Re: [pfSense Support] How do I break down a /22 into smaller subnets to use behind(LAN) side of my pfsense box

2010-10-06 Thread Beat Siegenthaler
On 05.10.10 20:43, Adam Thompson wrote: (On an unrelated note - anyone know why I can't send emails to this list from my BlackBerry? Works for other mailman-managed lists elsewhere...) As I remember this is not mailman. It is ezmlm. And I cannot send mails from my regular account too.

Re: [pfSense Support] Write 512MB image onto 4GB CF-card ?

2010-09-17 Thread Beat Siegenthaler
On 16.09.10 21:40, Jim Pingle wrote: And IIRC if the card has any kind of built-in wear leveling, it will extend the life of the card to 8 times what it would have otherwise been. This calculation is IMHO a bit too optimistic. I think wear levelling works with some percentage, maybe 5 or 10%

Re: [pfSense Support] power-out and Alix-boards

2010-09-09 Thread Beat Siegenthaler
On 09.09.10 16:18, Michel Servaes wrote: What could be the cause here ? Should I install an UPS... or should I buy better CF-cards ? As long You use the CF read-only I am pretty shure there is another problem... - To

Re: [pfSense Support] Alix VLANs

2010-08-17 Thread Beat Siegenthaler
On 17.08.2010 13:23, Paul Cockings wrote: Hi Pfsense folk, I am slightly confused about VLAN support on Alix board. I'm considering an Alix 2D3 LX800 (http://linitx.com/viewproduct.php?prodid=12647) + Pfsense for a small project 2D3 with 1.2.3 rel no problem here...

Re: [pfSense Support] Status ipv6

2010-04-18 Thread Beat Siegenthaler
On 16.04.10 20:48, R. Th. Boots wrote: Hello, I known I have been asking this before, but as my provider has started a pilot with native ipv6 over adsl, I was wondering what the current status is regarding ipv6 support. Take a look over to m0n0wall http://m0n0.ch it has a new version from

Re: [pfSense Support] Source NAT /tmp/rules.debug

2009-12-18 Thread Beat Siegenthaler
Does anybody think it'd be worthwhile to submit that as a patch? Or would someone like to see it otherwise (small enough even for posting on the list, perhaps - 105 line context diff)? Maybe this could help too: I Found this article because this Guy wanted to add IPv6 stuff to the Rules.

Re: [pfSense Support] pfSense, WRAP - and I think I also need one of these:

2008-10-05 Thread Beat Siegenthaler
Paul Cockings wrote: Take a look at ZyXEL P660R http://www.zyxel.co.uk/web/product_family_detail.php?PC1indexflag=20040812093058CategoryGroupNo=C8A3A230-907F-4CA8-9C3B-3A84F5A06405 Uhh.. If I see the picture of these hardware... Some of the cheaper Zyxels have fixed subnetmasks, no joke. Be

Re: [pfSense Support] ipv6 possibility

2008-09-30 Thread Beat Siegenthaler
Sean Cavanaugh wrote: tunneling IPv6 would just let you forward traffic in IPv4to an external gateway that translates from IPv4 to IPv6. the developers would rather not do that in favor of just fully implementing support for pfSense to be able to route IPv6 directly without the encapsulation.

Re: [pfSense Support] ipv6 possibility

2008-09-29 Thread Beat Siegenthaler
Scott Ullrich wrote: Chris summed this up quite well but we cannot just half ass implement IPv6. It requires a real testing environment and a lot of work to implement it fully vs. doing it for just most of us needs. I think we all appreciate the quality oriented development. But for

Re: [pfSense Support] ipv6 possibility

2008-09-27 Thread Beat Siegenthaler
Scott Ullrich wrote: And no, a proxy is not an option. Why ? what is the difference for the firewalling stuff? The Protocol is interesting. Most of us need a IPv6 Ruleset, radvd/rtadvd and a 4in6 Tunnel. That's what i am doing on a FreeBSD-Box behind my IPv4 Gateway (pfSense). For many

Re: [pfSense Support] ipv6 possibility

2008-09-26 Thread Beat Siegenthaler
RB wrote: This question comes back up every few months, and every time I wonder: what is the justification case for IPv6? Maybe it's the simple argument: Jump on the Train!!! Hype or not, IPv6 is coming. Let the we get out of IP's yells beside this time. It's like talk about that a

Re: [pfSense Support] DNS cache poisoning (solved)

2008-08-09 Thread Beat Siegenthaler
better than switch to bridge mode, because there is no more control over the router via SNMP, Pings, Management and more. This should work with other routers, with different naming for NAT. Beat Siegenthaler - To unsubscribe, e

Re: [pfSense Support] IPv6

2008-08-07 Thread Beat Siegenthaler
Jan Zorz wrote: What I see from changes, only basiv tunneling is implemented. What we need is also stateless autoconfiguration daemon (radvd), statefull autoconfig support (dhcpv6), full graphical config support (interfaces IP-s, rules definitions, etc...), OSPFv6, DNS tip or trick daemon

Re: [pfSense Support] DNS cache poisoning (solved)

2008-07-31 Thread Beat Siegenthaler
A bit Off-Topic... You can find no Information about DNS-Cache Poisoning at ZyXEL's Website. As manufacturer of NAT-Serializers this is poor behavior. Not for old and probably not patchable Routers nor the Information that maybe newer Products can solve this issue. Does somebody know a

Re: [pfSense Support] DNS cache poisoning

2008-07-22 Thread Beat Siegenthaler
Chris Buechler wrote: How is your outbound NAT configured? Even static port won't rewrite the source ports to something incremental, it just retains whatever the source port is. Automatic outbound NAT rule generation (IPsec passthrough) Auto created rule for LAN Static Port NO Port

Re: [pfSense Support] DNS cache poisoning

2008-07-21 Thread Beat Siegenthaler
Chris Buechler wrote: No, pf has randomized source ports on all NATed TCP and UDP traffic for 8 years. I was surprised to find out that's the exception rather than the norm. Cisco, Checkpoint, amongst numerous others apparently do not randomize source ports on NATed traffic. I am not

Re: [pfSense Support] DNS cache poisoning

2008-07-21 Thread Beat Siegenthaler
Tim Dickson wrote: Could it be your ISPs DNS that is bad? (that pfSense is relaying?) and not pfSense directly? -Tim Same Server behind pfSense and dd-wrt does differ sightly: The server runs patched [EMAIL PROTECTED] No ISP DNS, my own Server. Official DNS for my domains. In my DMZ.

Re: [pfSense Support] DNS cache poisoning

2008-07-21 Thread Beat Siegenthaler
Chris Buechler wrote: And it does recursive queries, does not rely on upstream servers? Are you running with static port enabled? That's the only way your source ports aren't going to be randomized, assuming the server is NATed and not just firewalled. Static port disables the source port

Re: [pfSense Support] DNS cache poisoning

2008-07-21 Thread Beat Siegenthaler
Beat Siegenthaler wrote: And I think it is not really a big problem as long the transaction ID's are really good random. Curiosity killed the Cat: done a dump on pfSense at the dmz-side. It looks that the source ports from BIND are very good in random. But at the wan-side, the ports

Re: [pfSense Support] DNS cache poisoning

2008-07-21 Thread Beat Siegenthaler
Bill Marquette wrote: Shouldn't make a difference if the source port is getting nat'd sequentially. That sounds a little odd to me, but I can check that out when I get home and see if I can duplicate. Can you send me whatever test script you are using? Thanks I use the Link:

Re: [pfSense Support] Re: atheros / ath driver

2008-05-20 Thread Beat Siegenthaler
Ermal Luçi wrote: Are you by any chance running the traffic shaper on the atheros interface? If yes, disabling it does help anyhow? This makes a very big difference. The mbuf counter does now show a normal behavior. 175/350/525 mbufs in use (current/cache/total) even with Zattoo and

Re: [pfSense Support] Re: atheros / ath driver

2008-05-20 Thread Beat Siegenthaler
Ermal Luçi wrote: Is it usable now apart the ath errors?! Meaning it does not disconnect and weird behaviour. Absolute! :-) - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

Re: [pfSense Support] Re: atheros / ath driver

2008-05-19 Thread Beat Siegenthaler
Simon Gerber wrote: ALIX board (latest bios installed) using either CM9 or wlm54abg 200mW as wireless card with 2 antenna setup. Installed on Microdrive using embedded kernel but else writable setup. Played with sysctl settings to no avail. In errors stilll here after playing with the

Re: [pfSense Support] Re: atheros / ath driver

2008-05-19 Thread Beat Siegenthaler
Chris Buechler wrote: It could also be interference, and potentially other things as well. Run athstats at a command prompt or the command page and you may get some helpful info. pfsense:~# athstats 2 input output altrate shortlong xretry crcerr crypt phyerr rssi rate 0

Re: [pfSense Support] Re: atheros / ath driver new odds

2008-05-19 Thread Beat Siegenthaler
sysctl dev.ath shows: pfsense:~# sysctl dev.ath dev.ath.0.txantenna: 0 dev.ath.0.rxantenna: 1 pfsense:~# sysctl dev.ath.0.rxantenna=0 dev.ath.0.rxantenna: 2 - 0 What? I thought it was 1 ? and now? what shows sysctl? pfsense:~# sysctl dev.ath dev.ath.0.txantenna: 0 dev.ath.0.rxantenna: 2

Re: [pfSense Support] Update firmware and backup RRD graph data

2008-05-18 Thread Beat Siegenthaler
tester wrote: Hello, How can I backup RRD graph data? I don't want to lost statistics about traffic (sent/received data) exchanged in these months and so on. I have a script that runs daily via cron anyway: pfsense:/var/log# cat /scripts/save_rrd.sh #!/bin/sh /etc/rc.conf_mount_rw # Save

[pfSense Support] atheros / ath driver

2008-05-17 Thread Beat Siegenthaler
Hi, I have a WRAP, run 1.2 and observe this problem for months. Have 3 different atheros minipci cards cm9-gp wlm54g and wlm54agp23 with 2 antenna setup. Normally there are around 6 errs/s inbound on this card. Interesting is that under heavy load this value goes down. From time to time, the