Subcategories

• Cache/Proxy

  Discussions about packages which handle caching and proxy functions such as squid, lightsquid, squidGuard, etc.
  4k Topics

  21k Posts

  J

  I wanted to share this with anyone else that noticed the speed when you hover over connections on status shows 0/0 always. Just in case also if anyone has any recommendations let me know. sqstat.class.php - Changes Log pfSense Squid Realtime Stats (SQStat) Speed Fix Date: March 12, 2026 PROBLEM SUMMARY Current Speed and Avg Speed columns always showed 0 in SQStat. Three root causes were identified and fixed. CHANGE 1: Connection ID Key (both makeHtmlReport and parseRequest) LOCATION: makeHtmlReport (~line 341) and parseRequest (~line 499) BEFORE: $con_id = $con['connection']; AFTER: $con_id = md5($con['uri'] . $con['peer']); WHY: Squid reports connection IDs as memory addresses (e.g. 0xbe97ec98) which change on every request. This meant the session key for a connection never matched between page loads, so previous byte counts could never be found and current speed was always 0. Using md5(uri + peer) creates a stable, consistent key that matches the same connection across multiple refreshes. CHANGE 2: Session replaced with temp file (both functions) LOCATION: makeHtmlReport (~line 280) and parseRequest (~line 460) BEFORE (session read): unset($session_data); if (isset($_SESSION['time']) && ((time() - $_SESSION['time']) < 3*60) && isset($_SESSION['sqdata']) && is_array($_SESSION['sqdata'])) { $session_data = $_SESSION['sqdata']; } AFTER (file read): $sqstat_file = '/tmp/sqstat_data.json'; $session_data = array(); if (file_exists($sqstat_file) && (time() - filemtime($sqstat_file)) < 180) { $session_data = json_decode(file_get_contents($sqstat_file), true) ?: array(); } BEFORE (session write): $_SESSION['time'] = time(); if (isset($new_data)) { $_SESSION['sqdata'] = $new_data; } AFTER (file write): if (isset($new_data)) { file_put_contents($sqstat_file, json_encode($new_data)); } WHY: pfSense uses jQuery AJAX to refresh SQStat. Each AJAX call was receiving a new PHP session ID, meaning $_SESSION was always empty on every refresh. Data written to $_SESSION on one call was never available on the next call. This was confirmed by debug logging showing a different session_id() on every request. /tmp on pfSense is a tmpfs (RAM) filesystem so writing to /tmp/sqstat_data.json has zero SSD impact and persists correctly between AJAX calls. CHANGE 3: Session start blocks removed (both functions) LOCATION: makeHtmlReport (~line 213) and parseRequest (~line 395) BEFORE: if ($this->use_sessions) { if (session_status() == PHP_SESSION_NONE) { session_name('SQDATA'); session_start(); } } AFTER: (removed entirely) WHY: pfSense already starts its own PHP session before SQStat loads. Attempting to start a second session named 'SQDATA' was conflicting with pfSense's session management. Since we moved to file-based storage this code is no longer needed at all. CHANGE 4: Avg speed moved outside session check (parseRequest) LOCATION: parseRequest (~line 520) BEFORE: if (isset($session_data[$con_id]) && !empty($session_data[$con_id])) { // ... curr_speed calculation ... // avg speed $avg_speed = $con['bytes'] / 1024; if ($con['seconds'] > 0) { $avg_speed /= $con['seconds']; } } AFTER: if (isset($session_data[$con_id])) { // ... curr_speed calculation only ... } // avg speed - always calculate if ($con['bytes'] > 0 && $con['seconds'] > 0) { $avg_speed = ($con['bytes'] / 1024) / $con['seconds']; } WHY: Avg speed does not need previous request data - it can always be calculated as total bytes transferred divided by connection duration. By moving it outside the session/file data check it shows immediately on first load for any connection alive more than 1 second, without needing a previous snapshot. CHANGE 5: Current speed calculation simplified (both functions) LOCATION: makeHtmlReport (~line 345) and parseRequest (~line 503) BEFORE: if ($was_time && $was_size) { $delta = $is_time - $was_time; if ($delta == 0) { $delta = 1; } if ($con['bytes'] >= $was_size) { $curr_speed = ($con['bytes'] - $was_size) / 1024 / $delta; } } else { $curr_speed = $con['bytes'] / 1024; } AFTER: $delta_time = max(1, $is_time - $was_time); $delta_bytes = $con['bytes'] - $was_size; if ($delta_bytes > 0) { $curr_speed = ($delta_bytes / 1024) / $delta_time; } WHY: Simplified the delta calculation using max(1, ...) to avoid division by zero more cleanly. Removed the fallback that set curr_speed to total bytes when no previous size was recorded - that was showing inflated incorrect values. Now only shows current speed when there is a genuine positive byte delta between refreshes. NOTES /tmp/sqstat_data.json is written on every refresh (tmpfs = RAM, no SSD writes) Old closed connections remain in the JSON file but are ignored since they won't match any active Squid connection on the next poll makeHtmlReport is not used by pfSense's version of SQStat (pfSense uses parseRequest + sqstat_resultHTML via AJAX) but was updated for consistency Current speed requires at least 2 refreshes with the same connection active to show a value - this is expected behavior Avg speed shows immediately on first load for connections > 1 second old =============================== End of change log
• IDS/IPS

  Discussions about packages whose functions are Intrusion Detection and Intrusion Prevention such as snort, suricata, etc.
  2k Topics

  16k Posts

  B

  The physical files themselves (the sample SID Management Configuration files) are installed with the Snort package into /var/db/snort. Then, if it's a first-time green field installation, the contents of those sample files are migrated into the config.xml file of the firewall as Base64 encoded text by the post-installation script and stored there from then on. If they are not showing for the OP, then somehow they were accidentally deleted is my best guess. The GUI will allow them to be deleted.
• Traffic Monitoring

  Discussions about packages that handle bandwidth and network traffic monitoring functions such as bandwidtd, ntopng, etc.
  577 Topics

  3k Posts

  G

  @johnpoz The decoded base 64 isn't something I recognise. It's simply "teamspeak5:" and then a random string of numbers/letters/symbols.
• pfBlockerNG

  Discussions about the pfBlockerNG package
  3k Topics

  20k Posts

  K

  @netboy I understand. A good guess since your websites (internetaccess) no longer works is that DNS stops working. That in turn suggests that Unbound (pfSense’s built in DNS server stopped working when attempting to start with the pfBlockerNG integration engaged. Try and check that Unbound have the python integration llisted in its config: [image: 1773438454507-706e4866-9e8e-4e8d-b9e3-55bb35f219bf-image.png] Next thing would be to look into the STATUS -> SYSTEM LOGS -> GENERAL/RESOLVER log and see if Unbound is spitting some usefull info into there
• UPS Tools

  Discussions about Network UPS Tools and APCUPSD packages for pfSense
  105 Topics

  3k Posts

  N

  @dennypage said in UPS ups on battery - appers often now: fast follow UPS like what you have Can you please explain what is "fast follow UPS"? Do you mean "actions or tasks that are done very quickly after an initial event, message, or decision." - I have to say no this is not the issue IMHO becuase the pattern is consistent.. The pattern: <1>Flooded with email alerts from netgate ups (usb attached) <2>No lights or warning from UPS <3>My "custom" app says the UPS is OK <4> I reboot router <5> next 12 hours no alerts <6> alert then flooding my inbox The above pattern repeats. @dennypage I am fully aware you are an expert in nut and i believe you are the developer for netgate NUT package - Do you really think there is no communcation issue between netgate router and the UPS package (service) installed inside the router based on my post?
• ACME

  Discussions about the ACME / Let’s Encrypt package for pfSense
  516 Topics

  3k Posts

  L

  @jimp Up to now I install the certificates on the (web/mail/sftp)server(s) them selves. However since that is becoming more and more complex and certificate lifetimes as becoming shorter and shorter. I do seriously consider to use LetsEncrypt certificates generated on pfSense. And preferable without the help of additional systems. Note however that I am using HA-proxy. So I am trying two routes: completely on pfSense on pfSense with the help of a dedicated webserver on a VM, handling all LetsEncrypt requests. Routed via HA-proxy based on ^path starts /.well-known/acme-challenge/^ For method 1) I implemented the ^acme-http01-webroot.lua^ option I did not yet implement method 2) Of course I do not want to expose the pfSense GUI to the internet. I changed the GUI port number and do not allow access to pfSense from the internet at all (at least I home so) Also have a look at my other thread 'Do not manage to generate Certificate (using ^Webroot local folder^)' My intention is of course that the token is stored and read on pfSense itself without using the GUI webserver / the possibility to access the GUI.
• FRR

  Discussions about the FRR Dynamic Routing package on pfSense
  299 Topics

  1k Posts

  L

  @jimp I'm definitely eager to test that package update, but after the latest system update to 25.11.1 from 25.11, (which I did in the hope it would the OPFv3 issue) my long-working IPsec VTI setup quit passing usable traffic. This obviously not the right topic for that subject. I will post it where it belongs once I get time to collect more useful diagnostic information than I have now. ETA: VTI IPsec VPN seems to be working normally again! IPv4 OSPF is working, and I can now rebuild my IPv6 routes on OPFv3. I am pretty stoked! Thanks to everyone involved in getting that package update published.
• Tailscale

  Discussions about the Tailscale package
  96 Topics

  731 Posts

  C

  @johnpoz said in "Tailscale is not online" problem: @chudak the next version of pfsense + 26.03, its in RC currently https://docs.netgate.com/pfsense/en/latest/releases/26-03.html https://forum.netgate.com/topic/200319/call-for-testing-pfsense-plus-26.03-rc-now-available Do you expect some changes related to TS in it?
• WireGuard

  Discussions about WireGuard
  734 Topics

  4k Posts

  N

  Off course, thanks for reporting.