using the full routing table would need to be changed so it ... Jim Pingle
09:48 AM Regression #11523: Incorrect upstream interface: Jim Pingle wrote:
> Does the patch from #11519 also solve this? If so, this can be closed and combined with it. Seem... Viktor Gurov
09:40 AM Regression #11523: Incorrect upstream interface: Does the patch from #11519 also solve this? If so, this can be closed and combined with it. Seems like the same root ... Jim Pingle
08:09 AM Regression #11523: Incorrect upstream interface: https://forum.netgate.com/topic/161063/update-to-2-5-0-broke-dhcp-relay Viktor Gurov
08:09 AM Regression #11523 (Duplicate): Incorrect upstream interface: another issue with `guess_interface_from_ip()` (see also #11519):
`services_dhcrelay_configure()` uses `guess_inte... Viktor Gurov
10:29 AM Regression #11519 (Pull Request Review): Incorrect DHCP failover IP address configured on peer after XMLRPC sync: Jim Pingle
04:06 AM Regression #11519: Incorrect DHCP failover IP address configured on peer after XMLRPC sync: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/151 Viktor Gurov
03:44 AM Regression #11519 (Closed): Incorrect DHCP failover IP address configured on peer after XMLRPC sync: `/etc/rc.filter_synchronize` uses `guess_interface_from_ip()` which returns only first (top-down) interface from the ... Viktor Gurov
10:20 AM pfSense Packages Bug #11515 (Pull Request Review): node_exporter 0.18.1_1 - Unable to interact or start the service from web ui: Jim Pingle
12:25 AM pfSense Packages Bug #11515: node_exporter 0.18.1_1 - Unable to interact or start the service from web ui: fix:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/58 Viktor Gurov
10:19 AM pfSense Packages Bug #11517 (Pull Request Review): Zebra Access List Names don't prevent spaces, but a whitespace in the name will stop FRR from starting: Jim Pingle
09:56 AM pfSense Packages Bug #11511 (Pull Request Review): OSPF distribute List always empty: Jim Pingle
09:48 AM pfSense Packages Feature #11520 (Pull Request Review): Add 'explicit-exit-notify' option by default: Jim Pingle
06:50 AM pfSense Packages Feature #11520: Add 'explicit-exit-notify' option by default: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/59 Viktor Gurov
06:04 AM pfSense Packages Feature #11520: Add 'explicit-exit-notify' option by default: Also see:
https://redmine.pfsense.org/issues/9085
Pippin MMD
04:36 AM pfSense Packages Feature #11520 (Resolved): Add 'explicit-exit-notify' option by default: https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html:... Viktor Gurov
09:46 AM Feature #11521: Set Explicit Exit Notify to ``1`` by default for new OpenVPN client instances: We already have a GUI option for this. It only works with UDP, so enabling it unilaterally is not viable. At most we ... Jim Pingle
07:06 AM Feature #11521: Set Explicit Exit Notify to ``1`` by default for new OpenVPN client instances: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/153 Viktor Gurov
07:00 AM Feature #11521 (Resolved): Set Explicit Exit Notify to ``1`` by default for new OpenVPN client instances: https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html:... Viktor Gurov
09:42 AM Regression #11524: Using SHA1 or SHA256 with AES-NI may fail if AES-NI attempts to accelerate hashing: Another potential report at https://forum.netgate.com/topic/161354/ipsec-packet-loss-routing-issue-with-21-02-release... Jim Pingle
08:11 AM Regression #11524: Using SHA1 or SHA256 with AES-NI may fail if AES-NI attempts to accelerate hashing: Specifically, the hardware from the thread above is a Netgate 5100 running pfSense Plus, but this likely affects both... Jim Pingle
08:09 AM Regression #11524 (Closed): Using SHA1 or SHA256 with AES-NI may fail if AES-NI attempts to accelerate hashing: Based on at least one report, it appears AES-NI on Plus 21.02/2.5.0 has an issue with SHA-256 and some clients, notab... Jim Pingle
07:13 AM pfSense Packages Bug #11522 (New): fping6 error: we have a XG7100 (not updated to 2.5) with a running zabbix proxy. Now we discovered many entrys in the logfile with:... Viktor Gurov
02:43 AM Revision a33e8b1c: CaptivePortal: Redirect back to Login Page on Logout: Currently (i.e when a custom logout page is present) when a user clicks on logout , a window with the logout message ... nraven777 consec

02/23/2021

11:50 PM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: Scott Lang, that tracks along the same lines with the issues I was having back in Sep 2020: https://forum.netgate.com... Daniel Gordon
11:37 PM pfSense Packages Bug #11517: Zebra Access List Names don't prevent spaces, but a whitespace in the name will stop FRR from starting: fix:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/57 Viktor Gurov
02:32 PM pfSense Packages Bug #11517 (Resolved): Zebra Access List Names don't prevent spaces, but a whitespace in the name will stop FRR from starting: Services/FRR/Global Settings/Edit/Access Lists allows saving the settings with a whitespace in the name, but this cau... Lennart dV
10:04 PM Revision 3987c45b: Improve CA/Self-Signed serial handling. Fixes #11514: (cherry picked from commit 4aa7c7aefc273464b8e66e6176a860b0246f8ee9) Jim Pingle
10:04 PM Revision 4aa7c7ae: Improve CA/Self-Signed serial handling. Fixes #11514: Jim Pingle
09:25 PM Revision 16c1d390: Try parsing four digit years in cert timestamps. Fixes #11504: (cherry picked from commit bdaa35dcf31def521ba8c60c0aa9c41bf5005311) Jim Pingle
09:24 PM Revision bdaa35dc: Try parsing four digit years in cert timestamps. Fixes #11504: Jim Pingle
09:12 PM Revision ad27159f: Do not deprecate prefix if AdvRASrcAddress is specified, refs: #11103: znerol
08:07 PM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: I also have this issue after upgrading to pfsense 2.5. I've noticed that if you reboot the named process doesn't seem... Stefan Andersson
07:22 PM Revision cb17faca: Improve handling of broken/invalid certs. Fixes #11489: (cherry picked from commit 29804b9e6ff07d0224d9396b063f88f486f0d231) Jim Pingle
07:21 PM Revision 29804b9e: Improve handling of broken/invalid certs. Fixes #11489: Jim Pingle
06:22 PM pfSense Packages Bug #11501: Daily acme "expiring soon" warnings about a test Let's Encrypt certificate that expired > 300 days ago: Jim Pingle wrote:
> Craig Leres wrote:
> > How was I able to go 390+ days before upgrading to 21.02 without getting... Craig Leres
04:10 PM Bug #11514 (Feedback): Renewing a self-signed CA or certificate does not update the serial number: Applied in changeset commit:4aa7c7aefc273464b8e66e6176a860b0246f8ee9. Jim Pingle
12:23 PM Bug #11514 (Closed): Renewing a self-signed CA or certificate does not update the serial number: When renewing a self-signed CA entry or self-signed certificate in the GUI the serial number is not replaced with a n... Jim Pingle
03:35 PM pfSense Plus Regression #11504 (Feedback): CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: Applied in changeset pfsense:commit:bdaa35dcf31def521ba8c60c0aa9c41bf5005311. Jim Pingle
03:26 PM pfSense Plus Regression #11504: CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: When applying the patch for this, you will probably need to apply @cb17faca3b07197db4b1eb1502a876873ddc222c@ first an... Jim Pingle
03:25 PM pfSense Plus Regression #11504: CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: Looks like this is from the @validTo@ date in the parsed details using a four digit date and the code assumed a two d... Jim Pingle
03:25 PM Bug #11489: Invalid certificate data can cause a PHP error: I have applied the patch and the problem is fixed. I have deleted the offending cert. Thanks. Simon Brezovnik
01:30 PM Bug #11489: Invalid certificate data can cause a PHP error: Applied in changeset commit:29804b9e6ff07d0224d9396b063f88f486f0d231. Jim Pingle
01:29 PM Bug #11489: Invalid certificate data can cause a PHP error: You can use the "system patches package":https://docs.netgate.com/pfsense/en/latest/development/system-patches.html t... Jim Pingle
01:25 PM Bug #11489: Invalid certificate data can cause a PHP error: OK, with the cert you sent I can reproduce the error. The problem is that the certificate data in that snippet is cor... Jim Pingle
07:22 AM Bug #11489: Invalid certificate data can cause a PHP error: You can send the certificate to @jimp@ (a.t.) @netgate@ (d|o|t) @com@
Once I can reproduce the problem and work up... Jim Pingle
06:14 AM Bug #11489: Invalid certificate data can cause a PHP error: I get the following error in the GUI with know way to delete the offending cert, screen shot attached. Is reloading t... Simon Brezovnik
06:08 AM Bug #11489: Invalid certificate data can cause a PHP error: I have identified the certificate causing the problem. How would you like me to send it to you? The crt was created i... Simon Brezovnik
03:16 PM Feature #11103: Use virtual link local IP address as RA source address for HA environments: Thanks for merging. I just opened a PR for a small followup:
https://github.com/pfsense/pfsense/pull/4502
Sorry... znerol znerol
03:10 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: *Another Update*
None of the conditions described in this bug report occur on an SG-1100 (64-bit ARM CPU), and nei... Bill Meeks
11:40 AM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Marcos:
-I'm running into difficulty updating my SG-1100 to the latest version. It is still on the 2.4.4 factory i... Bill Meeks
08:07 AM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Thanks for the additional info. I will investigate further. The Signal 10 from the Snort binary I am not really surpr... Bill Meeks
01:21 AM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: The behavior with both Snort and Suricata installed was definitely strange and didn't make sense to me. I did a fresh... Marcos M
02:56 PM Revision 6f84dd13: On save return virtual IP id: Steve Beaver
01:44 PM Revision a397f9a8: Merge pull request #4501 from mschiegl/patch-1: Renato Botelho
01:43 PM Regression #11316: Unbound crashes with signal 11 when reloading: Will the update be made available to 21.02 soon? My 2.5.0 box finds it, but my 21.02 box does not.
Thanks! Tim Gagnon
01:05 PM Bug #11516 (Rejected): pfsync Synchronize Peer IP lost when upgrading from 2.4.5 to 2.5.0: There is not enough information to classify this as a bug. It sounds more like a configuration issue led to that, not... Jim Pingle
01:01 PM Bug #11516 (Rejected): pfsync Synchronize Peer IP lost when upgrading from 2.4.5 to 2.5.0: Having a an HA installation, upgrade the backup node from 2.4.5 to 2.5.0 with no problems, then upgraded the master n... Pablo Trincavelli
12:46 PM Revision 8b424bca: Use set_curlproxy() function for cURL proxy configuration. Issue #11476: Viktor Gurov
12:44 PM Revision c03a2049: IPsec Mobile EAP-RADIUS additional configuration fix. Issue #11447: Viktor Gurov
12:41 PM Revision 969574b6: Put OpenVPN route-nopull option after custom options. Fixes #11448: Viktor Gurov
12:36 PM pfSense Packages Bug #11515 (Feedback): node_exporter 0.18.1_1 - Unable to interact or start the service from web ui: This bug can be reproduced on my Netgate XG-7100 running 21.02-RELEASE
After installing the package for the first... dff dff
12:34 PM pfSense Packages Bug #11513: FFR won't show Access-List on Distribute List (OSPF): Can't access gitlab.netgate.com :/ F. M.
12:21 PM pfSense Packages Bug #11513 (Duplicate): FFR won't show Access-List on Distribute List (OSPF): Duplicate of #11511 Viktor Gurov
12:20 PM pfSense Packages Bug #11513 (Duplicate): FFR won't show Access-List on Distribute List (OSPF): Pfsense 2.5 and FRR 1.1.0_5.
You create an access list and expect to set it on OSPF "Distribute List".
However ... F. M.
12:30 PM Revision 19866d78: System Information widget fix. Issue #11443: Viktor Gurov
12:29 PM Revision 4fef1c10: WireGuard interface friendly description. Fixes #11437: Viktor Gurov
12:29 PM Revision ee712bbb: Allow to use OpenVPN provided DNS servers. Implements #11140: Viktor Gurov
12:27 PM Revision 5f120301: WPA Enterprise (PEAP/TLS/TTLS) client mode. Feature #2400: Viktor Gurov
12:23 PM Bug #11503: Using multiple authentication backends on an OpenVPN server fails: seems related to #9460 Viktor Gurov
12:18 PM pfSense Packages Bug #11511: OSPF distribute List always empty: fix:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/56 Viktor Gurov
12:05 PM pfSense Packages Bug #11511 (Resolved): OSPF distribute List always empty: from https://forum.netgate.com/topic/161176/filter-some-routes:
The GUI does not find the configured ACL Lists any m... Viktor Gurov
12:12 PM Bug #11437 (Waiting on Merge): WireGuard group is not printed in the interface column of the NAT rule list: Jim Pingle
10:20 AM Bug #11437: WireGuard group is not printed in the interface column of the NAT rule list: Hi all,
Patch applied and bug fixed. Marcelo Gondim
06:35 AM Bug #11437: WireGuard group is not printed in the interface column of the NAT rule list: Applied in changeset commit:4fef1c109de562f9f97d7c04d4cf8f0f041811e0. Viktor Gurov
06:30 AM Bug #11437 (Feedback): WireGuard group is not printed in the interface column of the NAT rule list: PR has been merged. Thanks! Renato Botelho
12:08 PM Regression #11512 (Closed): DHCP Leases page and ARP table page fail to load if DNS is not available: From jimp: "Once upon a time it used to test for DNS on those pages and skip it if DNS didn't respond. Maybe that got... Brad Lavis
11:50 AM Regression #11510 (Closed): ARP Table populates hostname values using expired DHCP lease data: Description based on discussion from https://forum.netgate.com/topic/161139/arp-bug-pfsense-2-5-0
In *Diagnostic -... Tomasz K.
10:47 AM pfSense Packages Bug #11509 (Closed): LCD package - not starting at boot - stop and start in Status Window not possible: Hi all,
I'm using pfSense 2.5 on a WatchGuard XTM 510 on which I started using the built in LCD display. Got it work... The Cycler63
08:01 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: Jim Pingle wrote:
> https://docs.netgate.com/pfsense/en/latest/development/system-patches.html
>
> Create an entr... Jason Hodgdon
07:44 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: never mind I figured it out! thx :) Jason Hodgdon
07:40 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: https://docs.netgate.com/pfsense/en/latest/development/system-patches.html
Create an entry for @19866d78540d498f23... Jim Pingle
07:33 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: Renato Botelho wrote:
> Jason Hodgdon wrote:
> > Viktor Gurov wrote:
> > > fix:
> > > https://gitlab.netgate.com/... Jason Hodgdon
07:18 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: Jason Hodgdon wrote:
> Viktor Gurov wrote:
> > fix:
> > https://gitlab.netgate.com/pfSense/pfSense/-/merge_request... Renato Botelho
07:08 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: It's not down, that's our internal development git, not the public one which is on github. Jim Pingle
06:36 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: Viktor Gurov wrote:
> fix:
> https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/141
anyone know why git... Jason Hodgdon
06:30 AM Regression #11443 (Feedback): Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: PR has been merged. Thanks! Renato Botelho
07:45 AM Regression #11500 (Feedback): OpenVPN using the wrong OpenSSL command to list digest algorithms: PR has been merged. Thanks! Renato Botelho
07:42 AM Bug #11505 (Duplicate): PPPoE daemon selects wrong interface: The bug you reference is not fixed -- it's still open in a "New" state and nothing was done yet to correct it.
No ... Jim Pingle
07:26 AM Bug #10465 (Resolved): possible routing performance regression due to non use of ip_tryforward: Yes, this is fixed in 21.02/2.5.0 Jim Pingle
07:25 AM Bug #11506 (Duplicate): traffic graph dont show traffic for Wireguard interface: We're already tracking this internally (NG 5522). See also #11315 Jim Pingle
12:41 AM Bug #11506 (Duplicate): traffic graph dont show traffic for Wireguard interface: The traffic graph don´t register any traffic. The table show traffic correct but nothing in the graph. johan carlsson
06:52 AM pfSense Packages Bug #11477 (Feedback): FRR does not recognize some BFD options: PR has been merged. Thanks! Renato Botelho
06:52 AM pfSense Packages Bug #11392 (Feedback): FRR - Advanced Routing Behavior - Network Import Check: Flag should be reversed: PR has been merged. Thanks! Renato Botelho
06:52 AM pfSense Packages Bug #11445 (Feedback): bgp as-path in wrong position: PR has been merged. Thanks! Renato Botelho
06:50 AM Bug #11448: Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: Applied in changeset commit:969574b6dbb124e98595ca537c0d176d908707d0. Viktor Gurov
06:41 AM Bug #11448 (Feedback): Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: PR has been merged. Thanks! Renato Botelho
06:46 AM Bug #11476 (Feedback): Telegram and Pushover notification API calls do not respect proxy configuration: PR has been merged. Thanks! Renato Botelho
06:44 AM Regression #11447 (Feedback): EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes: PR has been merged. Thanks! Renato Botelho
06:35 AM Feature #11140: Allow the firewall to use DNS servers provided to an OpenVPN client instance: Applied in changeset commit:ee712bbb11bd04d442c545ab151a4df9e083edb6. Viktor Gurov
06:28 AM Feature #11140 (Feedback): Allow the firewall to use DNS servers provided to an OpenVPN client instance: PR has been merged. Thanks! Renato Botelho
06:27 AM Feature #2400 (Feedback): GUI options for WPA Enterprise with identity/password: PR has been merged. Thanks! Renato Botelho
02:58 AM Todo #11508 (Pull Request Review): Update SimplePie to to v1.5.6: Mostly bug and issue fixes, some new features. One micro-performance optimisation.
PR: https://github.com/pfsense/... GChuf 6
02:27 AM Todo #11507 (Resolved): Update font formats to WOFF2: Currently, the web fonts are stored in .ttf format. Since then, woff and woff2 formats have been invented, which don'... GChuf 6

02/22/2021

11:06 PM Bug #10465: possible routing performance regression due to non use of ip_tryforward: The 21.02 / 2.5 Release Notes lists this fix (in the Operating System section):
* Fixed a network performance regres... David Burns
09:49 PM Bug #10465: possible routing performance regression due to non use of ip_tryforward: Is this issue still applicable with 2.5 or should I re-enable ICMP redirect? Kevin Mychal Ong
10:20 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: So to make sure I understand, this only happens on an SG-3100 and you can't reproduce on x86 hardware.
The first t... Bill Meeks
07:04 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: They were not scrubbed. Here are the steps to reproduce it (was not able to reproduce on a x86 system).
Only Snort... Marcos M
06:43 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Marcos Mendoza wrote:
> The ARM patch for snort is still there:
> https://github.com/pfsense/FreeBSD-ports/blob/dev... Bill Meeks
02:08 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: The ARM patch for snort is still there:
https://github.com/pfsense/FreeBSD-ports/blob/devel/security/snort/files/pat... Marcos M
06:56 PM pfSense Packages Bug #9204: ospfd: GRE tunnels became unnumbered since 2.4.4: ...I mean, this is not a proper test, I need to bring up a live tunnel and get some LSAs going first.
But when thi... Firstname Surname
03:56 PM pfSense Packages Bug #9204: ospfd: GRE tunnels became unnumbered since 2.4.4: OK - I just tested that fix.... Firstname Surname
03:37 PM pfSense Packages Bug #9204: ospfd: GRE tunnels became unnumbered since 2.4.4: Typically we would wait until it's in an official release. Jim Pingle
02:37 PM pfSense Packages Bug #9204: ospfd: GRE tunnels became unnumbered since 2.4.4: FRR have been silent, but it looks like the person who raised this has a patch. What's your policy here, do you apply... Firstname Surname
06:50 PM Bug #11505 (Duplicate): PPPoE daemon selects wrong interface: The defect was not properly addressed and assigned leading up to the 2.5.0 release.
The functionality is still bro... Kristopher Kolpin
06:38 PM Bug #9270: "Remove all states to and from the filtered address" does not remove all states: looks great in 2.5.0 thanks a million ! Yuri Weinstein
05:33 PM Revision 00995e1e: Fix a typo.: No functional changes. Luiz Souza
04:52 PM pfSense Plus Regression #11504 (Resolved): CA and certificate validity end dates after 2038 are not handled properly on 32-bit ARM: The expiry date rolls over and is shown as some time in that past. pfSense see it as expired/invalid. See attachment.... Steve Wheeler
04:01 PM Regression #11316: Unbound crashes with signal 11 when reloading: This is now in the 2.5.0 repository. To upgrade manually, run the following from an ssh or console shell prompt (not ... Jim Pingle
10:18 AM Regression #11316: Unbound crashes with signal 11 when reloading: The forum thread linked above has instructions for installing the updated version manually from the snapshot reposito... Jim Pingle
03:51 PM Bug #11503 (New): Using multiple authentication backends on an OpenVPN server fails: We did update our pfSense Cluster to 2.5.0. On our OpenVPN connection we do have multiple backends. Our main one (RAD... Silvano Giacomello
03:45 PM Revision dc572d38: Merge pull request #4491 from dsmackie/issue-9887: Renato Botelho
03:17 PM Bug #11502: WireGuard ``matchaddr failed`` kernel messages in system log: Peter fixed a similar error before the release, this may be similar. Jim Pingle
02:35 PM Bug #11502 (Not a Bug): WireGuard ``matchaddr failed`` kernel messages in system log: When I setup 1 wireguard interface things work normally with 1 peer. Once I add a second peer to the same interface I... Adam Esslinger
02:21 PM Bug #9541: Non-admin user with admin rights is given the wrong URL for the user manager: The code in 2.5.0 is the same as the post-patch code there. Perhaps you accidentally reverted that patch after being ... Jim Pingle
02:13 PM Bug #9541: Non-admin user with admin rights is given the wrong URL for the user manager: Testing this on 2.5.0-RELEASE, it looks like the bug is either still present or there's been a regression—screen capt... Michael Alden
02:16 PM Regression #11442: Distinguished Name (FQDN) IPsec peer identifier type is not formatted properly in ``swanctl.conf`` secrets: Patch 10eb04259fd139c62e08df8de877b71fdd0eedc8 is much appreciated, looking forward to P1 release in order to be able... e 1/1
02:15 PM Bug #9887: Rule separator positions change when deleting multiple rules: Applied in changeset commit:3e7a04be6ce4530bbb37b3c312fd2239a61967db. Dan Mackie
09:45 AM Bug #9887 (Feedback): Rule separator positions change when deleting multiple rules: PR has been merged. Thanks! Renato Botelho
01:32 PM Revision e81512fa: Revert "Welcome pfSense CE 2.5.0-RELEASE-p1": This reverts commit 57296da03385ccdc0d07ac8b6bd8f110f8d0314f. Renato Botelho
01:20 PM Bug #11494: Wireguard interface sends ICMP Redirect when routing between two peers: I was able to confirm that there does not appear to be any rate limiting, the overhead isn't terrible though as the I... Blaine Palmer
11:37 AM Bug #11494: Wireguard interface sends ICMP Redirect when routing between two peers: Another workaround is to do one peer per tunnel and a dynamic routing protocol like BGP, or routes using the remote p... Jim Pingle
11:28 AM Bug #11494: Wireguard interface sends ICMP Redirect when routing between two peers: I've disabled redirect via the sysctl/tunable as suggested already.
Just to clarify this is for every incoming pac... Blaine Palmer
10:21 AM Bug #11494: Wireguard interface sends ICMP Redirect when routing between two peers: This is likely a (mostly?) harmless side effect of how the routes in the routing table are added for WireGuard. Becau... Jim Pingle
01:00 PM pfSense Packages Bug #11501: Daily acme "expiring soon" warnings about a test Let's Encrypt certificate that expired > 300 days ago: Craig Leres wrote:
> How was I able to go 390+ days before upgrading to 21.02 without getting daily expiring message... Jim Pingle
12:40 PM pfSense Packages Bug #11501: Daily acme "expiring soon" warnings about a test Let's Encrypt certificate that expired > 300 days ago: And I should ask is there a way to delete the certificate but keep the test config in case I need to test in the futu... Craig Leres
12:38 PM pfSense Packages Bug #11501: Daily acme "expiring soon" warnings about a test Let's Encrypt certificate that expired > 300 days ago: Jim Pingle wrote:
> Delete it, it's not needed. It's a leftover from previous ACME certificates.
>
> Entries are ... Craig Leres
12:35 PM pfSense Packages Bug #11501 (Not a Bug): Daily acme "expiring soon" warnings about a test Let's Encrypt certificate that expired > 300 days ago: Delete it, it's not needed. It's a leftover from previous ACME certificates.
Entries are never removed automatical... Jim Pingle
12:25 PM pfSense Packages Bug #11501 (Not a Bug): Daily acme "expiring soon" warnings about a test Let's Encrypt certificate that expired > 300 days ago: When I setup acme on my pfsense box I used the same procedure as I would with a FreeBSD host; I created a test cert w... Craig Leres
12:35 PM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Dirk Meyer wrote:
> Renato Botelho wrote:
> > Dirk,
> >
> > Can you try attached patch and let me know if it hel... Renato Botelho
12:26 PM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Renato Botelho wrote:
> Dirk,
>
> Can you try attached patch and let me know if it helps?
The patch looks like... Dirk Meyer
09:36 AM Regression #11475 (In Progress): Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Renato Botelho
09:36 AM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Dirk,
Can you try attached patch and let me know if it helps? Renato Botelho
08:58 AM Regression #11475 (Pull Request Review): Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Jim Pingle
12:33 PM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: Ran into this issue after updating pfsense (+) to 21.02 so appears problem still exists in latest version. Have a se... Rick Frey
10:08 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: That other issue is old/closed, not likely to be the same. Even so, if it came up again, it needs a fresh issue with ... Jim Pingle
12:07 PM pfSense Packages Bug #11490: Service Watchdog - Impacts Reboots and Package Updates: All fair points.
Have run into a couple occasions where something 'died' (such as Snort, Suricata, lldpd, haproxy)... A S
10:11 AM pfSense Packages Bug #11490: Service Watchdog - Impacts Reboots and Package Updates: This is a problem only with the package and also not likely one that will be solvable in an easy way.
The package ... Jim Pingle
11:25 AM Regression #11500 (Pull Request Review): OpenVPN using the wrong OpenSSL command to list digest algorithms: Jim Pingle
11:15 AM Regression #11500 (Closed): OpenVPN using the wrong OpenSSL command to list digest algorithms: At least in OpenSSL version 1.1.1i-freebsd, used by pfsense 2.5, there is no longer a "list-message-digest-algorithms... Markus Schiegl
11:14 AM Revision f37660de: Merge pull request #4500 from bitscher/master: Renato Botelho
11:06 AM Revision 50ae67cd: Merge pull request #4487 from znerol-forks/feature/master/radvd-linklocal-vip: Renato Botelho
10:46 AM Bug #11427 (Duplicate): IPSEC Status page shows Connections twice (connected and disconnected): This has been fixed already, see #11435 Jim Pingle
10:22 AM Bug #11427: IPSEC Status page shows Connections twice (connected and disconnected): We are having the same exact issue and despite I cannot provide any configuration at the moment I can provide some in... Denis Grilli
10:24 AM Regression #11495 (Pull Request Review): NTP widget displays incorrect status: Jim Pingle
10:19 AM pfSense Docs Todo #11499 (Closed): Feedback on Services — DHCPv4 Server: *Page:* https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv4.html
*Feedback:*
For "Failover Peer IP", ... Marcos M
10:12 AM pfSense Packages Feature #11492 (Duplicate): there is an Freebsd version available for a splunk universal forwarder: Duplicate of #7683 Jim Pingle
10:07 AM Bug #11482: WireGuard interfaces do not always have proper MTU applied: If you edit the assigned interface and save/apply, it does get the correct MTU applied. However, if you edit/save the... Jim Pingle
10:07 AM Bug #11484: Adding static routed subnets destroys the route at routing table: Sorry, yes you gave me the missing hint. To reach a static routed subnet via wireguard you just need to add the gatew... Dirk Steingäßer
09:56 AM Bug #11484 (Not a Bug): Adding static routed subnets destroys the route at routing table: By doing that you have added two static routes (since Allowed IPs entries get route table entries), so naturally one ... Jim Pingle
10:00 AM Bug #11489 (Feedback): Invalid certificate data can cause a PHP error: One or more of your certificate entries has an invalid or a date field that cannot be read. The code could handle thi... Jim Pingle
09:53 AM Bug #11481 (Rejected): NAT Reflection does not work when "NAT Reflection mode for port forwards" is set to "pure nat": There isn't nearly enough information here and this site is not for support or diagnostic discussion.
For assistan... Jim Pingle
09:51 AM pfSense Packages Bug #11465 (Pull Request Review): Input validation does not prevent multiple conflicting WireGuard peers on a single tunnel from attempting to act as default route: Jim Pingle
09:47 AM Bug #11480 (Duplicate): mDNS repeater (Avahi) over WireGuard not working at all: This is due to WireGuard on FreeBSD not passing multicast or broadcast traffic. We had an issue open on our internal ... Jim Pingle
09:46 AM Feature #11498 (New): WireGuard does not pass multicast traffic to peer: Moving this over from the internal Redmine (NG 5521)
From reports I've seen on other platforms, WireGuard should b... Jim Pingle
09:42 AM pfSense Packages Bug #11477 (Pull Request Review): FRR does not recognize some BFD options: Jim Pingle
09:40 AM Todo #10464: Don't change the current update repo when new releases are available: > What's keeping the dashboard from discovering new update branches on its own?
There is no mechanism to check it ... Jim Pingle
09:39 AM Bug #11478 (Duplicate): Restoring a backup on 2.4.5-p1 triggers an incomplete upgrade to 2.5.0: At it's core, it's a duplicate of #10464 -- solving that will also solve this. Jim Pingle
09:38 AM pfSense Packages Bug #11392 (Pull Request Review): FRR - Advanced Routing Behavior - Network Import Check: Flag should be reversed: Jim Pingle
09:38 AM pfSense Packages Bug #11445 (Pull Request Review): bgp as-path in wrong position: Jim Pingle
09:36 AM Bug #11476 (Pull Request Review): Telegram and Pushover notification API calls do not respect proxy configuration: Jim Pingle
09:33 AM Regression #11447 (Pull Request Review): EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes: Jim Pingle
08:51 AM Bug #11285: Kernel crash on ALTQ-enabled wg interfaces: That doesn't look like the same issue, the backtrace is a quite a bit different despite both mentioning CBQ. They cou... Jim Pingle
08:50 AM Regression #11470: Panic when using CBQ traffic shaping: That doesn't look like the same issue, the backtrace is a quite a bit different despite both mentioning CBQ. They cou... Jim Pingle
08:45 AM pfSense Docs Correction #11472 (Closed): Typo in https://docs.netgate.com/pfsense/en/latest/vpn/selection.html: Fixed. Just one missing word: "choices" Jim Pingle
08:05 AM Bug #11432: status_dhcp_leases.php doesn't load: We have the same problem after Upgrade to 21.02. A restart of the dhcpd helps for a short while but the problem comes... Christian Naumer
07:55 AM Bug #11497 (Duplicate): Dashboard: CPU Usage Meter Infinite Load: Jim Pingle
05:37 AM Bug #11497: Dashboard: CPU Usage Meter Infinite Load: Constantine Kormashev wrote:
> Probably related to https://redmine.pfsense.org/issues/11443
Can confirm. Re-enabl... Andy Dormire
05:30 AM Bug #11497: Dashboard: CPU Usage Meter Infinite Load: Probably related to https://redmine.pfsense.org/issues/11443 Constantine Kormashev
03:42 AM Bug #11497 (Duplicate): Dashboard: CPU Usage Meter Infinite Load: Howdy!
I worked with Netgate Support (ticket #76291) on an issue with my SG-5100 after upgrading to pfSense Plus 2... Andy Dormire
05:44 AM pfSense Packages Feature #11386 (Feedback): Add WireGuard tunneled networks to vpnaddresses list: PR has been merged. Thanks! Renato Botelho
05:42 AM pfSense Packages Feature #11385 (Feedback): Add WireGuard tunneled networks to vpnaddresses list: PR has been merged. Thanks! Renato Botelho
05:14 AM Feature #11420 (Feedback): New Dynamic DNS Provider: Gandi LiveDNS IPv6: PR has been merged. Thanks! Renato Botelho
05:09 AM Feature #11264 (Pull Request Review): Redirect Captive Portal users to login page after they logout: Renato Botelho
05:07 AM Feature #11103 (Feedback): Use virtual link local IP address as RA source address for HA environments: PR has been merged. Thanks! Renato Botelho
04:40 AM Bug #11483 (Feedback): Installer does not add required module to loader.conf when using ZFS: Fixed by commit de3efe409ae on FreeBSD-src... Renato Botelho
03:23 AM Bug #11483: Installer does not add required module to loader.conf when using ZFS: zfs_load="YES" to /boot/loader.conf workaround seems pretty good. Have one more fixed 21.02 ZFS device. Constantine Kormashev
02:57 AM Bug #10959: Traffic graph stopped on interface used via netmap: Can confirm this same behavior exists with Suricata with netmap enabled as well.
However, it appears to be an issu... Scott Morrison

02/21/2021

10:50 PM Feature #11496 (Resolved): Support for NTP Peer mode: If operating two pfSense machines, both of the same Stratum (for example both with GPS and stratum 1), it would be ni... Christian Borchert
07:49 PM Bug #11483: Installer does not add required module to loader.conf when using ZFS: Did a bit more testing and debugging.
The issue is not related to fstab or the drive order recognition.
The i... Sven Gruenitz
02:35 PM Revision 57296da0: Welcome pfSense CE 2.5.0-RELEASE-p1: Renato Botelho
02:28 PM Revision a97987a5: Non local gateways fix. Issue #11433: (cherry picked from commit 087d28fa3f5cfebfd4af7f4a4479b0fac053e062) Viktor Gurov
01:21 PM Regression #11495: NTP widget displays incorrect status: #3567 regression
fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/150 Viktor Gurov
01:12 PM Regression #11495 (Closed): NTP widget displays incorrect status: https://forum.netgate.com/topic/160971/ntp-status:
On my dashboard GUI, I have a widget for NTP Status displayed. In... Viktor Gurov
12:44 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: I'm also having the same problem. Manually setting the monitor address to the link-local address has worked around th... Nick B
12:29 PM Bug #11494: Wireguard interface sends ICMP Redirect when routing between two peers: One last interesting tidbit, similar assumptions causing issues with p2p interfaces in ipv6 which caused issues for W... Blaine Palmer
12:22 PM Bug #11494: Wireguard interface sends ICMP Redirect when routing between two peers: It would appear this may need to be corrected in the FreeBSD upstream.
Possibly relevant:
https://github.com/free... Blaine Palmer
11:25 AM Bug #11494: Wireguard interface sends ICMP Redirect when routing between two peers: Just for reference, it appears a similar issue was observed early in WireGuard's original development.
https://git... Blaine Palmer
10:45 AM Bug #11494 (Rejected): Wireguard interface sends ICMP Redirect when routing between two peers: When PFSense is used to route traffic between two WireGuard peers, it send ICMP Redirect when both peers are on the s... Blaine Palmer
11:24 AM Regression #11316: Unbound crashes with signal 11 when reloading: Pim Janssen wrote:
> I never had any problem with the core system of pfSense on production. Today my unbound died. (... Renato Botelho
10:57 AM Regression #11316: Unbound crashes with signal 11 when reloading: I never had any problem with the core system of pfSense on production. Today my unbound died. (about 5 hours after up... Pim Janssen
08:27 AM Regression #11316 (Feedback): Unbound crashes with signal 11 when reloading: Renato Botelho
08:27 AM Regression #11316: Unbound crashes with signal 11 when reloading: 1.13.1 cherry-picked to 2.5.0 branch Renato Botelho
09:31 AM Bug #11453: ``wpa_supplicant`` uses 100% of a CPU core at boot: Jordan Greene wrote:
> I'm using this currently as well but have not encountered any issues with CPU usage on 21.02 ... Matt Johnson
12:10 AM Bug #11453: ``wpa_supplicant`` uses 100% of a CPU core at boot: Jordan Greene wrote:
> I'm using this currently as well but have not encountered any issues with CPU usage on 21.02 ... Hayden Hill
08:28 AM Regression #11433 (Feedback): Gateways with "Use non-local gateway" set are not added to routing table: Cherry picked to 2.5.0 Renato Botelho
05:31 AM pfSense Packages Bug #11493 (New): After upgrade zabbix proxy wont start: Due to database changes between zabbix-proxy versions. The proxy database needs to be removed after upgrading else th... Pim Janssen
03:37 AM Bug #11485 (Duplicate): Second WAN DHCPv6 does affect the first WAN DHCPv6 to not work: duplicate of #6880 Viktor Gurov
01:08 AM Bug #11485: Second WAN DHCPv6 does affect the first WAN DHCPv6 to not work: For sure no. There where too many bugs with IPv6 in general in the past on the WAN side. But with 2.5.0 a lot of them... Dirk Steingäßer
12:12 AM Bug #11485: Second WAN DHCPv6 does affect the first WAN DHCPv6 to not work: Dirk Steingäßer wrote:
> Adding a second DHCPv6 WAN affect the first DHCPv6 WAN to not work anymore. It just stays o... Hayden Hill
03:08 AM pfSense Packages Feature #11492 (Duplicate): there is an Freebsd version available for a splunk universal forwarder: Splunk is great log analyzer. As well there is a free version available.
I my opinion it might be a good idea to u... thiamata thiamata
03:01 AM Feature #11228 (Resolved): Replace HTTP links with HTTPS in the GUI: Viktor Gurov
01:19 AM Bug #9460: OpenVPN local auth failing due to fcgicli output: similar issue: #4521 Viktor Gurov
12:02 AM Bug #9460: OpenVPN local auth failing due to fcgicli output: I am also having the same issue using "Local Database".
The error in the OpenVPN server log is "Connection reset, ... Elon l
01:18 AM pfSense Packages Bug #11491 (Feedback): haproxy-devel v0.62_2 - startup error 'httpchk': Seeing this error message upon startup (under 2.5.0):
haproxy: startup error output!: [WARNING] 051/015053 (57019)... A S
01:18 AM Bug #4521: OpenVPN authentication and certificate validation fail due to size of data passed through ``fcgicli``: another php-cgi issue: #9460 Viktor Gurov
01:11 AM pfSense Packages Bug #11490 (New): Service Watchdog - Impacts Reboots and Package Updates: All - wasn't quite sure which to attribute this to as its a package, but is impacting standard operation.
Synopsis... A S

02/20/2021

11:06 PM Bug #11489 (Resolved): Invalid certificate data can cause a PHP error: I get the following message on the main admin page.
pfSense has detected a crash report or programming bug. Click ... Simon Brezovnik
10:28 PM Revision 2fe5cc52: Don't add empty pools line. Fixes #11488: (cherry picked from commit bb3a6eb44958841df4257ae7936e6714d1ed99a8) Jim Pingle
10:28 PM Revision bb3a6eb4: Don't add empty pools line. Fixes #11488: Jim Pingle
10:20 PM Revision afffe759: Fix child SA name generation. Fixes #11487: (cherry picked from commit eb5bd64face47422285cb883ad44fc5d77c361fa) Jim Pingle
10:20 PM Revision eb5bd64f: Fix child SA name generation. Fixes #11487: Jim Pingle
10:18 PM Revision ded7970b: Fix IPsec connect/disconnect for all tunnels. Fixes #11486: (cherry picked from commit 50c2b3f9586090593bf45a7c5c6d5873f7fd4cdf) Jim Pingle
10:16 PM Revision 50c2b3f9: Fix IPsec connect/disconnect for all tunnels. Fixes #11486: Jim Pingle
09:18 PM Bug #11453: ``wpa_supplicant`` uses 100% of a CPU core at boot: I'm using this currently as well but have not encountered any issues with CPU usage on 21.02 --- additional informati... Jordan G
08:28 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Scott Long wrote:
> I don't think that this is related to https://redmine.pfsense.org/issues/11444.
I agree. The ... Bill Meeks
05:57 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: I don't think that this is related to https://redmine.pfsense.org/issues/11444. Scott Long
07:39 PM Bug #11483: Installer does not add required module to loader.conf when using ZFS: I am also running into this with the 21.02 recovery image on the SG-5100.
No issue with prior builds and no issue wh... Sven Gruenitz
12:49 PM Bug #11483: Installer does not add required module to loader.conf when using ZFS: I ran into this.. Trying to switch sg-4860 8GB/32GB eMMC model from UFS to ZFS doing clean install from USB boot.. JohnPoz _
12:46 PM Bug #11483: Installer does not add required module to loader.conf when using ZFS: The ZFS case fails in the same way whether installing to eMMC or mSATA.
See also: https://redmine.pfsense.org/issues... Steve Wheeler
12:44 PM Bug #11483 (Resolved): Installer does not add required module to loader.conf when using ZFS: The ADI installer image correctly installs to eMMC or mSATA creating a bootable install on RCC-VE with the default in... Steve Wheeler
06:43 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Same issues as noted above.
I was able to get IP6 working after configuring IP6 gateway monitoring to IP6 addres... Pete C
05:59 PM pfSense Plus Regression #11444 (In Progress): SG-3100 doesn't pass traffic after upgrade to 21.02: Scott Long
05:56 PM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: There is a fix that passes my testing here:
https://reviews.freebsd.org/D28821
The above patch is for FreeBSD H... Scott Long
05:54 PM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: I am facing the same problem at OVH. After the migration some pfSense stopped the gateway.
I found it strange beca... Tácio Andrade
04:35 PM Bug #11488 (Feedback): IPsec tunnel definitions have ``pools =`` entry in ``swanctl.conf`` with no value: Applied in changeset commit:bb3a6eb44958841df4257ae7936e6714d1ed99a8. Jim Pingle
04:26 PM Bug #11488 (Closed): IPsec tunnel definitions have ``pools =`` entry in ``swanctl.conf`` with no value: Some IPsec connections have "pools =" with no value. The line should be omitted in this case rather than being presen... Jim Pingle
04:30 PM Regression #11487 (Feedback): IPsec tunnels using expanded IKE connection numbers do not have proper child SA names in ``swanctl.conf``: Applied in changeset commit:eb5bd64face47422285cb883ad44fc5d77c361fa. Jim Pingle
04:10 PM Regression #11487 (Closed): IPsec tunnels using expanded IKE connection numbers do not have proper child SA names in ``swanctl.conf``: Tunnels with expanded IKE connection numbers (e.g. "con100000") are not forming proper child SA con numbers. The nume... Jim Pingle
04:25 PM Regression #11486 (Feedback): Connect and disconnect buttons on the IPsec status page do not work for all tunnels: Applied in changeset commit:50c2b3f9586090593bf45a7c5c6d5873f7fd4cdf. Jim Pingle
04:07 PM Regression #11486 (Closed): Connect and disconnect buttons on the IPsec status page do not work for all tunnels: The connect and disconnect buttons on IPsec status are not working for all tunnels. When they don't work, there appea... Jim Pingle
04:23 PM Regression #11455 (Not a Bug): The ipsec configuration migrated from 2.4.x to 2.5 fails in certain cases.: There is no problem with having 0 for those. It will still work properly and assume sane defaults as if they are blan... Jim Pingle
04:05 PM Bug #11485 (Duplicate): Second WAN DHCPv6 does affect the first WAN DHCPv6 to not work: Adding a second DHCPv6 WAN affect the first DHCPv6 WAN to not work anymore. It just stays on "pending" and does not r... Dirk Steingäßer
04:00 PM Bug #11484 (Not a Bug): Adding static routed subnets destroys the route at routing table: Adding static routed subnets to wireguard allowed subnets destroys the static route.
The subnet is then just added... Dirk Steingäßer
12:33 PM pfSense Packages Bug #8466 (Resolved): radiusd crash: Tested on the latest release.
It works as expected. Ticket resolved. Danilo Zrenjanin
12:18 PM Bug #11482 (Closed): WireGuard interfaces do not always have proper MTU applied: When you set the mtu of an assigned wg interface, that value is not honoured. The mtu of the interface is always 142... Derek Battams
11:44 AM Bug #11481 (Closed): NAT Reflection does not work when "NAT Reflection mode for port forwards" is set to "pure nat": Description:
i notice that when using nat+proxy then nat reflection works but when using pure nat then it does not. ... aniel arias
11:03 AM Feature #11228: Replace HTTP links with HTTPS in the GUI: Checked in:
2.6.0-DEVELOPMENT (amd64)
built on Sat Feb 20 01:03:44 EST 2021
FreeBSD 12.2-STABLE
These which a... Max Leighton
10:56 AM pfSense Packages Bug #11465: Input validation does not prevent multiple conflicting WireGuard peers on a single tunnel from attempting to act as default route: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/149 Viktor Gurov
10:06 AM Feature #11390 (Resolved): Copy button for Authentication Server entries: Tested in
2.6.0-DEVELOPMENT (amd64)
built on Sat Feb 20 01:03:44 EST 2021
FreeBSD 12.2-STABLE
It works well.... Max Leighton
09:35 AM Bug #11464: Requests to ``ews.netgate.com`` do not honor proxy configuration: Thank you for the quick turnaround Steve; I'll be back in office starting February and will verify it then. Florian Apolloner
07:48 AM Bug #9460: OpenVPN local auth failing due to fcgicli output: Aurelian Rau wrote:
> Hello, as Joakim Gilje mentioned, this issue is still present in the release version of pfSens... Viktor Gurov
06:23 AM Bug #9460: OpenVPN local auth failing due to fcgicli output: Hello, as Joakim Gilje mentioned, this issue is still present in the release version of pfSense 2.5. We had our OpenV... Aurelian Rau
06:04 AM Bug #11480 (Duplicate): mDNS repeater (Avahi) over WireGuard not working at all: Hi,
I've been enjoying WireGuard so far with the nightly builds of pfSense 2.5 and am happy to see the full releas... Michael .
05:57 AM pfSense Packages Bug #11477: FRR does not recognize some BFD options: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/55 Viktor Gurov
04:20 AM pfSense Packages Bug #11477 (Feedback): FRR does not recognize some BFD options: BFD daemon failed to start due to using incorrect command syntax:... Viktor Gurov
05:55 AM Revision bd5d33d8: Fix openssl digest algorithm param in openvpn.inc: At least in OpenSSL 1.1.1i-freebsd, used by pfsense 2.5, there is no longer a "list-message-digest-algorithms" parame... mschiegl
05:53 AM pfSense Packages Bug #11479 (New): snmptt 1.4.2 does not work in daemon mode: There is a bug in snmptt 1.4.2 that prevents it from starting up in daemon mode.
Upstream bug report: https://sour... Christian Ullrich
05:45 AM Todo #10464: Don't change the current update repo when new releases are available: > If you don't automatically offer the upgrade then the update check on the dashboard and so on is not useful.
Why... Christian Ullrich
05:26 AM Bug #11478 (Duplicate): Restoring a backup on 2.4.5-p1 triggers an incomplete upgrade to 2.5.0: After running in to some regressions on 2.5.0 covered by other bugs on the tracker, I decided to re-install pfSense 2... King J
03:05 AM pfSense Packages Bug #11392: FRR - Advanced Routing Behavior - Network Import Check: Flag should be reversed: add "no bgp network import-check" if unchecked:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/54 Viktor Gurov
02:41 AM Bug #11476: Telegram and Pushover notification API calls do not respect proxy configuration: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/148 Viktor Gurov
02:12 AM Bug #11476 (Closed): Telegram and Pushover notification API calls do not respect proxy configuration: Telegram and Pushover notifications ingore proxy configuration on "System -> Advanced -> Miscellaneous"
see also #... Viktor Gurov
01:13 AM Regression #11447: EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/147 Viktor Gurov
12:34 AM Regression #11475: Route tables with many entries can lead to PHP errors and timeouts when looking up routes: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/146 Viktor Gurov

02/19/2021

11:44 PM Regression #11475 (Closed): Route tables with many entries can lead to PHP errors and timeouts when looking up routes: Pfsense with FFR crashes in the web interface after update from 2.4.5-p1 to Pfsense 2.5.0
Right after update the d... Dirk Meyer
11:09 PM Bug #11285: Kernel crash on ALTQ-enabled wg interfaces: seems related to #11470 Viktor Gurov
11:08 PM Regression #11470: Panic when using CBQ traffic shaping: same issue: #11285 Viktor Gurov
02:05 PM Regression #11470 (Resolved): Panic when using CBQ traffic shaping: A couple users have reported a panic when using CBQ traffic shaping. It may also require using CBQ on VLAN interfaces... Jim Pingle
10:42 PM Bug #11474 (Resolved): Broken help link on IPsec Advanced Settings tab: Already fixed in commit:0a73926193d7d344b28d68a94e2f8bf2009ca119 Jim Pingle
08:51 PM Bug #11474 (Resolved): Broken help link on IPsec Advanced Settings tab: when I am in VPN>IPsec>Advanced Settings and click for help "?" it takes me to wrong URLs
2.5.0-RELEASE (amd64)
... Alhusein Zawi
09:00 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: As noted in the thread now, this also affects firewall rules that make use of the Gateway option. Because the IPv6 ga... Anonymous
07:08 AM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: something wrong with @/var/etc/rtsold_{realif}_script.sh@ -
it saves empty @/tmp/{realif}_routerv6@ and @/tmp/{reali... Viktor Gurov
01:26 AM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Same here after update from 2.4.5_1 to 2.5.0. IPv6 is working but Gateway only shows "~" and there is no IPv6 Gateway... Car F
08:12 PM Bug #11473 (New): System Activity shows invalid data on SG-3100: On the SG-3100 the first output from 'top -aSH' shows invalid data for system idle usage.
Subsequent output is corre... Steve Wheeler
07:37 PM Revision 585e7567: Fix alias renaming issue: Steve Beaver
06:54 PM pfSense Docs Correction #11399: SG-3100 M.2 Installation Guide Reinstall Corrections: Marcos Mendoza wrote:
> 1. I believe "run recovery" wipes emmc, so separate instructions here may not be needed.
> ... Kris Phillips
06:24 PM Revision 6ecf793e: Fixed #5685 - Renaming alias does not update firewall rules containg that alias: Steve Beaver
04:16 PM pfSense Docs Correction #11472 (Closed): Typo in https://docs.netgate.com/pfsense/en/latest/vpn/selection.html: One or more words are missing at the beginning of the section on "Choosing a VPN solution -> Interoperability":
To... Susan Kleinmann
03:52 PM Bug #11453: ``wpa_supplicant`` uses 100% of a CPU core at boot: Hayden Hill wrote:
> I am also having this issue. Started with 21.02 (2.5)
>
> Matt Johnson wrote:
> > https://g... Greg Revelle
03:46 PM Bug #11187: WAN_DHCP6 down, but IPv6 actually works: Still present on 2.5.0
Aforementioned error message is unrelated, happens even when all gateways are "online", wil... Aleksandr Mezin
03:36 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: The Signal 10 error occurs when an executable attempts to access a memory address on a non-word aligned boundary in A... Bill Meeks
03:19 PM pfSense Plus Bug #11466: PHP exits with signal 11 on SG-3100 when calling PCRE functions: Marcos Mendoza wrote:
> After installing Snort and starting the service on an interface, fails to start and the foll... Michael Spears
12:02 PM pfSense Plus Bug #11466 (Closed): PHP exits with signal 11 on SG-3100 when calling PCRE functions: After installing Snort and starting the service on an interface, fails to start and the following is reported on the ... Marcos M
03:28 PM Regression #11447: EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes: As a workaround, define a pool network. Clients will still pull their assigned addresses from RADIUS and the other se... Jim Pingle
03:19 PM Revision 2cb3c56d: Fixed #11464 by adding proxy configuration to web service calls: Steve Beaver
03:09 PM Bug #11463: Requirements for trusted certificates: The issue that most people will not see even that it changes color to yellow as change cert type much lower then vali... DRago_Angel [InV@DER]
08:10 AM Bug #11463 (Rejected): Requirements for trusted certificates: From the notes and commits on #9825 you can already see we lowered things to 398 days later in the issue, it did not ... Jim Pingle
07:59 AM Bug #11463: Requirements for trusted certificates: Oh, text says correctly: Server certificates should not have a lifetime over 398 days or some platforms may consider ... DRago_Angel [InV@DER]
07:47 AM Bug #11463 (Rejected): Requirements for trusted certificates: 1. Based on https://redmine.pfsense.org/issues/9825 must set validity time to 825 days for new SSL certs, but on 2.4.... DRago_Angel [InV@DER]
03:04 PM pfSense Packages Bug #11468: pfsense+ 21.02 missing zabbix44 package: Hi Jim, ok, thank you for reply DRago_Angel [InV@DER]
01:58 PM pfSense Packages Bug #11468 (Rejected): pfsense+ 21.02 missing zabbix44 package: It's expected, they are EOL and gone from ports so we have no way to keep them.... Jim Pingle
01:49 PM pfSense Packages Bug #11468 (Rejected): pfsense+ 21.02 missing zabbix44 package: Hi, after update to pfsense+ 21.02 my zabbix was been removed, I checked and installed 4.0, but my server is 4.4 so p... DRago_Angel [InV@DER]
02:52 PM pfSense Docs Correction #11471 (New): Inconsistencies in Developing Packages document (``config_file``/``configurationfile``): *Page:* https://docs.netgate.com/pfsense/en/latest/development/develop-packages.html
*Feedback:*
It seems like ... Andreas Lindhé
01:59 PM Bug #11469 (Duplicate): Pfsense 2.5.0 not working with Generation 2 Hyper-V VM: Already tracked at #10671 Jim Pingle
01:54 PM Bug #11469 (Duplicate): Pfsense 2.5.0 not working with Generation 2 Hyper-V VM: First Scenario
When I create a Hyper-V VM selecting generation 2 as the hardware, pfsense will install but after ins... Adam Esslinger
01:55 PM Bug #11467 (Rejected): RTSP issue: There isn't nearly enough detail here for a bug report, and this site is not for support or diagnostic discussion.
... Jim Pingle
12:13 PM Bug #11467 (Rejected): RTSP issue: I upgraded from 2.4.5 to 2.5 yesterday and since i can no longer see my video stream (Sounds still works but its supe... Antony Cossette
11:47 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: Thats running pfsense 2.5 upgraded from 2.4.5-p1 Wayne Graves
11:46 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: I'm using a Supermicro SuperServer E200-8D - Mini-1U - Xeon D-1528 1.9 GHz 32g ecc 500g ssd NMVe. A clean bind instal... Wayne Graves
10:41 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: I'll remove all the files tonight and then try it again with clean files.
It's running on a Netgate SG-3100
***... Tchello Mello
10:37 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: same issue with a clean BIND install?
pfSense Plus 21.02 or pfSense 2.5?
what kind of appliance? VM, Netgate applia... Viktor Gurov
09:10 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: -I'm going to check how can I install strace on this box to see if I can further debug it.
Used `truss` however, ... Tchello Mello
05:32 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: Wayne Graves wrote:
> unbound not running when this occurred on my pfsense 2.5.
Yea, ignore my comment (I deleted... Chris R
05:20 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: unbound not running when this occurred on my pfsense 2.5. Wayne Graves
04:20 AM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: can be related to #7271 Viktor Gurov
10:25 AM Todo #10464: Don't change the current update repo when new releases are available: If you don't automatically offer the upgrade then the update check on the dashboard and so on is not useful. The fire... Jim Pingle
09:35 AM Todo #10464: Don't change the current update repo when new releases are available: I think this is the wrong approach. Rather than preventing package updates if a pfSense version upgrade is pending, t... Christian Ullrich
09:40 AM Bug #11457: Client DNS doesn't resolve when using VIP in place of interface IP: After working on the forum thread, this is due to the "Enable SSL/TLS Service" setting which requires unbound have @i... Jim Pingle
08:44 AM Bug #11457 (Rejected): Client DNS doesn't resolve when using VIP in place of interface IP: "All" works fine for me here in an HA setup with CARP. Clients query the CARP VIP and receive responses from the CARP... Jim Pingle
08:23 AM Bug #11457: Client DNS doesn't resolve when using VIP in place of interface IP: The bug is the "All" Network Interface isn't including VIPs. If I manually select all of the network interfaces (exc... Travis McMurry
12:00 AM Bug #11457: Client DNS doesn't resolve when using VIP in place of interface IP: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/142 Viktor Gurov
09:25 AM Bug #11464: Requests to ``ews.netgate.com`` do not honor proxy configuration: Applied in changeset commit:2cb3c56db2366c9cadb04757bd3143ea0d7e7378. Anonymous
09:20 AM Bug #11464 (Feedback): Requests to ``ews.netgate.com`` do not honor proxy configuration: Fixed by adding proxy configuration to web service calls. Thanks! Anonymous
07:53 AM Bug #11464 (Resolved): Requests to ``ews.netgate.com`` do not honor proxy configuration: Our firewall rejects requests to ews.netgate.com, and we have configured a proxy in pfsense via "System -> Advanced -... Florian Apolloner
09:09 AM Bug #11462: Nested alias is not working on version 2.5.0: Really sorry, I have cleaned up my browser cache and it worked again.
Sorry about the inconvenience. Thiago Augusto Koroll
08:59 AM Bug #11462 (Rejected): Nested alias is not working on version 2.5.0: I can't reproduce the problem as stated even using your exact inputs. Either there is some missing factor not visible... Jim Pingle
07:05 AM Bug #11462 (Rejected): Nested alias is not working on version 2.5.0: Hi,
I just upgraded my pfSense from 2.4.5 to version 2.5.0 and I cannot edit or create nested alias.
I am getti... Thiago Augusto Koroll
08:11 AM Bug #11458 (Duplicate): Dashboard - Obtaining update status - forever: Yes, it is a duplicate of #11443 Jim Pingle
07:44 AM Bug #11458: Dashboard - Obtaining update status - forever: I believe this is a duplicate of #11443, which presents a workaround for this issue. Jove Too
02:50 AM Bug #11458: Dashboard - Obtaining update status - forever: This is Only happening on the dashboard
Obtaining update status never completes
going to system->update status retr... Jason Hodgdon
01:38 AM Bug #11458 (Duplicate): Dashboard - Obtaining update status - forever: This is Only happening on the dashboard
Obtaining update status never completes
going to system->update status retr... Jason Hodgdon
08:10 AM Todo #11426 (Feedback): Deprecate old cryptographic accelerator hardware which is not viable on modern systems: The support for the old hardware was removed from kernel and from the GUI. Luiz Souza
08:03 AM Bug #11437: WireGuard group is not printed in the interface column of the NAT rule list: The PR is still pending so there isn't anything to try yet. Once it's committed and this issue is in a Feedback state... Jim Pingle
06:04 AM Bug #11437: WireGuard group is not printed in the interface column of the NAT rule list: Hi all,
Do you need me to do some test here by my side? If you need, just say. Marcelo Gondim
08:01 AM Bug #11460: Adding a second peer results in Cannot allocate memory: Added new issue to create input validation which will protect against this misconfiguration: #11465 Jim Pingle
07:56 AM Bug #11460 (Rejected): Adding a second peer results in Cannot allocate memory: You cannot have multiple peers with "0.0.0.0/0" as AllowedIPs. It's an invalid configuration, WireGuard has no way to... Jim Pingle
04:14 AM Bug #11460 (Rejected): Adding a second peer results in Cannot allocate memory: One peer configured on my wg1 tunnel works fine:... pierre gleich
08:01 AM pfSense Packages Bug #11465 (Closed): Input validation does not prevent multiple conflicting WireGuard peers on a single tunnel from attempting to act as default route: WireGuard uses Allowed IPs for internal routing to decide where to send traffic to a peer. When a peer has Allowed IP... Jim Pingle
07:57 AM Regression #11451: Openvpn wants to use route it should create first: This is an error when openvpn does not use the outgoing interface specified in the openvpn settings and instead tries... Rene Hutschreuther
07:29 AM Regression #11451: Openvpn wants to use route it should create first: There is no bug here, it's a configuration problem, and this site is not for support or diagnostic discussion.
For... Jim Pingle
07:18 AM Regression #11451: Openvpn wants to use route it should create first: With a created static route to the Vpn server it only works if I use the Ip address of the vpn server and not the Dns... Rene Hutschreuther
05:55 AM Regression #11451: Openvpn wants to use route it should create first: The default route of the system is set in the Openvpn settings via Wan but Openvpn ignores the settings and continues... Rene Hutschreuther
07:56 AM Bug #9460: OpenVPN local auth failing due to fcgicli output: Hi all, after a recent upgrade to pfsense 2.5 as released, I had to manually apply the reverted patch ce76f299853dccb... Joakim Gilje
07:55 AM pfSense Packages Bug #11459 (Pull Request Review): pfBlockerNG doesn't include WireGuard interface in outbound floating rules: Jim Pingle
04:13 AM pfSense Packages Bug #11459: pfBlockerNG doesn't include WireGuard interface in outbound floating rules: https://github.com/pfsense/FreeBSD-ports/pull/1044 Viktor Gurov
04:07 AM pfSense Packages Bug #11459 (Resolved): pfBlockerNG doesn't include WireGuard interface in outbound floating rules: pfBlockerNG needs an option on the General tab for "WireGuard" similar to the "IPsec", "OpenVPN" and "L2TP VPN" optio... Viktor Gurov
07:55 AM pfSense Packages Feature #10739: Update HAproxy-devel package to 2.2 and HAproxy to 2.0: To add:
1. Now *Auto* SSL/TLS Compatibility Mode description says:
</code>If unsure leave it as 'Auto'</pre>
This ... DRago_Angel [InV@DER]
07:53 AM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: If you can re-enable those and test again, monitor the CPU usage, CPU temp, and so on to see if they are unusually hi... Jim Pingle
03:36 AM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: after uninstalling Snort and Suricata packages everything works fine
pfSense Plus 21.02 + pfBlockerNG-devel 3.0.0_10 Viktor Gurov
07:45 AM Bug #11446 (Pull Request Review): Mobile IPsec DNS server input validation does not reject unsupported IPv4-mapped IPv6 addresses: Jim Pingle
01:17 AM Bug #11446: Mobile IPsec DNS server input validation does not reject unsupported IPv4-mapped IPv6 addresses: check:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/145
see also #10694 Viktor Gurov
07:43 AM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: This also prevents the System / Update / System Update menu item to work. Jove Too
07:41 AM Feature #11380: PHP shell playback script to modify Alias contents: Hi,
Would you mind putting an option to add a description on alias and entries?
Cheers, Thiago Augusto Koroll
07:41 AM Bug #11448 (Pull Request Review): Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: Jim Pingle
12:44 AM Bug #11448: Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/144 Viktor Gurov
07:41 AM Feature #9825: Requirements for trusted certificates in iOS 13 and macOS 10.15: Hi, actually new rules come in game: *from 1 September 2020*, SSL/TLS certificates cannot be issued for longer than 1... DRago_Angel [InV@DER]
07:40 AM Bug #11456 (Pull Request Review): Unbound Python Integration repeatedly mounts ``dev`` without unmounting: Jim Pingle
12:37 AM Bug #11456: Unbound Python Integration repeatedly mounts ``dev`` without unmounting: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/143 Viktor Gurov
07:24 AM pfSense Packages Bug #11461: zeek package - Web Interface does not display any log content Package/Zeek/Alerts/Real Time Inspection: Further problems identified in the zeek_alerts.php:
The content is updated every 10 seconds however, the results in ... Felix S
06:58 AM pfSense Packages Bug #11461: zeek package - Web Interface does not display any log content Package/Zeek/Alerts/Real Time Inspection: Further investigation seems to show that the web gui is leveraging zeek_alert_data.php for getting the data. However,... Felix S
04:44 AM pfSense Packages Bug #11461 (Resolved): zeek package - Web Interface does not display any log content Package/Zeek/Alerts/Real Time Inspection: Pfsense 2.5.0 - Release, Zeek 3.0.6_1
Confirmed that zeek is working properly by inspecting process list as well as ... Felix S
05:30 AM Revision da59b0a3: Merge branch 'master' into master: bitscher
02:31 AM Bug #11393 (Resolved): Incorrect copyright year on 2.5.0-RC (CE): Jim Pingle wrote:
> It's right on the server. That's a local cached copy. It should update itself within ~24hrs. Not... Viktor Gurov
02:11 AM pfSense Packages Bug #11333 (Resolved): Incorrect community-list format: 1.1.0_4 works as expected:... Viktor Gurov
01:55 AM Bug #11383: pfSense Proxy Authentication not working: Jim Pingle wrote:
> From a much older release, yes, but not from the last public release. It was broken in 2.4.5-p1 ... Michael Samer

02/18/2021

11:52 PM Bug #11457 (Rejected): Client DNS doesn't resolve when using VIP in place of interface IP: https://forum.netgate.com/topic/161056/client-dns-doesn-t-resolve-when-using-vip-in-place-of-interface-ip:
"My ins... Viktor Gurov
10:57 PM Bug #11296 (Resolved): Static route targets may still reachable via default route when the gateway they should route through is down: Fixed.
If WAN GW is down I cannot ping even if there was static route.
2.5.0-RELEASE (amd64)
built on Tue Feb ... Alhusein Zawi
10:30 AM Bug #11296: Static route targets may still reachable via default route when the gateway they should route through is down: Applied in changeset commit:3fca57f8fae3733845c90338943c418bb77e68b7. Viktor Gurov
10:23 AM Bug #11296 (Feedback): Static route targets may still reachable via default route when the gateway they should route through is down: PR has been merged. Thanks! Renato Botelho
10:20 PM pfSense Packages Bug #11449: BIND fails during/after upgrade to 21.02/2.50: I'm also hitting the same problem on my SG-3100.
Seeing the same permissions problems here is what I'm seeing:
... Tchello Mello
12:30 PM pfSense Packages Bug #11449 (Resolved): BIND fails during/after upgrade to 21.02/2.50: After upgrading to 21.02, the named service wouldn’t start and the logs said it was segfaulting ("signal 11"). So I r... Anthony Pants
10:01 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: I am having this issue as well. Starting with 2.5. Without manually overriding gateway monitoring for the ipv6 gatewa... Hayden Hill
09:11 PM Bug #11454: Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: "Me too"... After upgrading to 2.5.0, IPv6 did not work until I manually added an address for monitoring. After doing... Anonymous
05:28 PM Bug #11454 (Resolved): Gateway value for DHCP6 interfaces missing after RA events triggered script without gateway information: Post update to 2.5.0 dpinger is not functioning for IPv6 gateway monitoring
Wan interface set to DHCPv6, WAN Inter... Mike McV
10:00 PM Bug #11453: ``wpa_supplicant`` uses 100% of a CPU core at boot: I am also having this issue. Started with 21.02 (2.5)
Matt Johnson wrote:
> https://github.com/MonkWho/pfatt
>
... Hayden Hill
04:16 PM Bug #11453 (Closed): ``wpa_supplicant`` uses 100% of a CPU core at boot: https://github.com/MonkWho/pfatt
Part of the project above is to use netgraph as a way to bypass the at&t provided... Matt Johnson
08:34 PM Bug #11456 (Resolved): Unbound Python Integration repeatedly mounts ``dev`` without unmounting: +As reported here+:
https://www.reddit.com/r/pfBlockerNG/comments/ln1gx1/pfblockerngdevel_leaking_mounts/
In file... BBcan177 .
07:45 PM Revision 01388d99: Add getVIPs() function for MVC: Steve Beaver
07:45 PM Revision 0d2a423c: Revised firewall_virtual_ip_edit for MVC: Steve Beaver
07:39 PM Revision f871d487: Fix broken help link.: (cherry picked from commit 0a73926193d7d344b28d68a94e2f8bf2009ca119) Jim Pingle
07:39 PM Revision 0a739261: Fix broken help link.: Jim Pingle
06:48 PM Revision 4ccf553a: firewall_virtual_ip refactored fro MVC: Steve Beaver
06:37 PM Regression #11455 (Not a Bug): The ipsec configuration migrated from 2.4.x to 2.5 fails in certain cases.: An ipsec configuration with version 2.4.x that contains these values
<rekey_time>0</rekey_time>
<reauth_time>0</rea... oscar sacristan
05:30 PM Bug #10671: pfsense 2.4.5_1 does not boot on Gen2 2012R2 HyperV VM: This also applies to pfsense 2.5.0. Also stalls on boot with input/output error. Jan de Groot
05:15 PM Revision d30498df: Fix filename in copyright message: Renato Botelho
05:01 PM Revision cc28c45f: Refactored system_advanced_misc for MVC: Steve Beaver
04:59 PM Bug #11452 (Duplicate): pkg breakage related to yet to be installed 21.02 base system: Part of that is expected (use @pkg-static@) but the real fix will come with #10464 Jim Pingle
04:08 PM Bug #11452 (Duplicate): pkg breakage related to yet to be installed 21.02 base system: It would appear merely running "pkg" in the shell of a 2.4.5_1 base system results in:
> @pkg: Warning: Major OS v... Craig Leres
04:59 PM Bug #11450: Problem with IPv6 netmask /128 in WireGuard: Hi Jim,
Patch applied and the problem persists. Marcelo Gondim
03:22 PM Bug #11450: Problem with IPv6 netmask /128 in WireGuard: Can you test this with the patch from #11433 applied?
commit:087d28fa3f5cfebfd4af7f4a4479b0fac053e062 Jim Pingle
01:57 PM Bug #11450: Problem with IPv6 netmask /128 in WireGuard: If I run: route -6 delete fc00:1111::1/128
It removes 7400:1000::/0 from the route table. Marcelo Gondim
12:52 PM Bug #11450 (Rejected): Problem with IPv6 netmask /128 in WireGuard: Hi All,
Creating a WireGuard VPN, I realized that when registering a Peer in "Allowed IPs" he accepts to enter an ... Marcelo Gondim
04:31 PM Revision 087d28fa: Non local gateways fix. Issue #11433: Viktor Gurov
04:29 PM Revision 4e5e99a6: Show switch tagging ports on status_interfaces page. Implements #10804: Viktor Gurov
04:27 PM Revision b785f439: RTL8153 USB ethernet module. Implements #11125: Viktor Gurov
04:25 PM Revision 47df65c3: Replace HTTP links to HTTPS. Implemets #11228: Viktor Gurov
04:22 PM Revision 3fca57f8: Delete static routes on gateway down. Fixes #11296: Viktor Gurov
04:21 PM Revision 16d5365c: Remove unused L2TP VPN directory. Fixes #11299: Viktor Gurov
04:20 PM Revision a628e8ca: Hide MAC address field for pseudo-interfaces. Issue #11387: Viktor Gurov
04:19 PM Revision 57dc81ea: Authentication Servers copy button. Feature #11390: Viktor Gurov
04:18 PM Revision 8673ae11: Unbound ip6.arpa local-zone type. Fixes #11403: Viktor Gurov
04:08 PM Revision 861d6eef: aliasmod shell script. Implements #11380: Viktor Gurov
04:06 PM Revision 1d378c4e: Set correct TCP MSS for IPv6. Fixes #11409: Viktor Gurov
04:05 PM Revision 7c4b3d3c: Allow to use host portion of IPv6 in firewall rules. Feature #6626: Viktor Gurov
04:05 PM Revision 6e281116: L2TP VPN MTU option. Feature #11406: Viktor Gurov
04:02 PM Revision 5e280f4b: Xen console support. Feature #11402: Viktor Gurov
04:00 PM Revision f5736d98: Display negotiated cipher on Status / OpenVPN page. Implements #7077: Viktor Gurov
04:00 PM Revision 10eb0425: Do not prefix FQDN IPsec IDs with @. Fixes #11442: (cherry picked from commit c09137ab4726dc492c658c27b6c46e25f0fbb55b) Jim Pingle
04:00 PM Revision 57beb9ad: Find IPsec IKE SAs by their full name. Issue #11435: (cherry picked from commit 95a4e1a0e42392fe4523bf769589f74864446f8c) Jim Pingle
04:00 PM Revision ead65156: Find IPsec IKE SAs by their full name. Issue #11435: (cherry picked from commit 4e5857b656c7bfd59efadbb9a124876a5516c7df) Jim Pingle
04:00 PM Revision 9d08d4bf: Fix custom XMLRPC port for Captive Portal. Fixes #11425: (cherry picked from commit fef846ce7ec4158a140f359b0fb35182f6ae9db9) Jim Pingle
03:59 PM Revision f22b2155: Hide Shared Key field on OpenVPN client page in SSL/TLS mode. Fixes #11382: Viktor Gurov
03:58 PM Revision fe6b1252: Mythic-Beasts.com DynDNS provider support. Implements #7842: Viktor Gurov
03:57 PM Revision 6542fe08: RADIUS Advanced parameters. Feature #11211: Viktor Gurov
03:49 PM Regression #11316 (New): Unbound crashes with signal 11 when reloading: Now that there have been responses from several others on the forum post with info, it does appear there is a problem... Jim Pingle
03:22 PM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: This could also be related to #11450 since it uses that function in this way Jim Pingle
11:29 AM Regression #11433 (Waiting on Merge): Gateways with "Use non-local gateway" set are not added to routing table: Renato Botelho
11:21 AM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: Can confirm it fixes the issue for me :-) Daniel Berteaud
10:31 AM Regression #11433 (Feedback): Gateways with "Use non-local gateway" set are not added to routing table: PR has been merged. Thanks! Renato Botelho
10:19 AM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/139 Viktor Gurov
07:19 AM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: Indeed, forgot to mention I'm assigning a static /32 IPv4 on my WAN interface, not with DHCP Daniel Berteaud
07:17 AM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: I can replicate this!
I was about to respond that this "works for me" because I have a pfSense demo VPS with a clo... M Felden
03:19 PM Bug #11437 (Pull Request Review): WireGuard group is not printed in the interface column of the NAT rule list: Jim Pingle
11:37 AM Bug #11437: WireGuard group is not printed in the interface column of the NAT rule list: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/140 Viktor Gurov
08:01 AM Bug #11437: WireGuard group is not printed in the interface column of the NAT rule list: Updating subject to make it a little more clear.
If you look at the generated ruleset in @/tmp/rules.debug@, does ... Jim Pingle
03:18 PM Regression #11443 (Pull Request Review): Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: Jim Pingle
01:21 PM Regression #11443: Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/141 Viktor Gurov
09:29 AM Regression #11443 (Resolved): Disabling 'State Table Size' in the System Information widget prevents other data from being displayed: In the dashboard System Information widget if you set the 'State Table Size' to not show the CPU usage and version up... Steve Wheeler
03:17 PM Regression #11451 (Not a Bug): Openvpn wants to use route it should create first: I'm not sure if this is a change in OpenVPN 2.5.0 or pfSense 2.5.0 here. I don't recall that working the way you desc... Jim Pingle
02:57 PM Regression #11451 (Not a Bug): Openvpn wants to use route it should create first: Since Pfsense version 2.5 openvpn is no longer able to connect to the server when the default gateway points to a vpn... Rene Hutschreuther
03:06 PM Revision c09137ab: Do not prefix FQDN IPsec IDs with @. Fixes #11442: Jim Pingle
02:48 PM Revision 819bd77c: Show gateway groups in OpenVPN Wizard. Fixes #11141: Viktor Gurov
02:45 PM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: I can reproduce this here as well. It was working not too long ago, though. It doesn't seem to affect everything, how... Jim Pingle
06:16 AM pfSense Plus Regression #11436: State matching problem with reponses to packets arriving on non-default WANs: Have same issue, started on devel 2.5. Posted some details at https://forum.netgate.com/topic/159354/pfsense-2-5-0-a-... DRago_Angel [InV@DER]
02:43 PM Revision a2076602: Check that DHCP has gateway in interface_has_gateway(). Fixes #5135: Viktor Gurov
02:41 PM Revision 25e8eb57: Randomize ACB cron minutes. Implements #10811: Viktor Gurov
02:39 PM Revision 54b3109f: RADVD set AdvRDNSSLifetime. Fixes #11105: Viktor Gurov
02:38 PM Revision 9115501d: Down disabled interfaces on boot. Fixes #11091: Viktor Gurov
02:32 PM Revision 23fcdccc: Do not restart unchanged services on XMLRPC sync. Fixes #11082: Viktor Gurov
01:59 PM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: Same issue with finding the CPU flags to see what the CPU supports.
On older versions, dmesg.boot wasn't cleared, ... Jim Pingle
01:26 PM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: Jim Pingle wrote:
> This is because the number of packages and cores is currently scraped from /var/log/dmesg.boot, ... B. B.
12:50 PM Feature #11125: Kernel module for RTL8153 driver: Genevieve Kidwell wrote:
> Does this mean this was implemented in 2.6.x experimental?
yes, and will be available ... Renato Botelho
12:39 PM Feature #11125: Kernel module for RTL8153 driver: Does this mean this was implemented in 2.6.x experimental? Genevieve Kidwell
10:35 AM Feature #11125: Kernel module for RTL8153 driver: Applied in changeset commit:b785f439ab50b0d7a981a15ccd465ca8353a97ea. Viktor Gurov
10:27 AM Feature #11125 (Feedback): Kernel module for RTL8153 driver: PR has been merged. Thanks! Renato Botelho
12:40 PM Feature #11438: Allow multiple cryptographic accelerator modules to be loaded at the same time: That OpenVPN option probably needs to go away. Historically it has been pretty much a no-op. You can pick an engine t... Jim Pingle
11:47 AM Feature #11438: Allow multiple cryptographic accelerator modules to be loaded at the same time: Good point Jim,
probably i got mislead by openvpn configuration menu, showing me no available crypto acceleration on... Grzegorz Krzystek
11:32 AM Feature #11438: Allow multiple cryptographic accelerator modules to be loaded at the same time: We're still testing whether it's useful/possible to have multiple modules enabled, so making them mutually exclusive ... Jim Pingle
12:10 AM Feature #11438 (New): Allow multiple cryptographic accelerator modules to be loaded at the same time: not every service is able utilise QAT.
so it seems to be reasonable to do not unload AES-NI and bsdcrypto while QAT... Grzegorz Krzystek
12:34 PM pfSense Packages Bug #11434 (Feedback): SquidGuard over 1.16.18_11: Fix pushed to version 1.16.18_15. Thank you! Renato Botelho
12:21 PM pfSense Packages Bug #11434: SquidGuard over 1.16.18_11: I found the problem in /usr/local/pkg/squidguard_configurator.inc
Line: 903... Eduardo Silva
10:04 AM pfSense Packages Bug #11434: SquidGuard over 1.16.18_11: Hi, i have same problem. i try change Client (source) with ip, domain, etc.. and config file is written with correct ... Eduardo Silva
12:26 PM Bug #11448 (Closed): Incorrect order of ``route-nopull`` option in OpenVPN client-specific override configuration: https://openvpn.net/faq/overriding-a-pushed-route-in-the-clients-config-throws-an-error/:
When connecting to server ... Viktor Gurov
12:24 PM Bug #11383: pfSense Proxy Authentication not working: From a much older release, yes, but not from the last public release. It was broken in 2.4.5-p1 thus not a new regres... Jim Pingle
10:20 AM Bug #11383: pfSense Proxy Authentication not working: Renato Botelho wrote:
> Not a regression, move to next release.
IMHO, shouldn't this technically be considering a... Michael Spears
11:24 AM Regression #11447 (Closed): EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes: When using IKEv2 EAP-RADIUS mobile IPsec and assigning client addresses from RADIUS, the pools configuration is omitt... Jim Pingle
11:16 AM Bug #11446 (Closed): Mobile IPsec DNS server input validation does not reject unsupported IPv4-mapped IPv6 addresses: Adding an IPv4-mapped IPv6 address as a mobile IPsec DNS server on vpn_ipsec_mobile.php (ex: @fd00::1.2.3.4@) causes ... Jim Pingle
10:41 AM pfSense Packages Bug #11445: bgp as-path in wrong position: fix:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/53 Viktor Gurov
10:24 AM pfSense Packages Bug #11445 (Resolved): bgp as-path in wrong position: https://forum.netgate.com/topic/160998/frr-7-5-full-bgp-table-very-slow-and-as-paths-not-working/4:... Viktor Gurov
10:35 AM pfSense Plus Feature #10804: Interface Status page information for switch uplinks may be replaced by switch port data when media state monitoring is set: Applied in changeset commit:4e5e99a61d422941e69b2caa11e948363409e48c. Viktor Gurov
10:29 AM pfSense Plus Feature #10804 (Feedback): Interface Status page information for switch uplinks may be replaced by switch port data when media state monitoring is set: PR has been merged. Thanks! Renato Botelho
10:30 AM Bug #11299: Unused L2TP VPN files are not removed when the service is disabled: Applied in changeset commit:16d5365ce65660f715fd521fae8aeb3b6b7a151a. Viktor Gurov
10:21 AM Bug #11299 (Feedback): Unused L2TP VPN files are not removed when the service is disabled: PR has been merged. Thanks! Renato Botelho
10:26 AM Feature #11228 (Feedback): Replace HTTP links with HTTPS in the GUI: PR has been merged. Thanks! Renato Botelho
10:25 AM Bug #11403: DNS Resolver does not add a ``local-zone`` type for ``ip6.arpa`` domain override: Applied in changeset commit:8673ae11ac96fbd2934133268d56829d6225b1c5. Viktor Gurov
10:18 AM Bug #11403 (Feedback): DNS Resolver does not add a ``local-zone`` type for ``ip6.arpa`` domain override: PR has been merged. Thanks! Renato Botelho
10:20 AM Bug #11387 (Feedback): Interfaces page displays MAC Address field for interfaces which do not support L2: PR has been merged. Thanks! Renato Botelho
10:19 AM Feature #11390 (Feedback): Copy button for Authentication Server entries: PR has been merged. Thanks! Renato Botelho
10:15 AM Feature #11380: PHP shell playback script to modify Alias contents: Applied in changeset commit:861d6eef97bc14679db7818a33cd9193ffe2eaf6. Viktor Gurov
10:08 AM Feature #11380 (Feedback): PHP shell playback script to modify Alias contents: PR has been merged. Thanks! Renato Botelho
10:15 AM Bug #11409: IPv4 MSS value is incorrectly applied to IPv6 packets: Applied in changeset commit:1d378c4ec6c440dabffba41bf5e4ef291acb9aa2. Viktor Gurov
10:07 AM Bug #11409 (Feedback): IPv4 MSS value is incorrectly applied to IPv6 packets: PR has been merged. Thanks! Renato Botelho
10:10 AM Feature #7077: Display negotiated data encryption algorithm in OpenVPN connection status: Applied in changeset commit:f5736d9827cf1997b648481c50993d69e3caedff. Viktor Gurov
10:00 AM Feature #7077 (Feedback): Display negotiated data encryption algorithm in OpenVPN connection status: PR has been merged. Thanks! Renato Botelho
10:06 AM Feature #6626 (Feedback): Support for IPv6 firewall entries with dynamic delegated prefix and static host address: PR has been merged. Thanks! Renato Botelho
10:05 AM Feature #11406 (Feedback): GUI option to set MTU for L2TP VPN server: PR has been merged. Thanks! Renato Botelho
10:05 AM Bug #11382: OpenVPN client configuration page displays Shared Key option when set for SSL/TLS: Applied in changeset commit:f22b21557e6a745dbb447ea488b97424e595efd7. Viktor Gurov
10:00 AM Bug #11382 (Feedback): OpenVPN client configuration page displays Shared Key option when set for SSL/TLS: PR has been merged. Thanks! Renato Botelho
10:05 AM Feature #7842: New Dynamic DNS Provider: Mythic-Beasts: Applied in changeset commit:fe6b125233f40f5919746b1cb90c39b459aa39fd. Viktor Gurov
09:59 AM Feature #7842 (Feedback): New Dynamic DNS Provider: Mythic-Beasts: PR has been merged. Thanks! Renato Botelho
10:02 AM Feature #11402 (Feedback): Xen console support: PR has been merged. Thanks! Renato Botelho
10:01 AM Bug #11425 (Feedback): XMLRPC error with Captive Portal and CARP failover when GUI is on non-standard port: Picked back Jim Pingle
09:57 AM Bug #11393: Incorrect copyright year on 2.5.0-RC (CE): It's right on the server. That's a local cached copy. It should update itself within ~24hrs. Not sure if there is any... Jim Pingle
03:47 AM Bug #11393: Incorrect copyright year on 2.5.0-RC (CE): same on 21.02 (SG-3100) Viktor Gurov
09:57 AM Feature #11211 (Feedback): GUI option to set RADIUS Timeout for EAP-RADIUS: PR has been merged. Thanks! Renato Botelho
09:49 AM pfSense Packages Bug #11404 (Feedback): Incorrect prefix/access lists migration on update: Merged Renato Botelho
09:48 AM pfSense Packages Feature #11405 (Feedback): add RPKI route map in GUI: Merged Renato Botelho
09:48 AM pfSense Packages Bug #8466 (Feedback): radiusd crash: Merged Renato Botelho
09:33 AM pfSense Plus Regression #11444: SG-3100 doesn't pass traffic after upgrade to 21.02: could be related: #11436 #11418 Viktor Gurov
09:30 AM pfSense Plus Regression #11444 (Resolved): SG-3100 doesn't pass traffic after upgrade to 21.02: After upgrading SG-3100 to pfSense Plus 21.02 NAT stopped working.
Test:
LAN PC (192.168.10.132):... Viktor Gurov
09:15 AM Regression #11442 (Feedback): Distinguished Name (FQDN) IPsec peer identifier type is not formatted properly in ``swanctl.conf`` secrets: Applied in changeset commit:c09137ab4726dc492c658c27b6c46e25f0fbb55b. Jim Pingle
09:04 AM Regression #11442 (Resolved): Distinguished Name (FQDN) IPsec peer identifier type is not formatted properly in ``swanctl.conf`` secrets: IPsec tunnels using an identifier type of "Distinguished Name" are not working properly. It appears that the identifi... Jim Pingle
08:55 AM Bug #11141: OpenVPN Wizard does not support gateway groups: Applied in changeset commit:819bd77ce13154ad3911310c6f3cb076a82e5fcb. Viktor Gurov
08:49 AM Bug #11141 (Feedback): OpenVPN Wizard does not support gateway groups: PR has been merged. Thanks! Renato Botelho
08:55 AM Bug #5135: DHCP interfaces are always treated as having a gateway, even if one is not assigned by the upstream DHCP server: Applied in changeset commit:a207660205a8c82466b63381f48a0355a32d8866. Viktor Gurov
08:47 AM Bug #5135 (Feedback): DHCP interfaces are always treated as having a gateway, even if one is not assigned by the upstream DHCP server: PR has been merged. Thanks! Renato Botelho
08:50 AM Feature #10811: Randomize time of scheduled AutoConfigBackup runs: Applied in changeset commit:25e8eb5772fd6d50c40c5eaf69805d94e5f89204. Viktor Gurov
08:43 AM Feature #10811 (Feedback): Randomize time of scheduled AutoConfigBackup runs: PR has been merged. Thanks! Renato Botelho
08:50 AM Bug #11105: IPv6 RA RDNSS lifetime is too short, not compliant with RFC 8106: Applied in changeset commit:54b3109f0b1978e22866117b6d93715eb8d78c29. Viktor Gurov
08:41 AM Bug #11105 (Feedback): IPv6 RA RDNSS lifetime is too short, not compliant with RFC 8106: PR has been merged. Thanks! Renato Botelho
08:45 AM Bug #11091: Interfaces set as disabled in the configuration have an UP status in the operating system at boot: Applied in changeset commit:9115501d6ab5197d9caf499e90779c020d711dca. Viktor Gurov
08:39 AM Bug #11091 (Feedback): Interfaces set as disabled in the configuration have an UP status in the operating system at boot: PR has been merged. Thanks! Renato Botelho
08:45 AM Bug #11082: XMLRPC synchronization restarts all OpenVPN instances on the secondary node when making any change on the primary node: Applied in changeset commit:23fcdcccd369603f4af6a89a0ec0a81505173f40. Viktor Gurov
08:36 AM Bug #11082 (Feedback): XMLRPC synchronization restarts all OpenVPN instances on the secondary node when making any change on the primary node: PR has been merged. Thanks! Renato Botelho
08:28 AM Regression #11441 (Rejected): Unable to create static routes: Something is not right on your system (maybe a broken upgrade ??). Line 764 of system.inc doesn't have a call to rou... Renato Botelho
08:16 AM Regression #11441 (Rejected): Unable to create static routes: Upon upgrading to 2.5.0, my pfSense instance was inaccessible. After some playing around with interfaces etc. it appe... Adam McKissock
08:09 AM pfSense Packages Feature #10858: OpenVPN Client silent install: Jordan Fishman wrote:
> Hello,
>
> There appears to be a bug in the page, where the "Save as default" button does... Viktor Gurov
08:03 AM Feature #11440: Expand collapsed sections by clicking anywhere on header: Updating the subject so it's more clear what you're asking for. Rather than clicking only on the +/- you want to expa... Jim Pingle
07:45 AM Feature #11440 (New): Expand collapsed sections by clicking anywhere on header: Hi! I would like to point out a little thing that could improve the pfSense user experience. I think it should be pos... Federico Galli
04:57 AM Feature #11439: IPv6 support in ``easyrule`` CLI script: fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/138 Viktor Gurov
03:06 AM Feature #11439 (Resolved): IPv6 support in ``easyrule`` CLI script: https://forum.netgate.com/topic/160578/getting-errors-loading-rules-after-using-easyrule:
I recently tried to use ... Viktor Gurov
03:27 AM Revision e01266c0: Improve the handling of crypto offload hardware.: Remove support to deprecated hardware.
Task: #11426 Luiz Souza

02/17/2021

10:13 PM Bug #11437 (Closed): WireGuard group is not printed in the interface column of the NAT rule list: Hi all,
When creating a "NAT Outbound" rule and selecting the WireGuard interface, it does not appear in the liste... Marcelo Gondim
09:56 PM Revision 95a4e1a0: Find IPsec IKE SAs by their full name. Issue #11435: Jim Pingle
09:39 PM Revision 4e5857b6: Find IPsec IKE SAs by their full name. Issue #11435: Jim Pingle
08:38 PM pfSense Packages Feature #10779: HAProxy SSL/TLS Compatibility Mode: ... DRago_Angel [InV@DER]
08:32 PM pfSense Packages Feature #10739: Update HAproxy-devel package to 2.2 and HAproxy to 2.0: Hi Actually my ticket was much before of "duplicate", and my ticket contain details, that now issue with 2.2 in 2.5 p... DRago_Angel [InV@DER]
08:30 PM Revision edd24218: Update comments: Steve Beaver
08:27 PM Revision f483c24b: Provide system_advanced_firewall.inc: Steve Beaver
08:21 PM Revision f010f43c: Revised system_advanced_notificaions for MVC: Steve Beaver
08:10 PM Revision 9f5fbb5d: Merged system_advanced_network for MVC: Steve Beaver
08:06 PM Revision 93fee0fd: remove obsolete system_advanced.inc: Steve Beaver
07:58 PM Revision 33db4727: Fix hnaltqenable setting: Steve Beaver
05:14 PM Bug #10966: IPv6 - WAN does not renew address when upstream fails: Thanks all for your efforts on this, great to see it in the 2.5.0 release today! Sam McLeod
04:28 PM pfSense Plus Regression #11436 (Resolved): State matching problem with reponses to packets arriving on non-default WANs: I have quite specific multiwan setup
WAN (symmetric pppoe) port forward for ssh to lan (rpi)
WAN2 (symmetric comm... Grzegorz Krzystek
04:27 PM Revision 370baf79: Build 245 repo: Renato Botelho
04:12 PM Revision eaf6cfb5: Make default repo to be 2.5.0: Renato Botelho
03:58 PM Regression #11435 (Feedback): IPsec status incorrect for entries using expanded IKE connection numbers: I checked in a fix for the widget now as well. Worked on two systems here (one which worked before, another which did... Jim Pingle
03:40 PM Regression #11435: IPsec status incorrect for entries using expanded IKE connection numbers: I pushed a fix for the status page, widget works much differently so it needs handled another way. Jim Pingle
02:37 PM Regression #11435 (Closed): IPsec status incorrect for entries using expanded IKE connection numbers: IPsec status is not correctly matching some tunnels. #9592 introduced a mechanism to accommodate large numbers of VTI... Jim Pingle
02:18 PM Revision 219a41be: Split system_admin.inc into separate files per tab: Steve Beaver
01:23 PM pfSense Packages Bug #11434 (Resolved): SquidGuard over 1.16.18_11: Hi, first problem thatI found is when we are using ldapusersearch on groups acl.
In older version when I insert ldap... Robson Ferreira
11:54 AM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: Attached is a screenshot of my VM during boot. Not sure if it's a symptom or a consequence of the default route missing Daniel Berteaud
11:36 AM Regression #11433: Gateways with "Use non-local gateway" set are not added to routing table: Do you see any errors in the console output while it boots when that happens?
There were numerous changes to gatew... Jim Pingle
11:31 AM Regression #11433 (Resolved): Gateways with "Use non-local gateway" set are not added to routing table: I'm using a non-local gateway as my default gateway (ticking the "Use non-local gateway through interface specific ro... Daniel Berteaud
11:33 AM Bug #11432: status_dhcp_leases.php doesn't load: Reset the install and restored back from the same config file and now it loads with minimal devices listed. Michael Walker
10:57 AM Bug #11432 (Rejected): status_dhcp_leases.php doesn't load: I can't replicate this here and there isn't nearly enough information to go by.
This site is not for support or di... Jim Pingle
10:13 AM Bug #11432 (Rejected): status_dhcp_leases.php doesn't load: Trying to access the DHCP leases page (https://UR_IP/status_dhcp_leases.php) but its never loads you end up getting 5... Michael Walker
11:04 AM Bug #11431 (Rejected): WAN IPv6 via Prefix Delegation over PPPoE: There were numerous improvements in IPv6 on PPPoE in 2.5.0 which was just released. If you can still replicate this p... Jim Pingle
09:58 AM Bug #11431 (Rejected): WAN IPv6 via Prefix Delegation over PPPoE: Hello,
the following wan setup is working with my provider.
WAN:
* IPv4 Configuration Type PPPoE
* IPv6 Configu... Jost Schoenleben
09:49 AM Bug #11401 (Resolved): Upgrade broken due to need to reinstall pkg: Jim Pingle
09:06 AM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: This is because the number of packages and cores is currently scraped from /var/log/dmesg.boot, and when you reset al... Jim Pingle
08:38 AM Bug #11416 (New): OpenVPN IPv4 Tunnel Network incorrectly allows hostnames: OK so you literally meant a host address inside a network, and not the network address.
We could do one of two thi... Jim Pingle
01:58 AM Bug #11416: OpenVPN IPv4 Tunnel Network incorrectly allows hostnames: A single host address with a CIDR mask. e.g., 10.0.8.1/24. Danilo Zrenjanin
08:36 AM Bug #11429: System Log / Settings form activates "Reset Log Files" button on enter: It is expected behavior, but if it's easy to change and improves the user experience, we may as well look into it. Jim Pingle
03:58 AM Bug #11429: System Log / Settings form activates "Reset Log Files" button on enter: I would say this is expected behavior. If you go to Firewall/Rules and hit Enter, the Delete button will be triggered... Danilo Zrenjanin
07:48 AM Bug #11430 (New): PHP console spam after Assigning Interfaces: After (re)assigning the interfaces at the console following a mismatch the WAN interface triggers a number or scripts... Steve Wheeler

02/16/2021

09:08 PM Revision fef846ce: Fix custom XMLRPC port for Captive Portal. Fixes #11425: Jim Pingle
06:49 PM Bug #11429 (New): System Log / Settings form activates "Reset Log Files" button on enter: I ran into this when I went to increase the size of my log files. Happy to see the action prompts for confirmation.
... Kai Groner
05:50 PM Revision d6db3d73: Completed networking section, subject to testing: Steve Beaver
03:43 PM Bug #11425 (Waiting on Merge): XMLRPC error with Captive Portal and CARP failover when GUI is on non-standard port: Jim Pingle
03:32 PM Bug #11425 (In Progress): XMLRPC error with Captive Portal and CARP failover when GUI is on non-standard port: Needs picked back after the release is tagged. Jim Pingle
03:15 PM Bug #11425 (Feedback): XMLRPC error with Captive Portal and CARP failover when GUI is on non-standard port: Applied in changeset commit:fef846ce7ec4158a140f359b0fb35182f6ae9db9. Jim Pingle
08:26 AM Bug #11425: XMLRPC error with Captive Portal and CARP failover when GUI is on non-standard port: Luca De Andreis wrote:
> .... after countless attempts and two tickets that you closed for me, I found the cause of ... Luca De Andreis
07:57 AM Bug #11425: XMLRPC error with Captive Portal and CARP failover when GUI is on non-standard port: Previous issues: #11218, #11220
Though you still did not provide enough information here, I managed to piece toget... Jim Pingle
05:02 AM Bug #11425 (Resolved): XMLRPC error with Captive Portal and CARP failover when GUI is on non-standard port: .... after countless attempts and two tickets that you closed for me, I found the cause of the problem.
The tcp por... Luca De Andreis
03:40 PM Bug #11428: CPU details are incorrect in the System Information widget after resetting log files: First reported here:
https://forum.netgate.com/topic/160762/cpu-info-disappear-on-pfsense-2-5-0-rc/2 B. B.
02:54 PM Bug #11428 (Resolved): CPU details are incorrect in the System Information widget after resetting log files: Some CPU Type information disappear after reset the log files under Status.
This happen on VMWare with 2.5.0 RC and ... B. B.
01:22 PM Revision 6fb4b1b0: Welcome pfSense 2.5.0-RELEASE: Renato Botelho
01:21 PM Revision 9f3752d8: Mark 2.5.0 as current stable version: Renato Botelho
01:19 PM Revision 2972e3fa: Mark 2.5.0 as current stable version: Renato Botelho
01:18 PM Revision 5b4f6490: Do not exclude unlisted package: Renato Botelho
01:18 PM Revision 6c5774dc: Mark 2.5.0 as current stable version: Renato Botelho
12:43 PM Bug #11427 (Incomplete): IPSEC Status page shows Connections twice (connected and disconnected): You haven't provided nearly enough information. At a minimum, provide the IPsec configuration as well as the output o... Jim Pingle
12:38 PM Bug #11427 (Duplicate): IPSEC Status page shows Connections twice (connected and disconnected): Hi,
I have two IPSEC connections, both are running fine.
On the Statuspage, the entries seams to be splittend in a ... Stefan Heck
09:49 AM Todo #11426 (Closed): Deprecate old cryptographic accelerator hardware which is not viable on modern systems: We are carrying drivers for a few bits of crypto hardware which do not make sense on current systems. Either due to l... Jim Pingle
08:49 AM Feature #6626 (Pull Request Review): Support for IPv6 firewall entries with dynamic delegated prefix and static host address: Jim Pingle
08:47 AM Bug #11409 (Pull Request Review): IPv4 MSS value is incorrectly applied to IPv6 packets: Jim Pingle
08:43 AM pfSense Docs Correction #11413 (Rejected): Feedback on Virtual LANs (VLANs) — pfSense VLAN Configuration: I think mentioning that might be confusing. It's pretty well established in the docs that the parent is completely un... Jim Pingle
08:41 AM Feature #2400 (Pull Request Review): GUI options for WPA Enterprise with identity/password: Jim Pingle
08:38 AM pfSense Packages Bug #8466 (Pull Request Review): radiusd crash: Jim Pingle
08:35 AM Bug #11416 (Feedback): OpenVPN IPv4 Tunnel Network incorrectly allows hostnames: By "host address" do you mean a single IP address without a CIDR mask ("x.x.x.x") or an FQDN? Jim Pingle
08:28 AM Bug #11415 (Rejected): fe80::1:1 duplicate from secondary pfSense: This seems unnecessary now -- the fe80::1:1 address was removed in #10661 on 2.5.0 (and HA isn't compatible with dyna... Jim Pingle
08:25 AM Bug #11418: 'NAT-T: Force' is broken for IPv6 IPsec: This is a problem in strongSwan and/or FreeBSD and not in pfSense software. See https://wiki.strongswan.org/issues/93... Jim Pingle
08:18 AM Feature #11420 (Pull Request Review): New Dynamic DNS Provider: Gandi LiveDNS IPv6: Jim Pingle
08:17 AM Bug #11424: Toggling pfSense update branch can lead to deinstall of packages without user confirmation: In the upgrade case, the branch is switched automatically. In your case, you did it manually. Same root cause.
Jim Pingle
08:15 AM Bug #11424: Toggling pfSense update branch can lead to deinstall of packages without user confirmation: I just want to clarify: In the case here the user does nothing to trigger a package update.
Merely toggling the b... M Felden
08:07 AM Bug #11424 (Duplicate): Toggling pfSense update branch can lead to deinstall of packages without user confirmation: Same root issue as #10464
Some of that can't be avoided due to conflict prevention, but solving the existing issue... Jim Pingle
08:15 AM pfSense Docs Todo #11421 (Resolved): Replace iTerm on iTerm2 due iTerm project close.: I fixed it, but it's fairly obvious. If someone searches for "iterm" they get led to the iterm2 page in several ways.... Jim Pingle
08:11 AM pfSense Docs New Content #11422 (Rejected): Add info about storing SSH public key in Backup: User SSH keys are public keys. There is nothing private/secret about them.
There is no more security loss by keepi... Jim Pingle
06:51 AM Bug #11423 (Duplicate): pfSense won't trust SMTP server TLS certificate signed by private CA: Renato Botelho
06:42 AM Bug #11423: pfSense won't trust SMTP server TLS certificate signed by private CA: Doh! Yep, I believe this issue can be closed as a duplicate of #4068.
Searching for issues regarding pfSense inter... Jonathon Reinhart
12:32 AM Bug #11423: pfSense won't trust SMTP server TLS certificate signed by private CA: https://redmine.pfsense.org/issues/4068 it's already done for 2.5.0 try the RC.
Grimson Gretzleburg

02/15/2021

09:31 PM Bug #11424 (Duplicate): Toggling pfSense update branch can lead to deinstall of packages without user confirmation: 2.4.5_1
Expected Behavior:
Merely changing update branch in System -> Update -> Update settings to RC should ... M Felden
07:16 PM pfSense Packages Feature #10858: OpenVPN Client silent install: Hello,
There appears to be a bug in the page, where the "Save as default" button does not save/apply the "silent i... Jordan Fishman
04:40 PM Bug #11423 (Duplicate): pfSense won't trust SMTP server TLS certificate signed by private CA: h1. TL;DR
I was surprised to find that there is no way in the pfSense UI to add external CA certificates that are ... Jonathon Reinhart
01:17 PM pfSense Docs New Content #11422 (Rejected): Add info about storing SSH public key in Backup: The "*AutoConfigBackup Service*" section https://docs.netgate.com/pfsense/en/latest/backup/autoconfigbackup.html
a... Sergei Shablovsky
11:01 AM pfSense Docs Todo #11421 (Resolved): Replace iTerm on iTerm2 due iTerm project close.: Dear pfSense DevTeam!
In pfSense Documents Secure Shell (SSH) section (https://docs.netgate.com/pfsense/en/latest/... Sergei Shablovsky
08:46 AM pfSense Packages Feature #11043: pfSense GUI for iperf3 / perf: Jim Pingle wrote:
> Maintaining a list of public servers is outside the scope of the package, and encouraging users ... Sergei Shablovsky
01:20 AM Revision 2efdd601: Add IPv6 support for Gandi LiveDNS dynamic DNS handler: * Simplify the use of the LiveDNS API by using another API call that
handles both creating and updating for a given n... bitscher

02/14/2021

07:38 PM Feature #11420: New Dynamic DNS Provider: Gandi LiveDNS IPv6: PR: https://github.com/pfsense/pfsense/pull/4500 Romain Bitschene
07:35 PM Feature #11420 (Closed): New Dynamic DNS Provider: Gandi LiveDNS IPv6: The current implementation of the dynamic DNS feature for Gandi LiveDNS in pfSense does not allow updates of AAAA rec... Romain Bitschene
03:03 AM Bug #11187: WAN_DHCP6 down, but IPv6 actually works: Still present on the current 2.5.0-RC
Simply rebooting also sometimes (in 50% cases maybe) fixes the issue.
Als... Aleksandr Mezin
02:21 AM Bug #11418 (Resolved): 'NAT-T: Force' is broken for IPv6 IPsec: While I tested IPsec I found that 'NAT-T: Force' is broken for IPv6. I've tried IKEv1 and IKEv2 with both 'Mutual cer... Azamat Khakimyanov

02/13/2021

11:11 PM pfSense Packages Feature #11022: Add feeds from Firebog.net to pfBlockerNG: 2.4.5p1 w/ pfblockerng-devel 3.0.0_10 shows additional firebog entries in feeds Jordan G
04:58 PM pfSense Packages Bug #11333: Incorrect community-list format: /var/log/frr/frr-reload.log is not generated in 2.4.5
2.4.5-RELEASE-p1 FRR 0.6.7_7
FRR 1.1.0_4 is n... Alhusein Zawi
10:32 AM pfSense Docs Todo #11417 (Closed): Feedback on Services — DNS Resolver — DNS Resolver Advanced Options: *Page:* https://docs.netgate.com/pfsense/en/latest/services/dns/resolver-advanced.html
*Feedback:*
Missing info... Viktor Gurov
06:53 AM Bug #11415: fe80::1:1 duplicate from secondary pfSense: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/137 Viktor Gurov
03:22 AM Bug #11415 (Rejected): fe80::1:1 duplicate from secondary pfSense: https://forum.netgate.com/topic/160181/fe80-1-1-duplicate-from-secondary-pfsense:
I've got a small setup with two ... Viktor Gurov
05:33 AM Bug #11416 (Resolved): OpenVPN IPv4 Tunnel Network incorrectly allows hostnames: If you enter a host address instead of a network address into the *IPv4 Tunnel Network* field, the setup will be acce... Danilo Zrenjanin
05:23 AM pfSense Packages Bug #8466: radiusd crash: I retested and added another minor fix.
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/51 Danilo Zrenjanin
05:00 AM Feature #2400: GUI options for WPA Enterprise with identity/password: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/136 Viktor Gurov
02:46 AM pfSense Packages Bug #11414 (New): Enabling feed "Public_DNS4_all" breaks some Google services: It seems at some point either public-dns.info added a wrong IP to their list of public DNS servers, Google changed so... T Toft
02:25 AM pfSense Packages Bug #11131 (Resolved): pfblockerng-devel 3.0.0_2 logs when logging is disabled: Viktor Gurov
02:09 AM pfSense Packages Bug #11131: pfblockerng-devel 3.0.0_2 logs when logging is disabled: I completely forgot about this bug report and now it is resolved. Sorry, please close (I don't think I can?). T Toft
01:08 AM pfSense Packages Bug #8607: Suricata package fails to prune suricata.log: Got this error again today with Suricata 5.0.4_2.... Car F
12:38 AM pfSense Docs Correction #11413 (Rejected): Feedback on Virtual LANs (VLANs) — pfSense VLAN Configuration: *Page:* https://docs.netgate.com/pfsense/en/latest/vlan/configuration.html
*Feedback:*
It should be noted that ... Viktor Gurov
12:14 AM Bug #11409: IPv4 MSS value is incorrectly applied to IPv6 packets: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/135 Viktor Gurov

02/12/2021

11:35 PM Feature #6626: Support for IPv6 firewall entries with dynamic delegated prefix and static host address: Allow to use host portion of IPv6 in firewall rules:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/134 Viktor Gurov
09:29 PM pfSense Packages Feature #11411: Smokeping as a default latency measurement tool: Sergei Shablovsky wrote:
> The main advantages:
> - very flexible system of a measurements (due a lot of probes htt... Sergei Shablovsky
05:12 PM pfSense Packages Feature #11411: Smokeping as a default latency measurement tool: Sergei Shablovsky wrote:
> Dear pfSense DevTeam!
>
> Please add Smokeping for monitoring WAN and LAN links state.... Sergei Shablovsky
04:43 PM pfSense Packages Feature #11411 (New): Smokeping as a default latency measurement tool: Dear pfSense DevTeam!
Please add Smokeping for monitoring WAN and LAN links state.
The main advantages:
- very... Sergei Shablovsky
08:12 PM Bug #11412 (New): LLDPD Package Doesn't Work with Switchports: When running the LLDP daemon from the lldpd package on an interface that is a logical VLAN interface (such as the swi... Kris Phillips
06:29 PM Revision 3f4949b6: Add input_errors to returned array: Steve Beaver
04:34 PM Revision c040bd1d: Revised system_advanced_notifications for MVC: Steve Beaver
03:53 PM pfSense Packages Feature #11410 (New): adding bpytop (former Bashtop): Dear pfSense DevTeam!
Adding bpytop (former Bashtop) for local monitoring of pfSense-based firewall state: hardwar... Sergei Shablovsky
03:26 PM Bug #8576 (Feedback): pfSense stops passing traffic after some time when using Outbound NAT pool w/ Sticky Address: There is not enough information to reasonably infer much. It's highly unlikely that all interfaces would stop passing... Marcos M
03:08 PM pfSense Docs Correction #11399: SG-3100 M.2 Installation Guide Reinstall Corrections: 1. I believe "run recovery" wipes emmc, so separate instructions here may not be needed.
2. It would be handy to hav... Marcos M
01:51 PM Revision 5e9b5483: Fix WireGuard add/next name behavior. Fixes #11407: * No need to set index when creating a new entry
* WireGuard interface name label was assuming array index=wg if name... Jim Pingle
01:50 PM Revision 11fd7da7: Fix WireGuard add/next name behavior. Fixes #11407: * No need to set index when creating a new entry
* WireGuard interface name label was assuming array index=wg if name... Jim Pingle
01:15 PM Bug #7313 (Closed): Crazy behviour of Virtual IP: Marcos M
12:42 PM Feature #11406 (Pull Request Review): GUI option to set MTU for L2TP VPN server: Jim Pingle
06:59 AM Feature #11406: GUI option to set MTU for L2TP VPN server: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/133 Viktor Gurov
06:33 AM Feature #11406 (Resolved): GUI option to set MTU for L2TP VPN server: Allow to set MTU on L2TP VPN server (useful for IPsec/L2TP configurations) Viktor Gurov
12:36 PM pfSense Packages Feature #11405 (Pull Request Review): add RPKI route map in GUI: Jim Pingle
02:16 AM pfSense Packages Feature #11405: add RPKI route map in GUI: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/50
see https://docs.frrouting.org/en/latest/bgp.... Viktor Gurov
01:54 AM pfSense Packages Feature #11405 (Resolved): add RPKI route map in GUI: Allow to select `match rpki` in the WebGUI:... Viktor Gurov
12:35 PM pfSense Packages Bug #11404 (Pull Request Review): Incorrect prefix/access lists migration on update: Jim Pingle
01:51 AM pfSense Packages Bug #11404: Incorrect prefix/access lists migration on update: fix:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/49 Viktor Gurov
12:04 AM pfSense Packages Bug #11404 (New): Incorrect prefix/access lists migration on update: https://forum.netgate.com/topic/160694/frr-7-3-7-5-bgp-not-announcing-routes:
I notice it now has an IP type selec... Viktor Gurov
12:34 PM Bug #11403 (Pull Request Review): DNS Resolver does not add a ``local-zone`` type for ``ip6.arpa`` domain override: Jim Pingle
12:12 PM Bug #11409 (Closed): IPv4 MSS value is incorrectly applied to IPv6 packets: Follows from discussion at https://forum.netgate.com/topic/152935/ipv6-pppoe-mss-incorrect/.
When setting up MSS c... Michael Smith
10:53 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: Yeah I can do that at a later date. I will keep it out of this report now. Chris Collins
10:47 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: At this point I'd say open a new and more specific bug report for that once you have all the info collected and re-te... Jim Pingle
10:43 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: It did work yes, the reason for the configuration is, the firewall is in front of a webserver, and I want people who ... Chris Collins
10:40 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: Chris Collins wrote:
> It goes into a black hole on inbound WAN matching.
>
> If I keep the match rule but remove... Jim Pingle
10:25 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: I only have it configured with ipv4. Chris Collins
10:04 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: Chris Collins wrote:
> Ok to summarise.
>
> It works on outbound WAN matching (this was broken before the patch).... Jesse Beauclaire
03:11 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: Ok to summarise.
It works on outbound WAN matching (this was broken before the patch).
It works on inbound and ou... Chris Collins
02:59 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: I updated to the latest stable (new RC 2.5)
Sadly I still have the same problem, I am still checking stuff to make... Chris Collins
10:35 AM pfSense Packages Feature #11408 (Rejected): Store 'Device Key' in config.xml: This would be better served by #11118 Jim Pingle
10:07 AM pfSense Packages Feature #11408 (Rejected): Store 'Device Key' in config.xml: Storing the ACB device key in config.xml allows users to use the latest config.xml backup as a safe copy of the Devic... Viktor Gurov
08:00 AM Bug #11407 (Feedback): Removing a WireGuard tunnel in a middle position can break Add button behavior: Applied in changeset commit:11fd7da72502c991b1f1c0e886ea212235f4a505. Jim Pingle
07:40 AM Bug #11407 (Closed): Removing a WireGuard tunnel in a middle position can break Add button behavior: If there are three WireGuard tunnels (wg0, wg1, wg2) and the middle tunnel (wg1) is removed, the add button links to ... Jim Pingle
06:59 AM Bug #10734: PFsense don't use wrong proposals: Same issue here.
P1 settings:
AES, 256 bits, SHA1, DH group 2 (1024 bit)
AES, 256 bits, SHA256, DH group 2 (1024... Petr H
04:43 AM pfSense Packages Bug #11391 (Confirmed): Zeek crashes on 2.5.0: running `zeekctl deploy` fixes this issue Viktor Gurov
03:49 AM pfSense Packages Bug #11381 (Resolved): PHP error after clean Zeek install: Fixed Viktor Gurov
03:42 AM pfSense Packages Feature #10605 (Resolved): Add certificates from Trusted Store to Squid cert store: squid pkg 0.4.45_3 - fixed Viktor Gurov
03:35 AM Feature #11402: Xen console support: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/132 Viktor Gurov
02:17 AM Bug #11397 (Resolved): Incorrect html encoding in the description of the "Duplicate gateway" option: 2.5.0.r.20210211.1637 fixed Viktor Gurov
02:11 AM Bug #11364: php-fpm and netstat taking very high CPU: Turns out my issue was unrelated. My issue was https://redmine.pfsense.org/issues/11404
My instance was accepting... M Felden

02/11/2021

11:58 PM Bug #11403: DNS Resolver does not add a ``local-zone`` type for ``ip6.arpa`` domain override: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/131 Viktor Gurov
11:45 PM Bug #11403 (Resolved): DNS Resolver does not add a ``local-zone`` type for ``ip6.arpa`` domain override: If you configured domain override for the *.in-addr.arpa domain it correctly sets the zone type to `typetransparent`:... Viktor Gurov
11:47 PM pfSense Packages Bug #11373 (Resolved): FRR: BGP neighbor remote-as external doesn't work: Viktor Gurov
11:47 PM pfSense Packages Bug #11376 (Resolved): BGP MD5 keys are not removed on service stop: Viktor Gurov
11:37 PM Feature #11402 (Closed): Xen console support: To be able to use `xm console` to connect to the pfSense console,
the following line must be added to '/etc/ttys':
... Viktor Gurov
11:31 PM Bug #5999 (Resolved): IPv6 IP Alias prevents Track Interface from working with DHCPv6 and RA: my test:
DHCPv6 server with fc00:623:5::-fc00:623:50:: /52 PD
pfSense 2.5.0.r.20210211.1637 client with two IP ... Viktor Gurov
08:27 PM Revision 1bc20f0d: Handle case where copyright file is downloaded but has a size of zero: Steve Beaver
08:26 PM Revision c7e8d310: Handle case where copyright file is downloaded but has a size of zero: Steve Beaver
07:52 PM Bug #11364: php-fpm and netstat taking very high CPU: ps aux
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
root 88102 29.8 0.2 52392 ... yon Liu
07:44 PM Bug #11364: php-fpm and netstat taking very high CPU: vmstat 1 5
procs memory page disks faults cpu
r b w avm fre flt re ... yon Liu
11:17 AM Bug #11401 (Feedback): Upgrade broken due to need to reinstall pkg: Fixed by pfSense-upgrade 0.88 on 2.4.5 and 0.91 on 2.5.0/2.6.0 Renato Botelho
10:52 AM Bug #11401 (Resolved): Upgrade broken due to need to reinstall pkg: Sometimes, without any good reason, pkg doesn't download itself when running `pkg upgrade -F` but then, when final `p... Renato Botelho
10:45 AM Revision 3c97d1b7: Do not exclude unlisted package: Renato Botelho
10:44 AM Revision b0ac3491: Do not build unused packages: Renato Botelho
10:44 AM Revision 998c898f: Do not build unused packages: Renato Botelho
09:24 AM Bug #9643 (Closed): Limiters do not function properly on 2.5 snapshots: Luiz Souza
08:02 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: Make a post on the forum and discuss it there, that's the best way to diagnose your issue. Jim Pingle
07:58 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: Jim Pingle wrote:
> That doesn't appear to be related to this specific issue, it looks like a problem with your rule... Jesse Beauclaire
07:55 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: That doesn't appear to be related to this specific issue, it looks like a problem with your rule / state of your system. Jim Pingle
07:53 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: I'm not sure if this is related, my understanding of this is limited. After creating/enabling CODEL traffic limiters ... Jesse Beauclaire
07:05 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: Looks good here as well. Not only can I pass traffic with limiters on, I am back to an A on the bufferbloat test than... Jim Pingle
05:38 AM Bug #9643 (Resolved): Limiters do not function properly on 2.5 snapshots: Renato Botelho
01:01 AM Bug #9643: Limiters do not function properly on 2.5 snapshots: I can confirm working too. Greg M
08:58 AM Bug #11393: Incorrect copyright year on 2.5.0-RC (CE): issue on https://ews.netgate.com/copyright... Viktor Gurov
08:26 AM Bug #3334: Status/Traffic Graph isn't IPv6 ready: Thank you for pointing that out. Now it shows IPv6 addresses. Great work. Pim Pish
07:44 AM Bug #3334: Status/Traffic Graph isn't IPv6 ready: It doesn't change to the new mode automatically. You have to change it from rate to iftop..
* *Status > Traffic Gr... Jim Pingle
02:07 AM Bug #3334: Status/Traffic Graph isn't IPv6 ready: I've upgraded to pfSense 2.5 RC but still there are no IPv6 addresses shown in the traffic graph for me. What am I do... Pim Pish
07:42 AM Bug #8136 (Resolved): dpinger for WAN DHCPv6 gets fails to update gateway IP: No more reports but it's not happening anymore on my home router, so I believe it's safe to say it's resolved. Renato Botelho
01:08 AM pfSense Packages Bug #11392: FRR - Advanced Routing Behavior - Network Import Check: Flag should be reversed: Ok I am up and running now and after some testing I can rephrase the issue more clearly.
- We have some changes be... M Felden

Also available in: Atom

Project

General

Profile

pfSense

Activity

Activity

03/12/2021

03/11/2021

03/10/2021

03/09/2021

03/08/2021

03/07/2021

03/06/2021

03/05/2021

03/04/2021

03/03/2021

03/02/2021

03/01/2021

02/28/2021

02/27/2021

02/26/2021

02/25/2021

02/24/2021

02/23/2021

02/22/2021

02/21/2021

02/20/2021

02/19/2021

02/18/2021

02/17/2021

02/16/2021

02/15/2021

02/14/2021

02/13/2021

02/12/2021

02/11/2021