Re: [pfSense Support] Re: Patch and ISO: New Feature -- Auto Configuring Interfaces
Please pretty please do not make distinctions on lan/wan/optif i have
invested too much time to clean this!
I still think that youare not competent enough to do this in 2.0 still
good luck
On Wed, Jul 15, 2009 at 12:08 AM, Tim A.pfse...@lists.goldenpath.org wrote:
Chris Buechler wrote:
On Sun, Jul 5, 2009 at 4:23 PM, Tim A.pfse...@lists.goldenpath.org wrote:
Attached a patch against 1.2.3-rc2 adding support for auto configuring
interfaces.
That's definitely a nice feature, though only suitable for addition to
2.0, so we'll need a patch for 2.0. The only thing from your
description that needs to change is the auto-assignment with one
interface, 2.0 will let you assign only WAN and treat it basically
like LAN with a default gateway for appliance purposes, so if there is
only one interface it needs to only assign WAN.
Thanks!
Attached a patch against 2.0 adding support for auto configuring interfaces.
This patch is done with -rub. So, you wont see the white space but note that
there's a significant block of the original code that should be indented
with this.
I reworked it to be less clunky and more POLS. Also, I'm learning more about
pfsense internals and the auto interface feature automatically turns on sshd
if it kicks in.
So, no need to worry about the config file.
I'll update the 1.2 patch later with these improvements as well.
By the way. I've started using git, and its very cool. I created an account
and added my key to rcs.pfsense.org.
I tried to push this to the repo but it keeps saying not allowed.
Are you guys only using that internally?
--- a/etc/inc/config.inc 2009-07-14 16:39:50.0 -0400
+++ b/etc/inc/config.inc 2009-07-14 14:30:35.0 -0400
@@ -790,6 +790,12 @@
$iflist = get_interface_list();
+/* Function flow is based on $key and $auto_assign or the lack thereof */
+ $key = null;
+
+ if ((ereg(cdrom, $g['platform'])) || is_interface_mismatch())
+ $auto_assign = true;
+
echo EOD
Valid interfaces are:
@@ -799,7 +805,7 @@
if(!is_array($iflist)) {
echo No interfaces found!\n;
- $iflist = array();
+ return;
} else {
foreach ($iflist as $iface = $ifa) {
echo sprintf(% -16s%s%s\t%s\n, $iface, $ifa['mac'],
@@ -807,6 +813,14 @@
}
}
+ if ($auto_assign) {
+ echo EOD
+
+BEGIN MANUAL CONFIGURATION OR WE WILL PROCEED WITH AUTO CONFIGURATION.
+
+EOD;
+ }
+
echo EOD
Do you want to set up VLANs first?
@@ -816,7 +830,54 @@
Do you want to set up VLANs now [y|n]?
EOD;
- if (strcasecmp(chop(fgets($fp)), y) == 0)
+ if ($auto_assign) {
+ $timeout=9; // How long do you want the script
to wait before moving on (in seconds)
+ exec(/bin/stty erase . chr(8));
+ while(!isset($key)) {
+ echo chr(8) . {$timeout};
+ `/bin/stty -icanon min 0 time 25`;
+ $key = trim(`KEY=\`dd count=1 2/dev/null\`; echo
\$KEY`);
+ `/bin/stty icanon`;
+ if ($key == '')
+ unset($key);
+ // Decrement our timeout value
+ $timeout--;
+ // If we have reached 0 exit and continue on
+ if ($timeout == 0)
+ break;
+ }
+ } else
+ $key = chop(fgets($fp));
+
+
+ if (!isset($key)) { // Auto Assign Interfaces
+ $optif = array();
+ $i = $j = 0;
+ echo \n\n;
+ foreach ($iflist as $iface = $ifa) {
+ if ($i 1) {
+ $optif[$j] = $iface;
+ echo Assigned OPT . ($j+1) . to :
$optif[$j] \n;
+ $i++;
+ $j++;
+ }
+ elseif ($i == 1) {
+ $lanif = $iface;
+ echo Assigned LAN to : $lanif \n;
+ $i++;
+ }
+ elseif ($i == 0) {
+ $wanif = $iface;
+ echo Assigned WAN to : $wanif \n;
+ $i++;
+ }
+ }
+
+ $config['system']['enablesshd'] = 'enabled';
+ $key = 'y';
+
+ } else { //Manually assign interfaces
+ if (in_array($key, array('y', 'Y')))
vlan_setup();
if (is_array($config['vlans']['vlan'])
count($config['vlans']['vlan'])) {
@@ -953,15 +1014,17 @@
echo OPT . ($i+1) . - .
Re: [pfSense Support] 1.2.3RC1 embedded: wireless communication with Nokia N97 stops after a few KB but the connection desn't drop
Only thing I can think of is the rekeying, setting it to 0 should solve it if it's the case. -lsf On Sun, Jul 12, 2009 at 7:21 PM, Angelo nglrossi...@gmail.com wrote: Hi, I have a weird wireless connection issue with my new Nokia N97, hope someone can help me. I use 1.2.3RC1 embedded on a Alix 2d3 with a Atheros 5413 minipci card. The system has been serving me fine for a couple of months providing internet access to my server and a sip device cable and to my laptop through wireless. As explained later I don't think this matters, but the wireless card was setup as access point and protected with WPA2. No bridges. The devices in the network dont interact much, they mainly need internet access so I have WAN, LAN, OPT1 and OPT2 with respectively a public IP, 192.168.69.0/24, 192.168.70.0/24, 192.168.71.0/24. Very plain setup, the only rules I've added allow communication between LAN, OPT1 and OPT2. Yesterday I bought a Nokia N97 and as soon as I came back home I started playing with it. I joined my wireless network and typed the PSK and the phone said it was connected properly. Opened the browser and went on google, typed a search and I got the page, another couple of pages and the connection stopped working. The page doesn't load and the phone gives me an error like gateway not responding. I am 101% sure it's something in the phone or in the wireless manager of the phone so I start investigating on it. I can see the DHCP lease from pfsense and for a few seconds I can ping the phone's IP then the connections stops until I manually disconnect and reconnect. Then it works for another few seconds. When the traffic stops after few seconds the phone still thinks it's connected and can stay connected for hours giving the gateway error problem; if I reboot the pfsense box the phone loses the connections for about a minute, then it automatically reconnects and works for a few seconds. I spent a good while focusing on the phone since I was sure they did some weird implementation that wasn't working fine with WPA2. So I decided to simplify the problem. As a test I moved the AP on WEP security, the phone kept connecting and working foe only a few secs. As an extreme step I setup the AP as an open system. The phone kept misbehaving. As a note, during all these tests I was using the same wireless connection with my XP laptop that was working fine. Also, on both the phone and the laptop the signal is really strong (the phone says 100%). I stepped back a bit and I decided to work wit other networks. I know the WEP key of my housemate and some of my neighbours keeps his wireless net open but the signal of this network is really low. My housemate wireless router is a linksys provided by his provider. I could connect on the open network and surf with almost no issues, the signal was occasionally dropping but the phone was reconnecting and then everything was ok. I could use the WEP protected network of my housemate with no issues, I installed several apps, surfed the web and checked emails. I started playing with all the settings like allow 802.11g only, intra BBS etc but the result was always the same. I am a bit at a loss here. I still believe the problem is mainly on the phone. But other APs can work perfectly with it. I wonder if there is a way to make pfSense work like them and allow the phone to use the network. I monitored the traffic with the phone from its connection to when it stops responding. It didn't help me much but maybe somebody can spot interesting clues there. 17:55:01.669458 IP (tos 0x0, ttl 64, id 32436, offset 0, flags [none], proto ICMP (1), length 48) 192.168.71.1 192.168.71.198: ICMP echo request, id 63553, seq 0, length 28 17:55:02.018578 IP (tos 0x10, ttl 16, id 0, offset 0, flags [none], proto UDP (17), length 328) 192.168.71.1.bootps 192.168.71.198.bootpc: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid 0xb078fb1a, Flags [none] (0x) Your-IP 192.168.71.198 Client-Ethernet-Address 00:26:68:04:de:05 (oui Unknown) Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message Option 53, length 1: Offer Server-ID Option 54, length 4: 192.168.71.1 Lease-Time Option 51, length 4: 7200 Domain-Name-Server Option 6, length 4: 192.168.71.1 Domain-Name Option 15, length 12: nglrossi.com Subnet-Mask Option 1, length 4: 255.255.255.0 Default-Gateway Option 3, length 4: 192.168.71.1 17:55:02.025847 IP (tos 0x10, ttl 16, id 0, offset 0, flags [none], proto UDP (17), length 328) 192.168.71.1.bootps 192.168.71.198.bootpc: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid 0xb078fb1a, Flags [none] (0x) Your-IP 192.168.71.198 Client-Ethernet-Address 00:26:68:04:de:05 (oui Unknown) Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message Option 53, length 1: ACK
[pfSense Support] Vpn LAN Client Connection
Hi, I have a server connected to my office network through openvpn. The server takes IP 10.69.36.x My office network IP pool is 10.69.11.x Server can reach any IP on office network. But I can not reach the server from the office through VPN. Thanks in advance. oytun - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
[pfSense Support] Filtering streaming - peer to peer - instant messaging
Hello, I am about to answer a public tender and am looking for a reliable open-source filtering solution. I need to filter layer 3 and 4 of TCP/IP stack (TCP and Application layer) specially for stream such as Peer to Peer - IM - Streaming - Virus. I was wondering if PFSense could do this kind of packet inspection work and how (from my reading It looks like the answer is no). Maybe there are some third party solution that could be incorporated and used… If not I would be interested in a pointer to another OpenSource project with similar facilities. Any experience feed-back is also very welcome. Thanks for your support. Gregober --- PGP ID -- 0x1BA3C2FD bsd @at@ todoo.biz P Please consider your environmental responsibility before printing this e-mail - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] Filtering streaming - peer to peer - instant messaging
Can't do layer 4 yet, but i read somewhere some work is being done on it, maybe in pfsense 2.0. A sorta work around could be forcing all the clients to use pfSense as their DNS. Then use opendns.org as your dns resolver. This should prevent a lot of the torrent and other bad sites from resolving to anything. Adam bsd wrote: Hello, I am about to answer a public tender and am looking for a reliable open-source filtering solution. I need to filter layer 3 and 4 of TCP/IP stack (TCP and Application layer) specially for stream such as Peer to Peer - IM - Streaming - Virus. I was wondering if PFSense could do this kind of packet inspection work and how (from my reading It looks like the answer is no). Maybe there are some third party solution that could be incorporated and used… If not I would be interested in a pointer to another OpenSource project with similar facilities. Any experience feed-back is also very welcome. Thanks for your support. Gregober --- PGP ID -- 0x1BA3C2FD bsd @at@ todoo.biz P Please consider your environmental responsibility before printing this e-mail - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org __ Information from ESET NOD32 Antivirus, version of virus signature database 4237 (20090712) __ The message was checked by ESET NOD32 Antivirus. http://www.eset.com - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
RE: [pfSense Support] Vpn LAN Client Connection
Your probably missing a route on whatever router your office uses for a gateway. Paul -Original Message- From: Oytun Yılmaz [mailto:oytunyil...@gmail.com] Sent: Wednesday, July 15, 2009 6:50 AM To: support@pfsense.com Subject: [pfSense Support] Vpn LAN Client Connection Hi, I have a server connected to my office network through openvpn. The server takes IP 10.69.36.x My office network IP pool is 10.69.11.x Server can reach any IP on office network. But I can not reach the server from the office through VPN. Thanks in advance. oytun - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] Filtering streaming - peer to peer - instant messaging
On Wed, Jul 15, 2009 at 8:48 AM, bsdb...@todoo.biz wrote: Hello, I am about to answer a public tender and am looking for a reliable open-source filtering solution. I need to filter layer 3 and 4 of TCP/IP stack (TCP and Application layer) specially for stream such as Peer to Peer - IM - Streaming - Virus. You have your layers wrong. L3 (IPs) and L4 (protocol, TCP, UDP, GRE, ESP, etc.) are fully supported. I presume you mean higher layers, identifying what traffic is based on the actual payload rather than L3/4 header. 2.0 does have some application intelligence but that's not an option for immediate use. There aren't any similar open source options that do have that kind of functionality unless you build it yourself. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: Re: [pfSense Support] Filtering streaming - peer to peer - instant messaging
Not to take anything away from pfSense. Because pfSense rocks at layer 2 3. But you might look at IPcop w/ L7-filter. http://l7-filter.sourceforge.net/ http://www.ipcop.org/index.php?module=pnWikkatag=IPCopAddons In fact we use pfSense with this very same add-on(s) (IPcop L7-Filter) at several clients to address this exact scenario. HTH -- David L. Strout Engineering Systems Plus, LLC - Original Message - SUBJECT: Re: [pfSense Support] Filtering streaming - peer to peer - instant messaging FROM: ...@pfsense.org TO: supp...@pfsense.com DATE: 07-15-2009 2:44 pm On Wed, Jul 15, 2009 at 8:48 AM, bsd wrote: Hello, I am about to answer a public tender and am looking for a reliable open-source filtering solution. I need to filter layer 3 and 4 of TCP/IP stack (TCP and Application layer) specially for stream such as Peer to Peer - IM - Streaming - Virus. You have your layers wrong. L3 (IPs) and L4 (protocol, TCP, UDP, GRE, ESP, etc.) are fully supported. I presume you mean higher layers, identifying what traffic is based on the actual payload rather than L3/4 header. 2.0 does have some application intelligence but that's not an option for immediate use. There aren't any similar open source options that do have that kind of functionality unless you build it yourself. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
RE: [pfSense Support] Filtering streaming - peer to peer - instant messaging
And again... not to take away from pfsense. But untangle has some filtering. ( I actually use pfsense for our firewall/vpn/routing etc... and untangle for web/protocol filtering) As a firewall it is severely lacking, but is a half decent web/protocol filter - at least for those that are free. www.untangle.com -Tim -Original Message- From: cbuech...@gmail.com [mailto:cbuech...@gmail.com] On Behalf Of Chris Buechler Sent: Wednesday, July 15, 2009 11:44 AM To: support@pfsense.com Subject: Re: [pfSense Support] Filtering streaming - peer to peer - instant messaging On Wed, Jul 15, 2009 at 8:48 AM, bsdb...@todoo.biz wrote: Hello, I am about to answer a public tender and am looking for a reliable open-source filtering solution. I need to filter layer 3 and 4 of TCP/IP stack (TCP and Application layer) specially for stream such as Peer to Peer - IM - Streaming - Virus. You have your layers wrong. L3 (IPs) and L4 (protocol, TCP, UDP, GRE, ESP, etc.) are fully supported. I presume you mean higher layers, identifying what traffic is based on the actual payload rather than L3/4 header. 2.0 does have some application intelligence but that's not an option for immediate use. There aren't any similar open source options that do have that kind of functionality unless you build it yourself. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] Re: Patch and ISO: New Feature -- Auto Configuring Interfaces
On Wed, Jul 15, 2009 at 3:39 AM, Ermal Luçiermal.l...@gmail.com wrote: Please pretty please do not make distinctions on lan/wan/optif i have invested too much time to clean this! I don't see anything that treats LAN/WAN/OPT improperly. When auto-assigning interfaces, you don't have a choice but to assign first to WAN, then to LAN, then to OPT. I agree we need to stay away from treating interfaces differently, but I don't see anything here that's improper, there is no other way to assign interfaces. If you have 1 interface, it must be WAN, if you have two, they must be LAN and WAN. You can do whatever you want with those two interfaces once you're in the GUI, but there are no other options in the interface assignment. It functions no differently from the console interface assignment. If I'm missing something else in the code let me know. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
[pfSense Support] Web Interface Pages - Save Button
Hello fellow pfSensers! I've been quietly annoyed with a minor 'issue' in pfSense for some time now and finally thought I'd bring it to light to see if it's just me or if anyone else has the same problem. I love my keyboard. It's one of those nice old IBM 'clickey' units that just feels great to type on. I find I rarely use my mouse unless absolutely required. When I'm using the pfSense web interface, to add/modify a firewall rule for example, I can tab my way around the page adding details where appropriate. Yay. UNTIL, I want to save the page. I tab over to the 'Save' button, hit enter, and NOTHING HAPPENS. Unlike any other page when I can simply hit enter to submit the form, this page requires me to use my mouse to click the button. I've verified this in IE6/7 and Firefox 2.x/3.x with the same behavior. Am I the only one with this problem? Is there a 'fix'? Should I quit grumbling about 'these young punks of today and their fancy mouse gadgets' etc...? Thanks for any pointers or tips. :-) --Tim - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] Web Interface Pages - Save Button
On Wed, Jul 15, 2009 at 11:15 PM, Tim Nelsontnel...@fudnet.net wrote: Hello fellow pfSensers! I've been quietly annoyed with a minor 'issue' in pfSense for some time now and finally thought I'd bring it to light to see if it's just me or if anyone else has the same problem. I love my keyboard. It's one of those nice old IBM 'clickey' units that just feels great to type on. I find I rarely use my mouse unless absolutely required. When I'm using the pfSense web interface, to add/modify a firewall rule for example, I can tab my way around the page adding details where appropriate. Yay. UNTIL, I want to save the page. I tab over to the 'Save' button, hit enter, and NOTHING HAPPENS. You can use the usual way to click a selected button with the keyboard - space bar. Or create a clone at rcs.pfsense.org and change every single page to save on enter and request a merge. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] Web Interface Pages - Save Button
Chris Buechler wrote: On Wed, Jul 15, 2009 at 11:15 PM, Tim Nelsontnel...@fudnet.net wrote: Hello fellow pfSensers! I've been quietly annoyed with a minor 'issue' in pfSense for some time now and finally thought I'd bring it to light to see if it's just me or if anyone else has the same problem. I love my keyboard. It's one of those nice old IBM 'clickey' units that just feels great to type on. I find I rarely use my mouse unless absolutely required. When I'm using the pfSense web interface, to add/modify a firewall rule for example, I can tab my way around the page adding details where appropriate. Yay. UNTIL, I want to save the page. I tab over to the 'Save' button, hit enter, and NOTHING HAPPENS. You can use the usual way to click a selected button with the keyboard - space bar. Or create a clone at rcs.pfsense.org and change every single page to save on enter and request a merge. Space bar eh? Boy that sounds counter intuitive... :-) Thanks for the tip Chris! --Tim - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] Web Interface Pages - Save Button
On Wed, Jul 15, 2009 at 11:25 PM, Tim Nelsontnel...@fudnet.net wrote: Chris Buechler wrote: On Wed, Jul 15, 2009 at 11:15 PM, Tim Nelsontnel...@fudnet.net wrote: Hello fellow pfSensers! I've been quietly annoyed with a minor 'issue' in pfSense for some time now and finally thought I'd bring it to light to see if it's just me or if anyone else has the same problem. I love my keyboard. It's one of those nice old IBM 'clickey' units that just feels great to type on. I find I rarely use my mouse unless absolutely required. When I'm using the pfSense web interface, to add/modify a firewall rule for example, I can tab my way around the page adding details where appropriate. Yay. UNTIL, I want to save the page. I tab over to the 'Save' button, hit enter, and NOTHING HAPPENS. You can use the usual way to click a selected button with the keyboard - space bar. Or create a clone at rcs.pfsense.org and change every single page to save on enter and request a merge. Space bar eh? Boy that sounds counter intuitive... :-) Not specific to anything we do, that's been the standard for pressing a highlighted button for a very long time. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] Web Interface Pages - Save Button
On Wed, Jul 15, 2009 at 10:10 PM, Chris Buechler c...@pfsense.org wrote: On Wed, Jul 15, 2009 at 11:25 PM, Tim Nelsontnel...@fudnet.net wrote: Chris Buechler wrote: On Wed, Jul 15, 2009 at 11:15 PM, Tim Nelsontnel...@fudnet.net wrote: Hello fellow pfSensers! I've been quietly annoyed with a minor 'issue' in pfSense for some time now and finally thought I'd bring it to light to see if it's just me or if anyone else has the same problem. I love my keyboard. It's one of those nice old IBM 'clickey' units that just feels great to type on. I find I rarely use my mouse unless absolutely required. When I'm using the pfSense web interface, to add/modify a firewall rule for example, I can tab my way around the page adding details where appropriate. Yay. UNTIL, I want to save the page. I tab over to the 'Save' button, hit enter, and NOTHING HAPPENS. You can use the usual way to click a selected button with the keyboard - space bar. Or create a clone at rcs.pfsense.org and change every single page to save on enter and request a merge. Space bar eh? Boy that sounds counter intuitive... :-) Not specific to anything we do, that's been the standard for pressing a highlighted button for a very long time. Well I'll be darned. I have to doubly admit that I was annoyed, and wasn't aware of the space-bar saviour either. db
