Project

General

Profile

Activity

From 11/18/2023 to 12/17/2023

12/17/2023

04:17 PM Feature #12521: Add the BBR2, QUIC, RACK Congestion Control (CC) protocols
hao zhang wrote in #note-3:
> https://man.freebsd.org/cgi/man.cgi?query=tcp_bbr&apropos=0&sektion=0&manpath=FreeBSD+...
Sergei Shablovsky
03:11 AM pfSense Plus Bug #15097: Upgrade to 23.09.1 is not offered for 23.05.1
Can confirm that this seems to consistently happen basically every time someone upgrades from 23.01 to 23.05.1. Kris Phillips
03:04 AM pfSense Packages Bug #15100 (New): Tailscale IPv6 Exit Node uses first LAN interface when WAN is set to Only Request Prefix
When Tailscale on pfSense Plus is being used as an exit node for IPv6 connectivity and the WAN interface is set to "O... Kris Phillips
02:58 AM pfSense Packages Feature #14453: Expand prefix list entry window
Any update on this?
The workaround is to go into the pfsense shell, go into the FRR cli <vtysh> and examine the pref...
Mike Moore

12/16/2023

10:51 PM Bug #13413 (Pull Request Review): Some messages presented to users contain relative links to pages which may be invalid when triggered from certain packages
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/1111
I wasn't able to reproduce the error with Wiregua...
Christopher Cope
08:29 PM Bug #15067 (Confirmed): Secondary node attempts to delete the ``admins`` group when synchronizing accounts via XMLRPC
After applying the fix, the errors are no longer present with the admins group, but assigning / removing any other gr... Christopher Cope
02:49 PM pfSense Packages Feature #15099 (Closed): ACME: please update GUI to include recently added DNSapi providers.
Please update GUI to include DNS API providers like DnsExit.com that was recently added to acme.sh.
https://github...
Michael C
11:35 AM Bug #15057: Router Advertisement daemon does not prioritize IPv6 GUA over ULA
I rolled back my change to get_interface_track6ip to show you what it returns with the original code... Mathis Cavalli
07:05 AM Bug #14691: Separators get shifted when copying firewall rules between interfaces
old separators Jonathan Lee
07:05 AM Bug #14691: Separators get shifted when copying firewall rules between interfaces
@ <separator>
<wan></wan>
<lan></lan>
<opt1></opt1>
<floatingrules></floatingrules>
...
Jonathan Lee
06:30 AM Bug #14619: Rule separators are ordered incorrectly after removing rules in certain positions
I still have issues with this in 23.05.01 and they all show up again in 23.09.01
I stopped using separators howev...
Jonathan Lee

12/15/2023

11:08 PM Bug #15057 (Incomplete): Router Advertisement daemon does not prioritize IPv6 GUA over ULA
Marcos M
10:59 PM Regression #14987 (Not a Bug): ``Interface Address`` is no longer an option for outbound NAT targets
The "Interface Address" selection is no longer available due to general changes to the outbound NAT pages which bring... Marcos M
08:29 AM Regression #14987: ``Interface Address`` is no longer an option for outbound NAT targets
I've tested on 23.09.1. Indeed, there is no Tailscale address from the drop-down menu in the translation section.
...
Danilo Zrenjanin
10:55 PM Bug #15098: Wireguard crashes on boot if PPPoE is the default gateway
restarting the gateway service also solves it.
Edit: Also happens with an DHCP interface as default gateway
Oskar Stroka
10:38 PM Bug #15098: Wireguard crashes on boot if PPPoE is the default gateway
changing a static route, even disabling and re-enabling one, allows wireguard to be enabled again Oskar Stroka
08:06 PM Bug #15098 (New): Wireguard crashes on boot if PPPoE is the default gateway
This only seems to happen after a fresh boot, and only if any PPPoE connection is the default gateway.
Even the ser...
Oskar Stroka
08:51 PM Bug #14967 (Resolved): Cannot disable Router Advertisements when the interface IPv6 configuration is set to ``None``
Marcos M
08:50 PM Bug #15096 (Resolved): Interface subnet aliases do not contain IPv6 VIPs
Marcos M
05:22 PM Bug #15096: Interface subnet aliases do not contain IPv6 VIPs
Works like a charm! cheers! gwab ber
04:58 PM Bug #15096: Interface subnet aliases do not contain IPv6 VIPs
Patch working great, thanks. Bob Dig
04:50 PM Bug #15096: Interface subnet aliases do not contain IPv6 VIPs
Patch is woring, table now contain the IPV6 alias IP
tested on ...
Lev Prokofev
04:20 PM Bug #15096: Interface subnet aliases do not contain IPv6 VIPs
Applied in changeset commit:1c4ca20d3d5910f126f11221f23e1fa21197f225. Marcos M
04:14 PM Bug #15096 (Feedback): Interface subnet aliases do not contain IPv6 VIPs
Fixed in commit 1c4ca20d3d5910f126f11221f23e1fa21197f225. Marcos M
12:01 PM Bug #15096: Interface subnet aliases do not contain IPv6 VIPs
I fixed it temporarely by adding separate allow rule for the ULA. gwab ber
11:58 AM Bug #15096: Interface subnet aliases do not contain IPv6 VIPs
I just looked, created gua and ula on one of my interfaces - and while the gua is shown, the ula is missing.
I cre...
JohnPoz _
11:22 AM Bug #15096 (Resolved): Interface subnet aliases do not contain IPv6 VIPs
While the tables _NETWORK not reflecting any IPv6 ULA as VIP at all, an ULA IPv6 connection from LAN is working while... Bob Dig
07:24 PM pfSense Docs Todo #15095 (Closed): Feedback on Installing and Upgrading — Upgrade Guide — Upgrading High Availability Clusters
You are correct, that bit isn't relevant anymore. I've removed it, the updated version will be online in a few minute... Jim Pingle
06:29 PM pfSense Plus Bug #15097 (Resolved): Upgrade to 23.09.1 is not offered for 23.05.1
Since the release of 23.09.1, devices that upgrade to 23.05.1 from a previous version are unable to upgrade to 23.09.... Kris Phillips
04:12 PM Revision 1c4ca20d: Include IPv6 VIPs in system subnet aliases. Fix #15096
Marcos M
11:42 AM Bug #15041: Icmp payload default of 0 can give issues as this is not a official supported value as monitoring of a gateway.
I understand that the value already can be edited, and that the default payload is 1 instead of zero does not change ... Leon Straathof

12/14/2023

07:23 PM Feature #6362 (New): Allow specifying the client identifier hardware type
From what I've gathered so far, this is not a bug. RFC2132 states:... Marcos M
05:40 PM Feature #6362: Allow specifying the client identifier hardware type
Carlo Tognetti wrote in #note-4:
> Still present in rel. 2.7.1
> The bug have been persisting on all releases in th...
Kris Phillips
05:27 PM pfSense Docs Todo #15095 (Closed): Feedback on Installing and Upgrading — Upgrade Guide — Upgrading High Availability Clusters
*Page:* https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide-ha.html
*Feedback:*
I believe this is in...
Steve Y
04:39 PM Regression #15094 (Resolved): Updates fail against an authenticated upstream proxy
When an upstream authenticated proxy is defined pkg commands fail, appearing to use the defined proxy but not send lo... Steve Wheeler
01:34 PM Bug #15092 (Not a Bug): OPT*_NETWORK tables are showing in Diagnostics - Tables
The page lists all PF tables, and those are now handled as PF tables. Hiding them would be counterintuitive as users ... Jim Pingle
10:52 AM Bug #15092 (Not a Bug): OPT*_NETWORK tables are showing in Diagnostics - Tables
After upgrading to 2.7.2 (or 2.7.1, not sure exactly when it started) a lot of "subnets of this interface" objects ap... Oleksii Tucha
01:31 PM Bug #15093 (Duplicate): Unable to install update 2.7.2 due to EFI error
Duplicate of #15081 Jim Pingle
11:59 AM Bug #15093 (Duplicate): Unable to install update 2.7.2 due to EFI error
Hi there,
I'm trying to install v2.7.2 on out PFSense Firewall, unforunately #15007 seems to have introduced a pr...
Lukas Fülling
10:56 AM Bug #15081: Upgrade fails due to undersized EFI filesystem
Do old efifat images match well-known hashes? If so, look for a partition matching the hash (maybe a bunch of differe... Luca Piccirillo
10:44 AM pfSense Packages Feature #15091 (New): FRR, add the ability to change the order of BGP neighbours
Hi!
I currently have over 20 bgp peers, and it's getting awkward to add new peers to an existing group as they app...
Oleksii Tucha

12/13/2023

09:10 PM Regression #15074: ISO fails to boot UEFI
Jim Pingle wrote in #note-1:
> Also note that adding a serial port to the VM hardware in Proxmox VE works around the...
Phil Duby
06:52 PM pfSense Packages Feature #9833: ACME: add ability to use custom ACME server
+1 also. Stephen Nelson
03:57 PM Bug #15043: IGMP proxy works intermittently
Hi Kristof, there have been quite some igmpproxy regressions in the past releases. I’m always anxious when applying a... Haraldinho D
01:17 PM Bug #15043: IGMP proxy works intermittently
Okay, thanks for confirming.
The relevant fixes are:
https://reviews.freebsd.org/D43031
https://reviews.freebsd....
Kristof Provost
01:49 PM Feature #15090 (New): Improve feedback from config recovery during install
When you run the recover config option during an install there is little to no feedback to the user. It's not clear w... Steve Wheeler
07:51 AM Regression #15005 (Resolved): Auto Config Backup times are incorrect
Yep, I can confirm it's working as expected on 23.09.1.
I am marking this ticket resolved.
Danilo Zrenjanin
12:54 AM Regression #15005 (Feedback): Auto Config Backup times are incorrect
The ACB server is now using the expected timezone. Backups report the correct time.
Tested: 23.09.1
Steve Wheeler

12/12/2023

10:46 PM Feature #15089: Support LuaDNS provider
I've opened a pull request in Github; https://github.com/pfsense/pfsense/pull/4663 Aaron Sierra
10:44 PM Feature #15089 (Resolved): Support LuaDNS provider
"LuaDNS":https://luadns.com is supported by the *acme* package, so it would be nice if it were also supported as a Dy... Aaron Sierra
09:52 PM Bug #15057: Router Advertisement daemon does not prioritize IPv6 GUA over ULA
I'm not able to replicate this on 23.09 (should be the same as 2.7.1 for this issue). Regardless of whether the ULA c... Marcos M
07:43 PM pfSense Packages Bug #15088 (Confirmed): BIND does not start after a config restore
Steps:
# Fresh install of pfSense+ 23.09.1
# Install bind package
# Restore a config backup with bind configuratio...
Marcos M
07:36 PM Bug #15043: IGMP proxy works intermittently
Kristof Provost wrote in #note-18:
> I believe I've found the reason we don't send an igmp leave when we should, alo...
Rai Wol
06:45 PM Bug #15043: IGMP proxy works intermittently
!clipboard-202312121942-zfdcl.png!
Seems to work like a charm!! No more streams that stop and it also shows in the...
Haraldinho D
06:16 PM Bug #15043: IGMP proxy works intermittently
I believe I've found the reason we don't send an igmp leave when we should, along with the cleanup improvements for M... Kristof Provost
09:49 AM Bug #15043: IGMP proxy works intermittently
Kristof, I sent logs on rc.newwanip occurrence per email. Haraldinho D
09:27 AM Bug #15043: IGMP proxy works intermittently
It's also not clear to me why igmpproxy shuts down.
The only thing I can think of right now is that there's a new ...
Kristof Provost
09:09 AM Bug #15043: IGMP proxy works intermittently
Haraldinho D wrote in #note-14:
> I have pfSense+ 23.09.1, not 2.7.2, so probably this patch is not for me... Can yo...
Kristof Provost
07:22 PM Feature #15073 (Rejected): FEATURE REQUEST: Ability at assign authenticated NTP settings under User manager separate from just NTP settings to hide keys
I don't think the benefit of this is worth the effort and technical debt. Marcos M
05:22 PM Bug #15087 (New): IPsec Keep Alive does not update the gateway status
If the IPsec gateway status is pending (e.g. on a VTI after bootup when the remote peer is an FQDN), the keep alive c... Marcos M
01:22 PM pfSense Packages Bug #15086 (Rejected): openvpn-client-export 1.9.2 | Viscosity Bundle | ECDSA cert missing key
Export VPN cert/settings as viscosity bundle do not include the key.key if the cert is ECDSA / secp521r1.
If the c...
slu -
09:16 AM pfSense Packages Bug #14668: FRR BGP route is not making into kernel route table after WireGuard's peer change is applied
CE 2.7.2, FRR 2.0.2_1 (frr9-9.0.2), WireGuard 0.2.1 - still the same. Oleksii Tucha
09:10 AM pfSense Packages Feature #14878: Integrated syslog support
Unfortunately I cannot code myself, so I have to ask for changes in detail instead. I think the solution should be ma... Tue Madsen
06:01 AM Feature #8794: NTP authentication support
Just to confirm Marcos M, I could not use NTP authentication direct for NIST.GOV without the two part key entry, with... Jonathan Lee
01:10 AM Feature #8794: NTP authentication support
Some general notes:
* The authentication key is only supported with the @peer@ and @server@ types according to the "m...
Marcos M
04:43 AM Regression #14987: ``Interface Address`` is no longer an option for outbound NAT targets
I am running 23.09.1. The Tailscale address is still missing from the pull-down menu in the translation section. In t... Chad Wagner
04:28 AM Regression #14987: ``Interface Address`` is no longer an option for outbound NAT targets
UPDATE:
I see the Tailscale interface has now been added back in 23.09.1
Please update the ticket to let us know ...
Mike Moore
04:25 AM Regression #14987: ``Interface Address`` is no longer an option for outbound NAT targets
I second this issue. Is there a workaround.
If you are using tailscale to set a Site2Site VPN then traffic leaving t...
Mike Moore
02:22 AM Regression #14987: ``Interface Address`` is no longer an option for outbound NAT targets
Is there a workaround until this gets fixed? Chad Wagner

12/11/2023

08:19 PM pfSense Packages Bug #11970: Netgate Firmware Upgrade Doesn't Work on XG-2758 (ADI/coreboot)
Jordan G wrote in #note-3:
> user reporting fw upgrade failing on 7100 @ 23.09.1 (ref # 2156023693)
>
> [...]
...
Marcos M
08:02 PM Bug #15043: IGMP proxy works intermittently
I have pfSense+ 23.09.1, not 2.7.2, so probably this patch is not for me... Can you build one for 23.09.1? Haraldinho D
07:55 PM Bug #15043: IGMP proxy works intermittently
Kristof Provost wrote in #note-12:
> Backup your device, download the pkg file to it, "pkg install -U pfSense-kernel...
Rai Wol
07:50 PM Bug #15043: IGMP proxy works intermittently
Backup your device, download the pkg file to it, "pkg install -U pfSense-kernel-pfSense-2.7.2.r.20231211.1745.pkg" an... Kristof Provost
07:41 PM Bug #15043: IGMP proxy works intermittently
Hey Kristof, I just sent you some additional logs + the netstat -gs output as well in your email. Happy to try the pa... Haraldinho D
07:08 PM Bug #15043: IGMP proxy works intermittently
Here's that patched kernel: https://nc.netgate.com/nextcloud/index.php/s/L9ERQHXbtygQHrt
Can someone try that one ...
Kristof Provost
02:09 PM Bug #15043: IGMP proxy works intermittently
netstat -gs might be interesting too.
Looking at the igmpproxy log there appear to be two things going on. The fir...
Kristof Provost
07:42 PM Feature #15085: Update /etc/rc.initial to reflect default root shell /bin/sh
I think this would benefit the user base because sh has many of the features of bash now and people are familiar with... Craig Coonrad
07:25 PM Feature #15085 (Rejected): Update /etc/rc.initial to reflect default root shell /bin/sh
We chose tcsh for a reason there. We weren't following FreeBSD. The previous default was csh, not tcsh. Jim Pingle
07:22 PM Feature #15085 (Rejected): Update /etc/rc.initial to reflect default root shell /bin/sh
/bin/sh is now the default root shell in FreeBSD (and pfSense.)... Craig Coonrad
06:54 PM Bug #15082: Upgrade fails due to unmounted EFI filesystem
It appears this isn't actually fixing what the users thought it was. By manually mounting the partition it caused the... Jim Pingle
02:10 PM Bug #15082 (Closed): Upgrade fails due to unmounted EFI filesystem
This may be related to #15081 but it's not definite.
Some upgrades have failed in pfSense-boot if the EFI partitio...
Jim Pingle
06:25 PM pfSense Packages Bug #15033 (Resolved): Suricata rule lists can't be manually updated unless the ETOpen Emerging Threats list is enabled
PRs merged, thanks! Jim Pingle
06:24 PM pfSense Packages Bug #15080 (Resolved): Suricata process dying due to Hyperscan error - also may randomly segfault
PRs merged, thanks! Jim Pingle
06:24 PM pfSense Packages Bug #14898 (Resolved): Suricata core dumps with signal 11
PRs merged, thanks! Jim Pingle
05:59 PM pfSense Packages Regression #14189: pfBlocker-NG: HA-Sync is not working
comparing:
https://github.com/pfsense/FreeBSD-ports/blob/734989ab5809fe5c7bde23a240e717da656775ac/net/pfSense-pkg-pf...
Steve Y
05:23 PM Bug #15083: Installing to ZFS mirror does not format or populate EFI partition on additional disks
Note that this is not specific to pfSense, the problem also exists in FreeBSD. There is a review in progress to addre... Jim Pingle
04:28 PM Bug #15083 (Resolved): Installing to ZFS mirror does not format or populate EFI partition on additional disks
Installing Plus 23.09.1 or CE 2.7.2 to a ZFS mirror does not format or populate the EFI partition on the additional d... Jim Pingle
05:19 PM Feature #15079: Remove spaces from filenames generated by status.php
Every file in the status output has one or more dashes except one: Config History.txt. This change makes that consist... Craig Coonrad
01:31 PM Feature #15079 (Rejected): Remove spaces from filenames generated by status.php
I don't see the value in this. Properly quoting filenames or escaping spaces is trivial in this day and age, and chan... Jim Pingle
04:56 PM Bug #15084 (Resolved): Upgrading an EFI system installed to ZFS mirror does not upgrade EFI loader on additional disks
When an EFI system installed to a ZFS mirror is upgraded, the EFI loader is only updated on the first disk of the mir... Jim Pingle
02:01 PM Bug #15081 (New): Upgrade fails due to undersized EFI filesystem
Some installations as recent as Plus 22.01 / CE 2.6.0 have EFI partitions that were created and/or populated by the o... Jim Pingle

12/10/2023

10:11 PM pfSense Packages Bug #11970: Netgate Firmware Upgrade Doesn't Work on XG-2758 (ADI/coreboot)
user reporting fw upgrade failing on 7100 @ 23.09.1 (ref # 2156023693)... Jordan G
06:38 PM pfSense Packages Bug #15033: Suricata rule lists can't be manually updated unless the ETOpen Emerging Threats list is enabled
A fix for this issue has been submitted via this pull request against the RELENG_2_7_2 branch: https://redmine.pfsens... Bill Meeks
04:38 PM Feature #6362: Allow specifying the client identifier hardware type
Still present in rel. 2.7.1
The bug have been persisting on all releases in the last 7 years.
While I'm grateful to...
Carlo Tognetti
11:45 AM Bug #15043: IGMP proxy works intermittently
If required I can deliver data too. I also suffer from this issue, but as I don't watch a lot of linear TV, I have 23... Haraldinho D
10:49 AM pfSense Packages Feature #14878: Integrated syslog support
I completely agree. The lack of integrated SYSLOG support (independent of local pfBlockerNG logging) is a MAJOR drawb... Tue Madsen
04:55 AM pfSense Packages Bug #14898: Suricata core dumps with signal 11
Pull request 1333 for the RELENG_2_7_2 branch of FreeBSD-ports has been submitted to address this issue.
https://git...
Bill Meeks
04:55 AM pfSense Packages Bug #14491: FRR not starting with AgentX enabled
Mike Moore wrote in #note-10:
> Found a use case for AgentX and ran into the frr start.
>
> Jim - i see the targe...
Jim Pingle
04:52 AM pfSense Packages Bug #14491: FRR not starting with AgentX enabled
Found a use case for AgentX and ran into the frr start.
Jim - i see the target versions have been deleted. Does th...
Mike Moore
04:50 AM pfSense Packages Bug #15080: Suricata process dying due to Hyperscan error - also may randomly segfault
Pull request 1333 for the RELENG_2_7_2 branch of FreeBSD-ports has been submitted to address this issue.
https://git...
Bill Meeks
04:31 AM pfSense Packages Bug #15080 (Resolved): Suricata process dying due to Hyperscan error - also may randomly segfault
Several users on the Netgate Forum are reporting random issues with Suricata failing due to the following Hyperscan e... Bill Meeks
01:18 AM pfSense Packages Todo #14073: Shalla block list is offline but still available in pfBlocker
This is an issue on the pfSense Plus 23.09.X branch still. Kris Phillips
01:16 AM pfSense Packages Bug #13810 (Rejected): Squid options obsolete
Marking this as Rejected since Squid is being deprecated and removed in a future version of pfSense CE and Plus. Kris Phillips
01:14 AM pfSense Packages Feature #14447 (Resolved): Update haproxy from 2.6 to 2.8 lts
Marking this as resolved. pfSense Plus 23.09 and 23.09.1 both have haproxy 2.8.2 for the backend on stable. Kris Phillips
01:09 AM pfSense Plus Bug #15006: Upgrade Issue to 23.09 Results in Stuck Prompt Mid-upgrade
This seems to be present with 23.09.1 as well. Kris Phillips
12:38 AM Bug #14261: Trim white space in a DHCP Leases page search field
Updated merge request to reflect feedback and to only trim on values where a space doesn't make sense. Christopher Cope
12:01 AM Bug #14989 (Pull Request Review): Typo in the Setup Wizard
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/1110 Christopher Cope

12/09/2023

10:41 PM Regression #14930: Clean installation using Auto (ZFS) + MBR (BIOS) does not boot
Christian McDonald wrote in #note-2:
> Yes, I proposed a fix for this upstream. I’ll poke the right people again
...
Boycee .
07:39 PM Feature #15079 (Rejected): Remove spaces from filenames generated by status.php
This eases filename expansion on the command line, and simplifies iterating over the files with commands or scripts. ... Craig Coonrad
06:59 PM Bug #14634: The default gateway icon is not updated when the default gateway is changed to none
The icon stays for me, when the default route is set to none. The changes were already applied and even after a reboo... Christopher Cope
03:37 PM Feature #15078 (New): Display all available updates on the dashboard
The available update information in the System Info widget should display all available upgrades.
Currently a devi...
Steve Wheeler
10:38 AM Bug #15069 (Resolved): Extra space in ``pkg`` configuration file ``FreeBSD.conf``
Tested the patch.
It removes the extra space.
Marking this case resolved.
Danilo Zrenjanin
09:49 AM Bug #15043: IGMP proxy works intermittently
I've ran the test.
The logs are included during my test time.
Also the netstat results are included.
Hope this ...
Remie van de Zande
09:14 AM Todo #13268 (Resolved): Dynamically adjust the interface name maximum width in the login banner
Tested the patch on the 23.09.1
It looks good.
I am marking this case resolved.
Danilo Zrenjanin
07:41 AM Bug #15071: Applying interface changes may not update default ACLs for the DNS Resolver
Tested the patch on ... Lev Prokofev
07:38 AM Bug #15071 (Resolved): Applying interface changes may not update default ACLs for the DNS Resolver
Tested the patch on 23.09.
The patch fixes all reported misbehavior.
I am marking this ticket reslvoed.
Danilo Zrenjanin

12/08/2023

10:25 PM Regression #15076 (Feedback): DHCP leases may not be restored from older configuration backups
Applied in changeset commit:192dba691e8441b7794482c3a196bed3422ee6ce. Marcos M
10:17 PM Regression #15076 (Pull Request Review): DHCP leases may not be restored from older configuration backups
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/1109 Marcos M
05:29 PM Regression #15076 (Resolved): DHCP leases may not be restored from older configuration backups
I noticed a '{' folder in /usr/local/www/ .
Drilling down, I find this file: "/usr/local/www/{/var/dhcpd/var/db/dh...
Matthew Fearnley
09:55 PM Revision 192dba69: Handle backuppath entries with multiple paths. Fix #15076
Marcos M
07:58 PM Bug #15042: Potential TCP connection denial of service attack from spoofed RST packets processed by PF
This has been announced by FreeBSD as "FreeBSD-SA-23:17.pf":https://www.freebsd.org/security/advisories/FreeBSD-SA-23... Jim Pingle
07:10 PM Bug #15067 (Feedback): Secondary node attempts to delete the ``admins`` group when synchronizing accounts via XMLRPC
Applied in changeset commit:3e0facb20fa46a13bf7b70d6ddb1970b00485eb2. Marcos M
06:59 PM Revision 3e0facb2: Fix off-by-one error when checking for system uid/gid. Fix #15067
Marcos M
06:38 PM Bug #15077 (Duplicate): Uncaught TypeError: Illegal offset type in /usr/local/www/interfaces.php:1996
Duplicate of #14949 -- already fixed in patches, and also in 23.09.1/2.7.2
Jim Pingle
06:29 PM Bug #15077 (Duplicate): Uncaught TypeError: Illegal offset type in /usr/local/www/interfaces.php:1996
After configuring the switch in my Netgate 2100 to put connector 4 of the LAN ports onto VLAN 4084,
I added a new in...
John Messenger
06:29 PM Bug #15071 (Feedback): Applying interface changes may not update default ACLs for the DNS Resolver
Fixed in fbc8d7d04dc5f7cbec65381b81dc5f4eed06a714. Marcos M
06:19 PM Revision fbc8d7d0: Check "all" when restarting unbound based on interface. Fix #15071
Marcos M
04:37 PM pfSense Packages Todo #15058 (Feedback): Remove Zabbix 4 Agent and Proxy
Zabbix 4 is EoL upstream Brad Davis
04:34 PM pfSense Packages Bug #14913 (Feedback): [Security] Zabbix packages need updating bec. of recent critical security CVEs
Done in 23.09.1 and 2.7.2 Brad Davis
04:33 PM Revision c0f95035: Retire Zabbix 4 now that they are EoL
Brad Davis
03:46 PM Revision b8c13d95: Use the correct fontawesome icon prefix
Marcos M

12/07/2023

10:42 PM pfSense Docs Correction #15075: Changing MSS for IPsec
Also the other popular VPN - OpenVPN - has their own way of changing MTU and MSS which should be added to the same do... Mike Moore
10:40 PM pfSense Docs Correction #15075 (Closed): Changing MSS for IPsec
The documentation states to change MSS for IPsec: https://docs.netgate.com/pfsense/en/latest/troubleshooting/low-thro... Mike Moore
06:52 PM pfSense Packages Feature #15072: [pfBlockerNG] RFE: Add ability to disable reverse DNS lookup for log entries
I've filed some initial work here: https://github.com/pfsense/FreeBSD-ports/pull/1331 Orion Poplawski
12:12 AM pfSense Packages Feature #15072 (New): [pfBlockerNG] RFE: Add ability to disable reverse DNS lookup for log entries
Currently pfBlockerNG logs the result of a reverse DNS lookup for a block IP address to ip_block.log and unified.log.... Orion Poplawski
06:03 PM Bug #13707: Unbound not binding to LAN on startup when explicitly set
I would like to help tshoot this issue but not here. Forums
As already stated this isnt the place for this and loggi...
Mike Moore
04:03 PM Bug #13707: Unbound not binding to LAN on startup when explicitly set
I am seeing this same issue on a typical setup with a Netgate 4100 (pfSense 23.09) and a Comcast Business modem with ... Anthony Gentile
05:55 PM Bug #15067 (Confirmed): Secondary node attempts to delete the ``admins`` group when synchronizing accounts via XMLRPC
A few notes after confirming this happens for me as well:
* The secondary node does have an @admins@ group in @/et...
Jim Pingle
05:44 PM Regression #15074: ISO fails to boot UEFI
Also note that adding a serial port to the VM hardware in Proxmox VE works around the issue. VMs with a serial port p... Jim Pingle
04:41 PM Regression #15074 (New): ISO fails to boot UEFI
In some cases the ISO image can fail to boot past the EFI framebuffer output when booted as UEFI.
It does not happ...
Steve Wheeler
02:47 PM Bug #14929 (Resolved): ``choparp`` service is not stopped after deleting Proxy ARP type Virtual IP addresses
I couldn't replicate the issue in 23.09.
I am marking this ticket as resolved.
Danilo Zrenjanin
01:11 PM Bug #15043: IGMP proxy works intermittently
MRT_DEL_MFC; Errno(49) is interesting. error 49 is EADDRNOTAVAIL, which can only be returned (for MRT_DEL_MFC at lea... Kristof Provost
12:20 AM Feature #15073 (Rejected): FEATURE REQUEST: Ability at assign authenticated NTP settings under User manager separate from just NTP settings to hide keys
A good patch has been developed by A1Mathew
https://forum.netgate.com/topic/162746/authenicated-ntp/28
https:/...
Jonathan Lee

12/06/2023

08:09 PM Revision 5060f7cf: Promote to 2.7.2-RELEASE
Brad Davis
05:38 PM Bug #15071: Applying interface changes may not update default ACLs for the DNS Resolver
Steve Wheeler wrote in #note-1:
> Resaving the Unbound config in the gui correctly creates the ACL file with the new...
Jim Pingle
05:22 PM Bug #15071: Applying interface changes may not update default ACLs for the DNS Resolver
Resaving the Unbound config in the gui correctly creates the ACL file with the new subnet.
It appears to not be tr...
Steve Wheeler
05:19 PM Bug #15071 (Resolved): Applying interface changes may not update default ACLs for the DNS Resolver
To reproduce:
1. Base install of pfSense Plus 23.09 with 1 LAN and 1 WAN
2. Activate an OPT interface and give it...
George Phillips
02:10 PM Bug #15069 (Feedback): Extra space in ``pkg`` configuration file ``FreeBSD.conf``
Applied in changeset commit:ea161f3bbb1748807e9829e995b8485d42a046e9. Jim Pingle
02:04 PM Revision ea161f3b: Remove bonus space. Fixes #15069
Jim Pingle
05:22 AM pfSense Plus Feature #15070: Script to fix: ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pfSense-repoc" error when downgrading boot environments
WARNING: DTB version is 6.4 while kernel expects 5.13, please update the DTB in the ESP
is also displayed when dow...
Jonathan Lee
05:14 AM pfSense Plus Feature #15070 (New): Script to fix: ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pfSense-repoc" error when downgrading boot environments
When using boot environments to move system back a version to last stable version users can no longer check for updat... Jonathan Lee
05:20 AM Feature #13377: Option to configure a custom value for the PHP memory limit
What is recommended for SG-2100MAX with 23.05.01 in use I can't remember I was using 128 I think but you guys are sho... Jonathan Lee
04:42 AM pfSense Packages Todo #15058: Remove Zabbix 4 Agent and Proxy
Is there a reason for it to be removed?
Jonathan Lee
04:35 AM Feature #8794: NTP authentication support
Thanks Matthew and Lamar I have confirmed this works as expected with GUI entry in pfSense Plus also patch needs to s... Jonathan Lee

12/05/2023

10:37 PM Bug #15069 (Resolved): Extra space in ``pkg`` configuration file ``FreeBSD.conf``
This is a small, non-impactful file format issue.
/usr/local/etc/pkg/repos/FreeBSD.conf...
Craig Coonrad
10:36 PM Feature #15068 (New): Show if an alias is currently in use
I would like to check if it is possible to include in a future release the ability to see if an alias is being used i... Marcelo Cury
08:40 PM Bug #15067 (Resolved): Secondary node attempts to delete the ``admins`` group when synchronizing accounts via XMLRPC
Version: 23.09-RELEASE
Error message:...
Craig Coonrad
07:58 PM Bug #15043: IGMP proxy works intermittently
I did a compare on the LAN and the WAN interface after changing TV channel. On the LAN interface I see a IGMP leave g... Rai Wol
07:35 PM Bug #15066: PHP allocation failure in pfsense-utils.inc
Jim Pingle wrote in #note-1:
> That function is used in a variety of places, including several dashboard widgets, th...
Alex Rosenberg
07:25 PM Bug #15066 (Feedback): PHP allocation failure in pfsense-utils.inc
It's failing on a line in @get_interface_info()@ where it is running a command to get pf statistics:... Jim Pingle
07:13 PM Bug #15066 (Duplicate): PHP allocation failure in pfsense-utils.inc
Plus 23.09 has been running without issue for some time until this crash report yesterday. No configuration changes o... Alex Rosenberg
07:27 PM Bug #15065 (Duplicate): igmpproxy works very unreliable, needs frequent restarts to watch television
Duplicate of #15043 -- we don't need two issues if it affects both, the original issue can be changed to note that. Jim Pingle
07:18 PM Bug #15065: igmpproxy works very unreliable, needs frequent restarts to watch television
I experience the same behavior on my SG3100 with 23.09. A fix would be highly appreciated.
Cornel van Mastrigt
06:03 PM Bug #15065 (Duplicate): igmpproxy works very unreliable, needs frequent restarts to watch television
Since upgrade to 23.09 igmpproxy works very unreliably.
When watching television the gateway logs produces the follo...
Remie van de Zande
05:20 PM Bug #13226 (Feedback): Disconnecting a user from Captive Portal may allow previously established connections to continue
Marcos M
04:44 PM Feature #11556: Kill states using the pre-NAT address
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/381
The php pfSense module has been updated to imp...
Marcos M
04:43 PM Feature #11556 (Feedback): Kill states using the pre-NAT address
Marcos M
03:34 PM Bug #15060: LDAP bind fails when authentication servers use different CA chains
As per Support reply to my #2138801585 ticket: "Unfortunately, what you are seeing is a limitation of the underlying ... Giovanni Vecchi
10:50 AM pfSense Packages Regression #15064 (Confirmed): Statis menu entry for APCUPSD leads to settings page, not status
if you call services/apcupsd in the gui you get the same result as if you call status/apcupsd. Both time you get the ... odo maitre

12/04/2023

07:32 PM Bug #15063 (Confirmed): vpn_openvpn_server.php: shows last used interface, after changing to multihome
How to reproduce:
1. Create openvpn server with interface "WAN" and protocol "UDP on IPv4 only"
2. Save config and ...
Grischa Zengel
07:16 PM Bug #15062 (New): cert_get_all_services doesn't check for unbound cert usage
cert_get_all_services in utils.inc doesn't look to see if unbound is using the referenced cert.
https://github.com/p...
Josh Stompro
07:11 PM Bug #15057: Router Advertisement daemon does not prioritize IPv6 GUA over ULA
Marcos M wrote in #note-1:
> Try this patch (apply with the system patches package):
> {{collapse
> [...]
> }}
...
Mathis Cavalli
05:57 PM pfSense Packages Bug #15061 (New): acme.sh nsupdate with challengealias is failing in certain cases
When using nsupdate with challengealias the wrong filename is used, therefore the script fails.... Seyfidin Hamraoui
05:40 PM Regression #14059 (Not a Bug): Old states are still used after a route change
Related: https://redmine.pfsense.org/issues/14630, https://redmine.pfsense.org/issues/15140
It seems like some sort ...
Marcos M
05:38 PM pfSense Packages Feature #14630 (New): FRR script hook for clearing states on routing changes
Marcos M
04:25 PM pfSense Packages Feature #14630 (Duplicate): FRR script hook for clearing states on routing changes
Though the behavior can be worked around in FRR specifically with a script hook, the issue itself is more general and... Marcos M
04:26 PM Bug #15060 (New): LDAP bind fails when authentication servers use different CA chains
The goal is to have 2 separate ldap databases, one for GUI/System authentication and one for OpenVPN authentication: ... Giovanni Vecchi
04:00 PM Todo #13268 (Feedback): Dynamically adjust the interface name maximum width in the login banner
Applied in changeset commit:f15e8e4fb1db624c04eeda8671c6b7fb34a87b03. Marcos M
03:52 PM Revision f15e8e4f: Dynamically adjust login banner interface max width. Fix #13268
Marcos M
03:50 PM Bug #14967 (Feedback): Cannot disable Router Advertisements when the interface IPv6 configuration is set to ``None``
Applied in changeset commit:0e5dec1906fc62e779321f688c35fdff1add2093. Marcos M
03:46 PM Revision b68e0c0c: Consolidate shaper input validation
Remove the duplicate function and integrate it with the rest of the
validate_input() methods.
do_input_validation() i...
Marcos M
03:38 PM Revision 0e5dec19: Allow disabling RA with no IPv6 config on the interface. Fix #14967
Marcos M
03:35 PM Feature #14728: Support for CD/DVD drives in the External Configuration Locator (ECL)
Applied in changeset commit:16e4d50ad554433d6d8f92a5b607de47a176d68c. Christopher Cope
03:31 PM Feature #14728 (Feedback): Support for CD/DVD drives in the External Configuration Locator (ECL)
Marcos M
03:10 PM Feature #14762: Support X25519 and X448 public key algorithms in certificates
See also: https://forum.netgate.com/post/1124620 Jim Pingle
03:08 PM Feature #15059 (Duplicate): openvpn server ed25519 certificate
Duplicate of #14762 Jim Pingle

12/03/2023

05:33 PM Feature #15059 (Duplicate): openvpn server ed25519 certificate
OpenVPN server web-page will not list in the drop-down for Server certificates, a properly imported certificate, if t... Fold right
05:19 PM pfSense Packages Regression #14452: Prometheus node_exporter generates errors with the default config
I enabled FreeBSD repos on 23.09 and installed node_exporter-1.6.1. Same error, does not resolve the issue. Craig Coonrad
01:31 AM pfSense Packages Todo #15058 (Resolved): Remove Zabbix 4 Agent and Proxy
Zabbix 4 is EOL and the packages will be removed upstream in a few weeks. We should remove these from the repos in a... Kris Phillips
01:24 AM pfSense Packages Bug #14913: [Security] Zabbix packages need updating bec. of recent critical security CVEs
There are also updated versions of zabbix-agent6, zabbix-proxy6, zabbix-agent5, zabbix-proxy5, zabbix-agent4, zabbix-... Kris Phillips
01:07 AM pfSense Packages Bug #14913 (Confirmed): [Security] Zabbix packages need updating bec. of recent critical security CVEs
Confirmed that the version in Plus 23.09, 23.09.1, and 2.7.X are all the vulnerable 6.4.5 version.
Freshports has ...
Kris Phillips
01:10 AM pfSense Packages Bug #14926 (Rejected): Squid Proxy contains critical vulnerabilities
Squid is deprecated as a package in pfSense CE and Plus. It's recommended that users remove this package as soon as ... Kris Phillips
12:56 AM pfSense Packages Feature #14999 (Rejected): Feature Request: Update Squid Package to Version 6.5 this was released on updated Nov 6
Squid is planned to be removed as an available package in the next version of pfSense CE and Plus.
https://www.n...
Kris Phillips
12:36 AM Feature #14728 (Pull Request Review): Support for CD/DVD drives in the External Configuration Locator (ECL)
Christopher Cope
12:20 AM Feature #14728: Support for CD/DVD drives in the External Configuration Locator (ECL)
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/1107 Christopher Cope
12:12 AM Revision 16e4d50a: etc/rc.ecl: Update CD/DVD logic. Fixes #14728
Christopher Cope

12/02/2023

11:33 PM Feature #14728 (In Progress): Support for CD/DVD drives in the External Configuration Locator (ECL)
Tested on... Christopher Cope
10:50 PM Regression #15005: Auto Config Backup times are incorrect
confirmed, if I make a backup now @ 16:50 the restore page shows the time stamp as 22:50. likewise my scheduled backu... Jordan G
10:24 PM Bug #14167: Auto Config Backup: Selected manual backups are not retained.
on 23.09 ACB adheres to the max entered under settings>manual backups to keep Jordan G
10:11 PM Bug #14967: Cannot disable Router Advertisements when the interface IPv6 configuration is set to ``None``
above patch seems to be effective on 23.09, prevents being caught in a loop of no IPv6, cannot disable RA, rinse, repeat Jordan G
05:22 PM Bug #15057 (Feedback): Router Advertisement daemon does not prioritize IPv6 GUA over ULA
Try this patch (apply with the system patches package):
{{collapse...
Marcos M
06:39 AM Bug #15057 (Resolved): Router Advertisement daemon does not prioritize IPv6 GUA over ULA
When saving or reloading radvd service, the conf file is regenerated
If the interface has a public track interface a...
Mathis Cavalli
03:30 AM pfSense Packages Bug #14523: PHP error when using an unsupported alias type in Advanced Rule Settings
I have narrowed it down to situation where 'Custom Source' alias name cannot be saved when using 'Host' type aliases ... Sengor K

12/01/2023

09:26 PM Bug #15007 (Closed): pfSense-boot does not update the EFI loader
Jim Pingle
08:32 PM pfSense Packages Feature #15056: Feature Request: Donate to Package Maintainer Button
https://forum.netgate.com/topic/184100/how-are-packages-supported
Lots of talk has started on this today, and man...
Jonathan Lee
08:31 PM pfSense Packages Feature #15056 (New): Feature Request: Donate to Package Maintainer Button
Maybe the packages, should have a button so donate button to send some money to maintainers. I recently learned that ... Jonathan Lee
08:07 PM Bug #15042 (Resolved): Potential TCP connection denial of service attack from spoofed RST packets processed by PF
The behavior seems to be correct on current snapshots. On snapshots before the fix it would fall into time_wait every... Jim Pingle
07:20 PM Bug #14917 (Closed): Mulicast traffic on a detached interface causes a panic
The original issue here is rare and difficult to reproduce, only affecting a small number of users. Since we don't ha... Jim Pingle
07:18 PM Feature #14887 (Closed): Add an appropriately named file to install images to indicate what they are
The Plus 23.09 and CE 2.7.2 images I've checked all seem to be OK. They each only have one file and it's appropriatel... Jim Pingle
06:52 PM Todo #15055 (Resolved): Allow the dashboard update widget to show new versions separately from the update page
Marcos M
06:26 PM Todo #10464 (Closed): Don't change the current update repo when new releases are available
Marcos M
05:15 PM pfSense Plus Bug #15040: ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pfSense-repoc"
stephenw10 fixed my issue with the linked library Boot Environment issue for plus
pkg-static upgrade -f pfSense-repoc
Jonathan Lee
04:45 PM pfSense Plus Bug #15040: ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pfSense-repoc"
This is plus with use of Boot environments Jonathan Lee
04:45 PM Bug #11452: pkg breakage related to yet to be installed 21.02 base system
https://redmine.pfsense.org/issues/15040 Jonathan Lee
04:24 PM Bug #14978 (Resolved): PHP error on ``services_dhcpv6.php`` if the configuration contains an empty ``dhcpv6`` section
That is normal if you don't fix the range after switching from tracked to static. The default values for tracked rang... Jim Pingle
04:18 PM Todo #15050 (Resolved): Update strongSwan to 5.9.11_3
This version is present in RC builds and appears to be operating normally. Jim Pingle
04:18 PM Todo #15049 (Resolved): Update OpenVPN to 2.6.8_1
This version is present in RC builds and appears to be operating normally. Jim Pingle
01:23 PM Bug #15034: FreeBSD-EN-23:16.openzfs: Potential ZFS file corruption
FreeBSD released their errata notice for this: https://www.freebsd.org/security/advisories/FreeBSD-EN-23:16.openzfs.asc Jim Pingle
08:06 AM Bug #15043: IGMP proxy works intermittently
Martial G wrote in #note-1:
> Also applies to pfSense Plus version 23.09 according to this article: https://forum.ne...
Remie van de Zande
07:52 AM Feature #8794: NTP authentication support
Added NTP Authentication key ID field to the GUI and config
https://github.com/pfsense/pfsense/pull/4658
Matthew Ray

11/30/2023

10:28 PM Revision 92573452: poudriere_bulk: remove frr8* and bump PHP to 8.3
Christian McDonald
08:28 PM Revision d8814ad6: Don't refresh the cache when visiting the update page. Fix #15055
Marcos M
08:25 PM Todo #15055 (Feedback): Allow the dashboard update widget to show new versions separately from the update page
Applied in changeset commit:cea9d2d02e49ea6bcac1b6bd0a00f1cf2a9d33e5. Marcos M
07:29 PM Todo #15055 (Resolved): Allow the dashboard update widget to show new versions separately from the update page
The update check on @System > Update@ (the update page) only checks within the selected branch, whereas the dashboar... Marcos M
07:33 PM Revision cea9d2d0: Don't refresh the cache when visiting the update page. Fix #15055
Marcos M
07:10 PM pfSense Docs Correction #15052 (Closed): SG-3100 reinstall procedure the image name is incorrect
Updated and deployed: https://gitlab.netgate.com/docs/pfsense-platforms/-/commit/4f3e78d209bf9da8eb60c3c8e4035dd943cc... Jim Pingle
10:48 AM pfSense Docs Correction #15052 (Closed): SG-3100 reinstall procedure the image name is incorrect
The docs says:... Danilo Zrenjanin
05:02 PM Bug #15054 (Resolved): Permissions on tmpfs RAM disk for ``/var`` are too lenient
The code in source:src/etc/rc.ramdisk_functions.sh#L133 configures any tmpfs RAM disk with @1777@ permissions, so bot... Jim Pingle
04:59 PM Todo #15053 (Closed): Update PHP to 8.3.x
Christian McDonald
04:52 PM Bug #15044 (Resolved): Route "Invalid argument" error during boot
Marking as resolved as the reproducer no longer fails:... Christian McDonald
04:41 PM Revision 63556af2: make.conf: move to PHP 8.3
Christian McDonald
01:57 PM Bug #14537: Nat Reflection changed behavior on pfsense 2.7
I have the same problem since I upgraded to 2.7.0 (also upgraded to 2.7.1 now, but the behavior is still the same).
I...
Tobias D.
09:20 AM Bug #14917: Mulicast traffic on a detached interface causes a panic
The relevant commit has also been cherry-picked in 2.7.2 and 23.09.1. Kristof Provost
12:52 AM Regression #15051 (Not a Bug): Host(s) Aliases using Domains fail to resolve
A very similar issue to this bug which has already been resolved: https://redmine.pfsense.org/issues/14947 which rega... John Smith

11/29/2023

08:45 PM Bug #15044 (Feedback): Route "Invalid argument" error during boot
https://cgit.freebsd.org/src/commit/?id=f818559774cb0c1516364c4beca361480fd68b5b Christian McDonald
08:31 PM Bug #15042 (Feedback): Potential TCP connection denial of service attack from spoofed RST packets processed by PF
Kristof pushed a fix for this to the Plus 23.09.1 and CE 2.7.2 branches. Jim Pingle
08:15 PM Bug #15042: Potential TCP connection denial of service attack from spoofed RST packets processed by PF
Updating subject. This is not specific to NAT. Jim Pingle
06:12 PM Bug #15042: Potential TCP connection denial of service attack from spoofed RST packets processed by PF
(Copy of what I just sent to secteam@FreeBSD.org)
Netgate received a report that there’s an issue with pf’s sequen...
Kristof Provost
08:27 PM pfSense Packages Regression #14452: Prometheus node_exporter generates errors with the default config
Still not working with pfSense 23.09 and node_exporter-1.5.0_6. I tested FreeBSD 14.0-RELEASE w/node_exporter-1.6.1. ... Craig Coonrad
07:51 PM pfSense Plus Bug #15017 (Incomplete): DHCP relay CARP status VIP function is not working in pfsense+ 23.09
I was not able to replicate this on 23.09 - toggling maintenance mode on/off on the master correctly stops/starts the... Marcos M
07:51 PM Todo #15050 (Feedback): Update strongSwan to 5.9.11_3
Commits to bring strongSwan up to 5.9.11_3 are in both Plus 23.09.1 and CE 2.7.2 branches
Need to verify the versi...
Jim Pingle
06:45 PM Todo #15050 (Resolved): Update strongSwan to 5.9.11_3
Update the strongSwan port from 5.9.11_2 to 5.9.11_3 which brings in a patch to address a potential vulnerability in ... Jim Pingle
07:03 PM Todo #15049 (Feedback): Update OpenVPN to 2.6.8_1
Commits are in the ports tree, just need to validate that the correct version ends up in the next build(s) and operat... Jim Pingle
06:38 PM Todo #15049 (Resolved): Update OpenVPN to 2.6.8_1
OpenVPN released version 2.6.8 to address a segmentation fault in 2.6.7. At least one user on the forum has reported ... Jim Pingle
06:38 PM Todo #14985: Update OpenVPN to 2.6.7
Superseded by #15049 so no need to list it on 23.09.1 Jim Pingle
04:01 PM Bug #15034: FreeBSD-EN-23:16.openzfs: Potential ZFS file corruption
Two data corruption bugs were recently reported against ZFS, including the version provided with pfSense. The upstrea... Marcos M
03:30 PM pfSense Packages Bug #11802: FreeRADIUS sync
A checkbox list like the one under the system's High Availability setup interface would be ideal. This behavior chang... Ansley Barnes
11:23 AM pfSense Packages Bug #11802: FreeRADIUS sync
We're also hit by the same issue after pfSense upgrade, and that's pretty annoying. Our certificate configs are getti... Yury Zaytsev
02:21 PM Revision 99ea9c32: net/frr9: enable SNMP port option
Christian McDonald
09:47 AM pfSense Packages Bug #15048 (New): Snort large memory consumption when updating

Snort since the last updates uses a lot of memory when updating and it has a big impact. Can this be improved?
T...
Ricardo ot
05:01 AM pfSense Packages Bug #14287: pfBlockerNG does not uninstall cleanly when using RAM disks
I wonder if this will fix the slow startup time for pfBlockerNG-dev with RAM disks enabled.
There's a long delay (...
Loh Phat
01:26 AM pfSense Packages Bug #14491: FRR not starting with AgentX enabled
I see this issue is now assigned, just for reference here are some probably heavily related tickets:
https://gith...
Yif Swery

11/28/2023

08:18 PM Bug #15034 (Resolved): FreeBSD-EN-23:16.openzfs: Potential ZFS file corruption
We imported a patch for this from upstream and we're planning on making patch releases with this and some other fixes... Jim Pingle
08:18 PM Bug #15044 (In Progress): Route "Invalid argument" error during boot
Christian McDonald
06:43 PM Bug #15044 (Resolved): Route "Invalid argument" error during boot
When booting 24.03, the following route error is shown on the console at different points - e.g.:... Marcos M
06:46 PM Revision 8446884a: Revert "Update version to 2.7.2-RC"
This reverts commit fae35334d0fc1266c8b6bdc71d9feffac16338c1. Reid Linnemann
06:39 PM Revision 5588a42e: Correct ESP mount executed in a subshell. Fixes #15007
(cherry picked from commit 87ecf1c2da6e4a1b4964b1c0c0fc31a73b461a57) Reid Linnemann
06:37 PM Bug #15043: IGMP proxy works intermittently
Also applies to pfSense Plus version 23.09 according to this article: https://forum.netgate.com/topic/184360/igmp-pro... Martial G
06:32 PM Bug #15043 (Resolved): IGMP proxy works intermittently
The IGMP proxy no longer works reliably after the update to 2.7.1. Channels that are no longer watched continue to be... Martial G
05:54 PM Bug #15042 (Resolved): Potential TCP connection denial of service attack from spoofed RST packets processed by PF
There is a report (attached) that claims that a third party attacker can send TCP RST packets with a spoofed source a... Jim Pingle
05:03 PM Regression #14970: Static ARP assignments lose ``permanent`` flag in ARP table
Denny Page wrote:
> Arp flips back and forth between reporting static arp entries as permanent or having timeouts wi...
Johan Belmans
04:55 PM Bug #14990 (Resolved): IPsec log categories set to "Audit" do not function properly or save properly in the GUI
Working as expected on current 24.03 snapshots Jim Pingle
04:37 PM pfSense Plus Bug #15017: DHCP relay CARP status VIP function is not working in pfsense+ 23.09
OK, this is much more serious than it first looks, if you enter to CARP failover mode then leave CARP failover mode o... Robert Karsai
03:41 PM Bug #15041: Icmp payload default of 0 can give issues as this is not a official supported value as monitoring of a gateway.
To be extra certain I ran a packet capture of a monitoring ping on a default install and confirmed the size is 1 byte... Jim Pingle
03:36 PM Bug #15041 (Not a Bug): Icmp payload default of 0 can give issues as this is not a official supported value as monitoring of a gateway.
The default in pfSense is 1, not 0. The default in dpinger is 0 but pfSense uses 1 when it's unset, not 0.
!clipbo...
Jim Pingle
03:35 PM Bug #15041 (Closed): Icmp payload default of 0 can give issues as this is not a official supported value as monitoring of a gateway.
The payload size can already be configured in the gateway's advanced settings. Marcos M
02:49 PM Bug #15041 (Not a Bug): Icmp payload default of 0 can give issues as this is not a official supported value as monitoring of a gateway.
Icmp payload for monitoring a gateway has a default value of 0. The result of the ICMP request can be influenced by f... Leon Straathof
10:52 AM pfSense Plus Feature #15038: Operating System support for PF ``pflow`` packet data flow export
The plan is to start by importing OpenBSD's pflow(4), and then extending it to expose more NAT information (see RFC 8... Kristof Provost
07:53 AM pfSense Packages Bug #14287: pfBlockerNG does not uninstall cleanly when using RAM disks
Jordan G wrote in #note-21:
> quite similar, both ends of the spectrum though - https://redmine.pfsense.org/issues/1...
Loh Phat
06:25 AM pfSense Plus Bug #15035: System GUI unaccessable
23.05.01 with squid was the everything bagel of open source community firewall software... 🥯 Jonathan Lee

11/27/2023

10:11 PM Revision fae35334: Update version to 2.7.2-RC
Brad Davis
09:50 PM pfSense Packages Bug #14861: PHP error when pings are enabled but no ping hosts are defined
Hi, not sure what to tell you. I was using the telegraf plugin on 2.7.x sending stats to an influxdb. I don't recall ... David Bowen
08:52 PM Feature #13085 (Feedback): OpenVPN NBDD server options
Marcos M
08:37 PM pfSense Packages Bug #14287 (Resolved): pfBlockerNG does not uninstall cleanly when using RAM disks
Fixed in version 3.2.0_7: https://github.com/pfsense/FreeBSD-ports/commit/bd3ae22c8740dad7db80a893038990c83b55700f Marcos M
07:59 PM pfSense Plus Bug #15035: System GUI unaccessable
TAC ticket number is: 2113707645 Jonathan Lee
07:53 PM pfSense Plus Bug #15035: System GUI unaccessable
https://forum.netgate.com/topic/184377/4-1-6_14-snort-23-09-issue-arm Jonathan Lee
07:49 PM pfSense Plus Bug #15035: System GUI unaccessable
NogBadTheBad
also stated issues with the ".14 fix" Snort update however the thread was locked right after he reporte...
Jonathan Lee
07:46 PM pfSense Plus Bug #15035: System GUI unaccessable
I had to uninstall Snort to access the web GUI. It does not work for my configuration you see above at all. I am stuc... Jonathan Lee
07:03 PM pfSense Plus Bug #15035: System GUI unaccessable
wrt snort, the issue with killing states is resolved; see https://forum.netgate.com/topic/184112/important-snort-and-... Marcos M
05:12 PM pfSense Plus Bug #15035: System GUI unaccessable
Thank you open source community for all you do. Jonathan Lee
05:11 PM pfSense Plus Bug #15035: System GUI unaccessable
23.09 is not stable when Snort is used with blocking enabled it will depreciate a firewall to no gui access with bloc... Jonathan Lee
05:08 PM pfSense Plus Bug #15035: System GUI unaccessable
Packages running
23.05.01 final ARM SG2100 stable version time to stable config 2019->2023
I hope that provides...
Jonathan Lee
05:02 PM pfSense Plus Bug #15035: System GUI unaccessable
ACLs Jonathan Lee
04:53 PM pfSense Plus Bug #15035: System GUI unaccessable
Squid uses both splice for some and intercept for others Jonathan Lee
04:52 PM pfSense Plus Bug #15035: System GUI unaccessable
None of that is relevant if you cannot reproduce the PHP error while you are on a stock/unmodified 23.09. If you only... Jim Pingle
04:51 PM pfSense Plus Bug #15035: System GUI unaccessable
took from 2019 until 23.05.01 for this to be stable
23.09 on arm processor is not stable with Snort active .14 ver...
Jonathan Lee
04:50 PM pfSense Plus Bug #15035: System GUI unaccessable
backups/patched custom Jonathan Lee
04:34 PM pfSense Plus Bug #15035: System GUI unaccessable
Attached is information on how my system works in 23.05.01. This is stable and runs for days without issues even with... Jonathan Lee
03:58 PM pfSense Plus Bug #15035: System GUI unaccessable
23.09 is not stable for Snort it just doesn't work with it on ARM. Jonathan Lee
03:57 PM pfSense Plus Bug #15035: System GUI unaccessable
Steps to reproduce.
1. Use boot environments I went to test out 23.09 again with the latest Snort update. I starte...
Jonathan Lee
02:12 PM pfSense Plus Bug #15035 (Rejected): System GUI unaccessable
There is no code like that on line 535 in a current version of head.inc. On 23.05.1 it would imply that the content o... Jim Pingle
02:28 AM pfSense Plus Bug #15035: System GUI unaccessable
Errors that are listed in logs Jonathan Lee
02:26 AM pfSense Plus Bug #15035: System GUI unaccessable
I noticed this after some snort changes when this GUI access was removed
Changes marked unknown...
Jonathan Lee
02:00 AM pfSense Plus Bug #15035 (Rejected): System GUI unaccessable
/head.inc, Line: 535, Message: Uncaught TypeError: count): Argument #1 (Svalue) must be of type Countable|array, bool... Jonathan Lee
07:39 PM Regression #15011 (Resolved): ISC DHCP responds from a random port
Marcos M
06:52 PM Regression #15011: ISC DHCP responds from a random port
Before the fix, DHCP logs show the following when a client tries to renew (logs reversed):... Marcos M
07:07 PM Feature #14620: Support running DHCPv4 Server and DHCPv4 Relay at the same time on different interfaces
For reference: https://github.com/pfsense/FreeBSD-ports/commit/43067d320d88d1d9856d048c7129399bd80a2216 Marcos M
07:02 PM Revision 891a9fa4: Show the target for auto outbound NAT rules. Fix #15025
(cherry picked from commit 83bca4954db2a52c35c1581e53be2faa7a47d49b) Marcos M
07:02 PM Revision 9c227343: Append a new line to NAT rule errors. Fix #15024
(cherry picked from commit b7f2b1dc3f0c15c4b2b9d475848f42573c43e261) Marcos M
07:02 PM Revision 4e15e2de: Update misleading function names. Fix #11566
(cherry picked from commit 50b5741beafdb34a3009b78279e203570f5e6d3f) Marcos M
07:02 PM Revision 0323b9fe: Fix IPsec log value handling. Fixes #14990
(cherry picked from commit dcdb461733044d274c742832097b13a312045f37) Jim Pingle
07:02 PM Revision b5f346cf: Save the mobile IPsec group auth setting. Fix #14963
(cherry picked from commit 0fc7765c886ed60555750d12808f493d70918450) Marcos M
07:02 PM Revision 4f89ce19: Remove invalid field from input validation. Fix #14965
(cherry picked from commit a6c6b835f8d75796c0c1fb9ecde90f5b1757f807) Marcos M
07:02 PM Revision a433a061: Update direct config access in services_dhcpv6.php. Fix #14978
(cherry picked from commit 6df70417029defed162b539720e8baa03984f653) Marcos M
07:02 PM Revision 7f85fd87: Fix PHP error when saving PPP interface w/o config. Issue #14949
(cherry picked from commit 0236684082ef0a954ce74a785a4d0eb2e22106cd) Jim Pingle
06:59 PM pfSense Plus Bug #15040 (Closed): ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pfSense-repoc"
It's a known issue that's resolved by https://redmine.pfsense.org/issues/10464. Marcos M
06:07 PM pfSense Plus Bug #15040 (Closed): ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pfSense-repoc"
When using boot environments to move system back to last stable version users can no longer check for updates
@ld...
Jonathan Lee
05:35 PM pfSense Plus Feature #15039 (Closed): GUI to configure Packet Flow Data (``pflow``) export
Following #15038 the GUI will need a set of options to configure @pflow(4)@ behavior
It will need at least the fol...
Jim Pingle
05:25 PM pfSense Plus Feature #15038 (Closed): Operating System support for PF ``pflow`` packet data flow export
Import the "pflow(4)":https://man.openbsd.org/pflow.4 netflow/IPFIX export functionality for PF from OpenBSD into pfS... Jim Pingle
04:33 PM Bug #15034: FreeBSD-EN-23:16.openzfs: Potential ZFS file corruption
name name wrote in #note-2:
> Could you please tell me if an update is planned for 23.09/2.7.1 once an upstream fix ...
Jim Pingle
04:16 PM Bug #15034: FreeBSD-EN-23:16.openzfs: Potential ZFS file corruption
Thank you for looking into it and the recommendation.
Could you please tell me if an update is planned for 23.09/2...
name name
02:05 PM Bug #15034 (Closed): FreeBSD-EN-23:16.openzfs: Potential ZFS file corruption
pfSense 23.09 and 2.7.1 are both using code that is close to 2.2.0:... Jim Pingle
03:40 PM Regression #15030 (Confirmed): Keymap Layout Options No Longer Provided
I tried both BIOS and UEFI paths and it doesn't show up in either case. This isn't new, however, it wasn't in 2.7.0 e... Jim Pingle
02:06 PM pfSense Packages Todo #12806 (Closed): Update node_exporter to 1.3.1
Jim Pingle
02:05 AM pfSense Packages Todo #12806: Update node_exporter to 1.3.1
Logan Marchione wrote:
> Sorry if this isn't the right place to ask. I wasn't sure if pfSense published package upda...
Logan Marchione
02:06 PM pfSense Packages Bug #14986 (Resolved): Snort's Legacy Blocking Mode custom plugin code causes a Signal 11 and core dump when "kill states" option is enabled
Jim Pingle
01:57 PM pfSense Plus Bug #15026 (Not a Bug): PHP Error since upgrading to 23.09
This isn't a bug, either something didn't complete in your upgrade or something else patched on there is causing it. ... Jim Pingle
01:55 PM Feature #15031 (Closed): Need "Custom Options" section for Kea DHCP Server to support Kea DHCP-DDNS service at a minimum
We are aware of the features not yet implemented in Kea, these are already being developed and do not need to be trac... Jim Pingle
01:51 PM pfSense Packages Bug #15028 (Not a Bug): OpenVPN + FRR BGP routing failure(Unable to contact daemon/Service not running?)
That is the kind of error you'll get if there is a conflicting route already in the table which prevents it from conf... Jim Pingle
01:39 PM pfSense Plus Bug #15036: Traffic Shaper Wizard Dedicated generates error
Please include the details of all the inputs that were given in the wizard which resulted in the error. It should all... Jim Pingle
06:09 AM pfSense Plus Bug #15036: Traffic Shaper Wizard Dedicated generates error
Tested on
23.09-RELEASE (amd64)
built on Thu Nov 23 9:32:00 UTC 2023
FreeBSD 14.0-CURRENT
I can confirm this e...
aleksei prokofiev
05:56 AM pfSense Plus Bug #15036 (Confirmed): Traffic Shaper Wizard Dedicated generates error
I can reproduce it on 23.01, 23.05_1 and 23.09
All the time I run *Traffic Shaper Wizard Dedicated* with HFSC que...
Azamat Khakimyanov
12:29 PM Bug #15037 (New): NTPD: Serial GPS with PPS error opening /dev/gpspps0
Receive the following error message in the NTP log when using a serial GPS with PPS output connect to a serial COM po... Elvis Impersonator
07:26 AM pfSense Packages Bug #15018: Suricata 7.0.2 service stop problem
Service_Watchdog is not (and was never) installed on affected systems. What I don't understand how can a "suricata.sh... Robert Karsai
04:53 AM Bug #15015: Static routes not working
dylan mendez wrote in #note-2:
> In this case, my best guess is that the IPSec tunnel is going down for some reason, ...
Silviu Bajenaru
12:23 AM Bug #15015: Static routes not working
In this case, my best guess is that the IPSec tunnel is going down for some reason, therefore, the route is no longer... dylan mendez
12:22 AM Bug #15015: Static routes not working
Created 3 VMs
VM 1 - pfSense CE 2.7.0 - Subnet: 192.168.1.0/24 - Connected via VTI IPsec to VM2 (10.10.10.1) - Rou...
dylan mendez

11/26/2023

11:04 PM pfSense Packages Bug #14986: Snort's Legacy Blocking Mode custom plugin code causes a Signal 11 and core dump when "kill states" option is enabled
The fix has deployed in package updates to both CE 2.7.1 and Plus 23.09. User feedback on the Netgate Forum indicates... Bill Meeks
10:59 PM pfSense Packages Bug #15033: Suricata rule lists can't be manually updated unless the ETOpen Emerging Threats list is enabled
Verified.
The check for enabled rules currently only checks for ET Open, Snort VRT, ET Pro, and Extra Rules as shown...
Bill Meeks
02:11 AM pfSense Packages Bug #15033 (Resolved): Suricata rule lists can't be manually updated unless the ETOpen Emerging Threats list is enabled
To reproduce on a system that's never had Suricata installed before:
- Install it, enable an interface and start the...
Chris W
10:52 PM pfSense Packages Bug #15018: Suricata 7.0.2 service stop problem
Robert Karsai wrote in #note-4:
> Hello Bill, Thanks for looking into this issue. I've managed to reproduce the probl...
Bill Meeks
09:48 PM pfSense Packages Bug #15018: Suricata 7.0.2 service stop problem
Hello Bill, Thanks for looking into this issue. I've managed to reproduce the problem on a Netgate 4100 cluster maste... Robert Karsai
04:53 PM pfSense Packages Bug #15018: Suricata 7.0.2 service stop problem
Continuing to try and gather data about this issue. I have not been able to reproduce it in my local testing machines... Bill Meeks
04:00 AM pfSense Packages Bug #15018: Suricata 7.0.2 service stop problem
Editing redmine to correct title. Kris Phillips
02:52 PM pfSense Plus Bug #15026: PHP Error since upgrading to 23.09

cat /etc/inc/util.inc | grep "php_default_memory"
it is there and the code as well
function get_php_default_memory...
Eric Nguyen
01:43 AM pfSense Plus Bug #15026: PHP Error since upgrading to 23.09
Those patches shouldn't affect it. That function 'get_php_default_memory()' should be defined in /etc/inc/util.inc. I... Christopher Cope
11:59 AM Bug #15034 (Resolved): FreeBSD-EN-23:16.openzfs: Potential ZFS file corruption
From reading the ZFS issue tracker there seem to be quite a few problems with the new ZFS 2.2.0 version and I was won... name name
06:23 AM Bug #13413: Some messages presented to users contain relative links to pages which may be invalid when triggered from certain packages
Tested on
23.09-RELEASE (amd64)
built on Fri Nov 17 13:32:00 UTC 2023
FreeBSD 14.0-CURRENT
I've tried different...
aleksei prokofiev
05:27 AM pfSense Packages Bug #14287: pfBlockerNG does not uninstall cleanly when using RAM disks
quite similar, both ends of the spectrum though - https://redmine.pfsense.org/issues/13679
can I ask if you have IPv...
Jordan G
04:12 AM Bug #14978: PHP error on ``services_dhcpv6.php`` if the configuration contains an empty ``dhcpv6`` section
I set a static v6 address on one of my LANs and when trying to enable ISC or KEA v6 DHCP server I receive the same me... Jordan G
03:56 AM pfSense Packages Bug #14861 (Incomplete): PHP error when pings are enabled but no ping hosts are defined
Tested on 2.7.1. I'm still not able to recreate this bug report. Marking as Incomplete until exact replication step... Kris Phillips
12:03 AM pfSense Plus Bug #15029 (Not a Bug): Additional packages are blank
Christopher Cope

11/25/2023

03:41 PM pfSense Plus Bug #15029: Additional packages are blank
Rebooted system again this morning and its working fine now. thanks for the help. John Beaudoin
03:17 PM pfSense Plus Bug #15029: Additional packages are blank
You can try these steps to force download new repository files. This is often all you need to do but repo issues are ... Chris W
03:14 PM Bug #15032 (Resolved): Kea DHCP sends wrong bootloader file for UEFI
I already posted this problem in the pfSense forum and was asked to report this issue here. Here is the link of the d... David Masshardt
01:30 PM Feature #15031 (Closed): Need "Custom Options" section for Kea DHCP Server to support Kea DHCP-DDNS service at a minimum
With the move to the Kea DHCP server, local resolution of DHCP names in the DNS relay has gone away. A reasonable wo... Brett Wyer
11:35 AM pfSense Docs Correction #9370: Update old screenshots
The screenshots on the *Launching an Instance with a Single Network Interface* page are outdated.
https://docs.netg...
Danilo Zrenjanin
10:45 AM pfSense Docs Correction #14988 (Resolved): DHCPv6 relay Destination Server
It looks good now.
I am marking this ticket resolved.
Danilo Zrenjanin
09:53 AM Regression #14987: ``Interface Address`` is no longer an option for outbound NAT targets
I've just tested and confirmed on 23.05.1 that there was no need to assign the Tailscale interface to have it in the ... Danilo Zrenjanin
08:44 AM Regression #15005 (Confirmed): Auto Config Backup times are incorrect
Yes, indeed. I can confirm this behavior at:... Danilo Zrenjanin
08:38 AM Regression #15025 (Resolved): Automatic outbound NAT rules show an empty NAT Address
I can confirm this behavior on 23.09.
The patch fixes it.
I am marking this ticket resolved.
Danilo Zrenjanin
08:37 AM Bug #15009: System>Update page menu uses incorrect internal URL
Interestingly, a reboot resolved the issue. No changes made. Jon8RFC .

11/24/2023

09:43 PM Regression #15030 (Confirmed): Keymap Layout Options No Longer Provided
Testing the installer for CE 2.7.1 there is no keyboard/keymap layout option provided as described here:
https://doc...
Kris Phillips
08:43 PM Feature #12522: More GUI options for OpenVPN Client-Specific Overrides
and a patch file for current master branch Phil Wardt
08:32 PM Feature #12522: More GUI options for OpenVPN Client-Specific Overrides
I updated the commit as you suggested
https://github.com/pfsense/pfsense/pull/4570
Phil Wardt
06:41 PM pfSense Plus Bug #15029 (Not a Bug): Additional packages are blank
running version
Version 23.09-RELEASE (amd64)
built on Tue Oct 31 15:56:00 EDT 2023
FreeBSD 14.0-CURRENT
Unabl...
John Beaudoin
07:25 AM Bug #15009: System>Update page menu uses incorrect internal URL
Hmm. But refresh, ctrl+refresh, shift+refresh, ctrl+shift+refresh all yield the same result for me: Unable to check ... Jon8RFC .

11/23/2023

06:40 PM pfSense Packages Bug #14668: FRR BGP route is not making into kernel route table after WireGuard's peer change is applied
updated to CE 2.7.1, FRR 2.0.2, WireGuard 0.2.1 - the issue is still persist. Oleksii Tucha
06:26 PM pfSense Packages Bug #15028 (Not a Bug): OpenVPN + FRR BGP routing failure(Unable to contact daemon/Service not running?)
Up to version 2.6.0, it works normally without bugs. The new versions 2.7.0 and 2.7.1 report inconsistency according ... Thiago Orico
12:36 PM pfSense Packages Bug #15027 (Resolved): Bind DNS Server cannot reorder zones
Hello all,
Since 23.09 and 23.05 re-ordering zones and saving has no effect, returning to the zone definitions aft...
Eric Nguyen
12:30 PM pfSense Plus Bug #15026 (Not a Bug): PHP Error since upgrading to 23.09
Hello all,
Since upgrading to 23.09, have the following error messages in my notice area coming up at regular inte...
Eric Nguyen

11/22/2023

10:55 PM Regression #15025 (Feedback): Automatic outbound NAT rules show an empty NAT Address
Applied in changeset commit:83bca4954db2a52c35c1581e53be2faa7a47d49b. Marcos M
10:45 PM Regression #15025 (Resolved): Automatic outbound NAT rules show an empty NAT Address
The @NAT Address@ column for the automatic outbound NAT rules is empty. Checking @/tmp/rules.debug@, the rules are st... Marcos M
10:45 PM Revision 83bca495: Show the target for auto outbound NAT rules. Fix #15025
Marcos M
10:42 PM Regression #15011 (Feedback): ISC DHCP responds from a random port
Marcos M
10:41 PM Regression #15024 (Resolved): Invalid outbound NAT rules break the following rule
Marcos M
09:11 PM Regression #15024: Invalid outbound NAT rules break the following rule
Patch looks good:... Steve Wheeler
09:10 PM Regression #15024 (Feedback): Invalid outbound NAT rules break the following rule
Applied in changeset commit:b7f2b1dc3f0c15c4b2b9d475848f42573c43e261. Marcos M
04:26 PM Regression #15024: Invalid outbound NAT rules break the following rule
In my test case the rule is added twice:... Steve Wheeler
04:25 PM Regression #15024 (Resolved): Invalid outbound NAT rules break the following rule
Manual outbound NAT rules are commented out in the ruleset if they are invalid such as when he interface is disabled:... Steve Wheeler
09:02 PM Revision b7f2b1dc: Append a new line to NAT rule errors. Fix #15024
Marcos M
06:08 PM Bug #14891: High CPU usage when interface get down and up due to proces check_reload_status
I've seen this issue on two different 4100 units in the past 2 days (Nov 21 and 22).
It seems to prevent the WAN conn...
Andrew Almond
04:25 PM Revision e6f78714: Update fontawesome references in form buttons
Marcos M
02:34 PM Bug #15023: KEA DHCP and ERROR [kea-dhcp4.dhcp4.0x545c1212000] DHCP4_PARSER_FAIL failed to create or run parser for configuration element subnet4: option data does not match option definition (space: dhcp4, code: 42)
Thanks Jim.
I just took a look at RFC 2132, Section 8.3, <https://datatracker.ietf.org/doc/html/rfc2132#section-8....
Jeffrey Walton
01:31 PM Bug #15023 (Duplicate): KEA DHCP and ERROR [kea-dhcp4.dhcp4.0x545c1212000] DHCP4_PARSER_FAIL failed to create or run parser for configuration element subnet4: option data does not match option definition (space: dhcp4, code: 42)
Given the content of the file causing the error, this is a duplicate of #14991 Jim Pingle
08:03 AM Bug #15023: KEA DHCP and ERROR [kea-dhcp4.dhcp4.0x545c1212000] DHCP4_PARSER_FAIL failed to create or run parser for configuration element subnet4: option data does not match option definition (space: dhcp4, code: 42)
After SSH'ing into the box, this is what is reported for kea-dhcp4.conf:
```
$ cat -n /usr/local/etc/kea/kea-dhcp...
Jeffrey Walton
07:50 AM Bug #15023 (Duplicate): KEA DHCP and ERROR [kea-dhcp4.dhcp4.0x545c1212000] DHCP4_PARSER_FAIL failed to create or run parser for configuration element subnet4: option data does not match option definition (space: dhcp4, code: 42)
Hi Everyone,
I'm using the latest pfSense image, 2.7.1 (amd64). I got the ISC DHCP warning on reboot. I switched t...
Jeffrey Walton
01:52 PM Bug #14917 (Feedback): Mulicast traffic on a detached interface causes a panic
I've picked the relevant change (https://cgit.freebsd.org/src/commit/?id=b01cad6d3a8523101e7915809144f47e3045067f) to... Kristof Provost
01:25 PM Bug #14917: Mulicast traffic on a detached interface causes a panic
Forcing V_mfchashtbl to NULL produces a panic on that exact line in X_ip_mrouter_done, with the same `fault virtual a... Kristof Provost
11:23 AM Bug #14917: Mulicast traffic on a detached interface causes a panic
One report decodes to FreeBSD-src-RELENG_2_7_1/sys/netinet/ip_mroute.c:815, or `LIST_FOREACH_SAFE(rt, &V_mfchashtbl[i... Kristof Provost
01:23 AM Feature #15022 (Resolved): Allow overriding text scrolling during package install/uninstall
Hello fellow Redmine community members. I have noticed time and time again I have the ability to scroll during packag... Jonathan Lee

11/21/2023

10:47 PM Regression #15011 (Pull Request Review): ISC DHCP responds from a random port
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/379 Marcos M
02:42 PM Regression #15011: ISC DHCP responds from a random port
Although RFC2131 doesn't specifically dictate the source ports, RFC8357 was proposed to address the requirement to us... Douglas Hoffman
10:45 PM Todo #10464 (Feedback): Don't change the current update repo when new releases are available
The update check process has changed recently (available in 23.09 and CE dev currently).
Now relevant repos are ch...
Marcos M
12:53 AM Todo #10464: Don't change the current update repo when new releases are available
Craig Leres wrote in #note-21:
> Three years later I wake up to find that my SG-3100 has auto-borked itself by autom...
Kyle Palmer
09:07 PM Feature #13340: Option to change QinQ ethertype to Service VLAN Tag
Steve Wheeler wrote in #note-1:
> In 23.01/2.7 the QinQ is handled by if_vlan directly and not netgraph. It now uses...
Yif Swery
08:37 PM Feature #4728: Expose ``nopool`` server option in the OpenVPN Server GUI
I usually find negated settings hard to read. But let me know what you prefer or simply push the edits yourself into ... Florian Apolloner
08:10 PM Bug #15020: pfSense 2.7.1 No Hardware Crypto Acceleration in OpenVPN
Perhaps it is worth removing this option completely so as not to be misleading?
Even better - display OpenVPN hardwa...
I Ivanov
04:40 PM Bug #15020 (Not a Bug): pfSense 2.7.1 No Hardware Crypto Acceleration in OpenVPN
The "Hardware Crypto" option hasn't done much of anything in OpenVPN in a long time. OpenVPN/OpenSSL will use what it... Jim Pingle
03:26 PM Bug #15020: pfSense 2.7.1 No Hardware Crypto Acceleration in OpenVPN
Same thing after a clean install I Ivanov
03:25 PM Bug #15020 (Not a Bug): pfSense 2.7.1 No Hardware Crypto Acceleration in OpenVPN
After update to pfSense 2.7.1 only "No Hardware Crypto Acceleration" available in OpenVPN on all my instances (usuall... I Ivanov
07:37 PM Revision 91c4768b: More fontawesomev6 updates
Marcos M
10:29 AM pfSense Packages Bug #14986: Snort's Legacy Blocking Mode custom plugin code causes a Signal 11 and core dump when "kill states" option is enabled
The relevant changes have been merged to 2.7.1 and 23.09.
The 23.09 build is currently failing due to unrelated ch...
Kristof Provost

11/20/2023

10:22 PM Regression #15019 (Resolved): pfSense Plus is always shown as an available upgrade for eligible CE devices.
With the new ability of pfSense-upgrade to check for updates in all available repo branches CE devices will always di... Steve Wheeler
09:59 PM pfSense Packages Bug #15018: Suricata 7.0.2 service stop problem
The Subject is "Suricata 7.0.2 service stop problem" not "Suricata 7.0.12" of course Robert Karsai
08:22 PM pfSense Packages Bug #15018 (New): Suricata 7.0.2 service stop problem
Hello,
I can't reliably stop Suricata service using Services / Suricata / Interfaces / <interface> / stop icon. I'...
Robert Karsai
09:27 PM Regression #15011: ISC DHCP responds from a random port
Marcos M wrote in #note-9:
> Looks like the standard leaves it up to the client:
> > The time over which the client...
Ansley Barnes
06:39 PM Regression #15011: ISC DHCP responds from a random port
Looks like the standard leaves it up to the client:
> The time over which the client collects messages and the mechan...
Marcos M
06:12 PM Regression #15011: ISC DHCP responds from a random port
I don't know if it is related, but my HA setup, where the backup pfSense is offline due to a hardware defect, didn't ... name name
08:23 PM pfSense Docs Todo #15014: Feedback on Configuration — Advanced Configuration Options — Firewall
For reference, we did set it before when it was a loader option, but now that it's a tunable the loader default in @/... Marcos M
05:50 PM pfSense Docs Todo #15014 (Rejected): Feedback on Configuration — Advanced Configuration Options — Firewall
*Page:* https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html
*Feedback:*
re: "By defaul...
Steve Y
07:51 PM pfSense Plus Bug #15017 (Incomplete): DHCP relay CARP status VIP function is not working in pfsense+ 23.09
Hello,
It seems that after 23.05.1->23.09 upgrade DHCP relay CARP status VIP function is not working properly, DHCP ...
Robert Karsai
07:47 PM Feature #15016: Recursive DHCPv6-PD
Kristof Provost wrote in #note-2:
> > Because we don't have a way to get that from the client. Lots of DHCPv6 delega...
Jim Pingle
07:19 PM Feature #15016: Recursive DHCPv6-PD
> Because we don't have a way to get that from the client. Lots of DHCPv6 delegation features are blocked by that. Th... Kristof Provost
07:05 PM Feature #15016: Recursive DHCPv6-PD
Kristof Provost wrote:
> I'm reconfiguring my network and have a need for a delegated IPv6 prefix from my pfSense bo...
Jim Pingle
06:55 PM Feature #15016 (New): Recursive DHCPv6-PD
I'm reconfiguring my network and have a need for a delegated IPv6 prefix from my pfSense box.
The ISP provides a /...
Kristof Provost
05:53 PM Bug #15015 (Not a Bug): Static routes not working
Hello,
This morning I updated to PFSense 2.7.1 from 2.7.0. Now, I just tried to add a dynamic gateway and a static...
Silviu Bajenaru
05:38 PM Bug #11566 (Resolved): Firewall Maximum Table Entries "default size" is whatever is entered
We don't set a defined value by default - it's whatever the OS reports (which has its own defaults). Marcos M
04:33 PM Bug #11566: Firewall Maximum Table Entries "default size" is whatever is entered
A quick look at the code, I see a few of:
-['placeholder' => pfsense_default_table_entries_size()]
+['placeholder...
Steve Y
04:55 PM Bug #15007 (Feedback): pfSense-boot does not update the EFI loader
Applied in changeset commit:87ecf1c2da6e4a1b4964b1c0c0fc31a73b461a57. Reid Linnemann
04:50 PM Revision 87ecf1c2: Correct ESP mount executed in a subshell. Fixes #15007
Reid Linnemann
01:40 PM Regression #14963 (Resolved): Mobile IPsec Group Authentication cannot be enabled
Jim Pingle
01:39 PM Bug #15012 (Duplicate): NTP assigned to KEA DHCP Clients causes service to fail
There is already an open report for this: #14991 Jim Pingle
01:35 PM Bug #15009 (Not a Bug): System>Update page menu uses incorrect internal URL
When you change branches it does a POST and the parameter is set in the POST request so it is not visible in the URL ... Jim Pingle
12:01 AM Bug #14613: Incorrect wireguard control panel status management
Johannes Rohde wrote in #note-7:
> I can second this bug on pfsense ce 2.7.1. It seems to have something to do with ...
hao zhang

11/19/2023

09:18 PM Bug #14613: Incorrect wireguard control panel status management
I can get php_wg to work again as well as soon as I make a change to an interface within the gui. That fixes the wire... Johannes Rohde
08:55 PM Bug #14613: Incorrect wireguard control panel status management
I can second this bug on pfsense ce 2.7.1. It seems to have something to do with a missing ipv6 gateway. Please refer... Johannes Rohde
08:28 PM Regression #15011: ISC DHCP responds from a random port
I think I found the problem...
https://github.com/pfsense/FreeBSD-ports/commit/3b827dc6cfe3aebec16332b6494cb2742757a...
Douglas Hoffman
05:03 PM Regression #15011: ISC DHCP responds from a random port
It's possible to specify the local port using the ... Douglas Hoffman
03:20 PM Regression #15011: ISC DHCP responds from a random port
Confirmed that using the 23.05.1 binary in 23.09 I'm seeing the "old" behaviour where the Windows Server doesn't spam... Mathias Ringhof
07:12 AM Regression #15011: ISC DHCP responds from a random port
I cross-checked the binaries MD5sums since configuration etc seems to be the same and indeed there's a difference bet... Mathias Ringhof
01:57 AM Regression #15011: ISC DHCP responds from a random port
This appears to be related to a change in behavior with the source port being used by isc dhcpd in 23.09/2.7.1.
Co...
Douglas Hoffman
05:11 PM Regression #14963: Mobile IPsec Group Authentication cannot be enabled
Confirmed Patch is working as expected in 23.09 dylan mendez
02:56 PM pfSense Plus Feature #15013 (New): Speed Shift - Add Field to control lowest C-State
Dear pfSense-team,
after updating to 2.7.1 i was curious how well the new speed shift GUI entries work.
In fact a...
Dieter Kreuz
06:49 AM pfSense Plus Feature #14252: Optimization for 10GB-Connection/Throughput
Kris Phillips wrote in #note-1:
> Tuning Guide is already present here that contains the first two tuning items:
> ht...
Muhammad Waseem Ul Haq
03:53 AM pfSense Plus Feature #14252: Optimization for 10GB-Connection/Throughput
Tuning Guide is already present here that contains the first two tuning items:
https://docs.netgate.com/pfsense/en/l...
Kris Phillips
06:38 AM pfSense Packages Bug #14861: PHP error when pings are enabled but no ping hosts are defined
Tested upgrade from 2.6.0 to 2.7.0 with installed telegraf 0.9_6, no issue
2.6.0-RELEASE (amd64)
built on Mon Jan ...
aleksei prokofiev
03:44 AM Bug #15012: NTP assigned to KEA DHCP Clients causes service to fail
Testing this it appears that Kea cannot accept hostnames, but can accept IP addresses just fine.
Tested this wit...
Kris Phillips
01:55 AM pfSense Packages Bug #14287: pfBlockerNG does not uninstall cleanly when using RAM disks
RAM disks are in use in my environment, for the record. Loh Phat
12:37 AM pfSense Packages Bug #14287: pfBlockerNG does not uninstall cleanly when using RAM disks
are you testing with RAM disks enabled prior to installing pfBlockerNG? that seems to be the necessary catalyst to re... Jordan G
01:53 AM pfSense Packages Feature #14468: pass along ntopng professional license key
Mike
No, wrong link, go to this one.
https://packages.ntop.org/FreeBSD/
As mentioned, use Putty as admin, cu...
Russ Reynolds
12:32 AM Bug #11566: Firewall Maximum Table Entries "default size" is whatever is entered
applying this patch on 23.09 removes the "default" size listing below the entry field
clearing the field and savin...
Jordan G

11/18/2023

10:42 PM Bug #15012: NTP assigned to KEA DHCP Clients causes service to fail
Harald Holzner Thanks for adding this to my report. Appreciate it. Steven Cedrone
10:08 PM Bug #15012: NTP assigned to KEA DHCP Clients causes service to fail
Steven Cedrone wrote:
> Changed from ISC to KEA DHCP and the service would not stay running.
>
> After going thro...
Harald Holzner
09:44 PM Bug #15012 (Duplicate): NTP assigned to KEA DHCP Clients causes service to fail
Changed from ISC to KEA DHCP and the service would not stay running.
After going through System Log it reported an...
Steven Cedrone
09:33 PM Regression #14966: DHCP WAN with multiple (2+) IP Alias VIPs may show ``0.0.0.0`` as an interface address at boot
Had this issue on 23.09, patch resolved it! Thank you! Hayden Hill
06:11 PM pfSense Packages Feature #14468: pass along ntopng professional license key
Found this link here in the documentation
Is this what you mean?
https://www.ntop.org/guides/ntopng/third_party_...
Mike Moore
05:45 AM pfSense Packages Feature #14468: pass along ntopng professional license key
Mike, I can send details no problem at all, however, pfsense have released an updated Plus Version 23.09 based on the... Russ Reynolds
02:46 PM Bug #15010 (Duplicate): Some strange with arp table
Marcos M
02:29 PM Bug #15010: Some strange with arp table
Negative value of lease time have been several times, so now i can't reproduce it.
About static / dynamic arp my req...
Evgeny Korostelev
01:55 PM Bug #15010: Some strange with arp table
So have been able to duplicate this, see this thread.
https://forum.netgate.com/topic/184155/static-arp-in-dhcp-ov...
JohnPoz _
07:53 AM Bug #15010: Some strange with arp table
Hello,
Please provide exact steps to reproduce the behavior.
Lev Prokofev
07:21 AM Bug #15010: Some strange with arp table
Over some time static arp change to dynamic arp :( Evgeny Korostelev
05:37 AM Bug #15010 (Duplicate): Some strange with arp table
Expiries time has negative time instead of static arp Evgeny Korostelev
06:01 AM Regression #15011: ISC DHCP responds from a random port
EDIT: here is a full 24h of the same Windows server DHCP request with 23.05:
https://gist.github.com/mathiasringhof/...
Mathias Ringhof
05:43 AM Regression #15011 (Resolved): ISC DHCP responds from a random port
After upgrading from 23.05.1 to 23.09 I'm seeing a significant jump in log messages from the ISC DHCP server, mostly ... Mathias Ringhof
03:07 AM pfSense Packages Todo #14795: Transition to nut-devel
If it will work, I have a PR prepared: https://github.com/pfsense/FreeBSD-ports/pull/1329. Thanks. Denny Page
02:47 AM Bug #15009 (Not a Bug): System>Update page menu uses incorrect internal URL
v2.7.0
Going to System>Update leads to here:
http://192.168.168.1/pkg_mgr_install.php?id=firmware
Changing the...
Jon8RFC .
 

Also available in: Atom