Netgate SG-1000 microFirewall

Recent Posts

Pages: 1 2 3 [4] 5 6 7 8 ... 10
Hardware / Re: Network Card suggestions
« Last post by Derelict on Yesterday at 10:56:23 pm »
If you add NICs of the same type you can run into enumeration ordering issues.

For example if you have two onboard NICs that are igb0 and igb1 then add a two port intel card that also uses the igb driver, that card might show up as igb0 and igb1 pushing the on-board ports to igb2 and igb3. So you reboot and nothing works because it's not patched to the correct ports. There is really no way to know but to try it. The system BIOS makes those decisions and presents the hardware to the OS.

The best thing to do is note the MAC addresses, shutdown, install the new card, then boot into single-user mode.

You can look at the output there and see what cards are showing up as what device.

Then make a plan to either reassign the interfaces to the new physicals or re-patch to the new hardware.

You can use the dmesg command to see the current output or cat /var/run/dmesg.boot to see the messages from the last time the system booted.

igb0: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0x1000-0x101f mem 0xdfc00000-0xdfc1ffff,0xdfc20000-0xdfc23fff irq 18 at device 0.0 on pci3
igb0: Using MSIX interrupts with 3 vectors
igb0: Ethernet address: 00:08:a2:0a:59:41
Mira, el principal consejo que podría darte, es que utilices Puntos de Aceso (Access Point) y no enrutadores (Router). Si no tenes la posibilidad de conseguir APs, entonces es recomendable que configures CADA ENRUTADOR poniendoles una IP del rango en que está configurada la LAN en el pfSense pero que no sea dentro del rango que reparte. ¿Qué quiere decir esto? muy simple, si la LAN del pfSense reparte por ejemplo de la a la, debes colocar a cada enrutador una IP menor a 20.  Por ejemplo:
Enrutador Uno:
Enrutador Dos:
Enrutador Tres:
Enrutador Cuatro:
Enrutador Cinco:
Enrutador Seis:

Desactivas en todos el DHCP ya que sería el pfSense el único DHCP en la red y NO UTILICES EL PUERTO WAN O INTERNET para nada. Debes utilizar cualquier puerto LAN para conectar los Enrutadores al pfSense.

De esa forma, el único amo y señor de la red, será el pfSense.
Warning: PHP Startup: Unable to load dynamic library '/usr/local/lib/php/20131226/' - Shared object "" not found, required by "" in Unknown on line 0
Netgate SG-2220
OpenVPN / Re: Fast speeds web browsing - grinds to a halt if torrenting
« Last post by marvosa on Yesterday at 10:48:42 pm »
Verify you don't have any rogue traffic shaping rules or limiters.

Are you routing all traffic over the AirVPN tunnel?

Do you have a site-to-site tunnel to your friend's firewall?  I doubt this is it, but double check that your rules are not routing traffic through your friend's connection

I would need to see your OpenVPN config's and your firewall rules to offer more targeted troubleshooting.
My computer is on a the range, and the server is on a range. I don't want to add a address to the servers because they need to be isolated. Shouldn't the pfsense just route the traffic between the 2 interfaces. It must be allowing it through because i can connect for a few seconds at least.

If is actually an inside interface and not addresses on WAN, then yes.

You are trying to ping-pong your traffic out to the WAN then back into the same interface it arrived on. When the server has reply traffic, that traffic is same-subnet so it doesn't even send it to the firewall at all so you have pretty much the worst kind of asymmetric routing.

I have a server with 2 IP addresses, and

I don't want to add a address to the servers because they need to be isolated.

Which is it?

Diagram your network. Detail where all the addresses are and where your 1:1 NAT and port forwards are.
DHCP and DNS / Re: Inability to get DHCP ? No Carrier
« Last post by InvictusDecretum on Yesterday at 10:35:30 pm »
Seems the SG3100 is affected by this as well:

That would severely suck for me... as that's going on 6mo with no movement.  Is there any way I can actually see what my connection is ?  based on 6Mbps, it very well could be 10FD.
LED on the ASUS WAN is green (10mbps... my connection speed is 6mbps.

WOW!!!  6 millibit/s!!!

Actually, it shouldn't show green for 10 Mb, unless the other end is only a 10 Mb interface.  The light has nothing to do with the actual bandwidth.  For example, the modem interface could be capable of 1 Gb, yet still only provide 6 Mb, as limited by ADSL.

Haha thank you for pointing out the error of my ways.  The light is a very definitive green, as compared to the yellow of the connection coming out of the switched ports.  There is 100*M*bps internet coming into this area though, which leads me to believe the line is faster than 10baseF.  The light would also be green with a 100Mbps negotiated link too, correct ?  Is there a way for me to determine what protocol the line is running 10 or 100 or 1000baseF ? 

I have also submitted a ticket to NetGate for assistance.  They want me to test putting an unmanaged switch between the SG3100 and the wall socket, which I'll grab tomorrow.
My computer is on a the range, and the server is on a range. I don't want to add a address to the servers because they need to be isolated. Shouldn't the pfsense just route the traffic between the 2 interfaces. It must be allowing it through because i can connect for a few seconds at least.
General Questions / Re: Country blocking to stop devices calling home
« Last post by jahonix on Yesterday at 10:12:45 pm »
Forget about smart-TV's ability to play Netflix and such. They'll be outdated within a year or two anyways. No manufacturer is interested in supporting them longer than need be. They want to sell new ones. Watch TV via their tuners and use them as monitor for set-top boxes and devices like Apple TV, Fire TV, Roku, ...

Deny cameras all outbound access. Dump them if they fail to work without calling home - they will have more serious design flaws than that.

Apps on your mobile can be tamed best when only allowing them http(s) and mail ports outbound. Block the rest and see what happens.
Packages / Re: ACMEv2 is live!
« Last post by cbadk on Yesterday at 09:50:57 pm »
I'm getting "[Fri Mar 23 02:39:40 UTC 2018] Create new order error. Le_OrderFinalize not found. {"type":"urn:ietf:params:acme:error:malformed","detail":"Parse error reading JWS","status": 400}" when trying to issue the certificate.

It seems it was related to , but when running manually from the console it works. Maybe someone knows what the problem could be?

I've tried deleting the file mentioned and upgraded the acme to the developer version but still doesn't fix the problem.

General Questions / Re: Best Wireless AP
« Last post by jahonix on Yesterday at 09:45:20 pm »
I'm a bit astonished that Ruckus doesn't get more coverage here.
Their APs can be used in "stand alone" mode with webGUI configuration, have a CLI and VLANs were never an issue with them. I run a few in some installs this way. If you have more than one APs to manage then get a controller, called "ZoneDirector" with Ruckus.

Ubiquity seems often used by ambitious home users, probably because of costs. I've never seen them in commercial installs with more than 3 APs.

A bigger local venue (10.000 capacity) just dumped Aruba and installed Aerohive and they seem quite happy. I'm not involved in WiFi there, just reporting. I would have installed Ruckus, the client density per AP is impressive.

Cisco is Cisco - solid work, solid price, nothing fancy.
Pages: 1 2 3 [4] 5 6 7 8 ... 10