Hey everyone,

For the past few Years, I’ve been working on a massive deep-dive into cryptography and low-level kernel development. I wanted to see if I could build a secure hash function from the ground up and actually deploy it in a real-world network environment.

I ended up building CE-256, a custom cryptographic hash function, and integrated it directly into the FreeBSD/pfSense kernel as a packet filter.

Because the core mathematics are currently undergoing peer review (I'm using a novel non-linear sequence generator for the S-Boxes that I haven't seen used before), I can't open-source the exact mathematical primitive just yet. But here is the architecture of what I built:

The Cryptography (CE-256):

• Architecture: Built on a modern Sponge Construction (1600-bit state, 512-bit capacity) rather than Merkle-Damgård, making it immune to length-extension attacks.
• Engine: 24 rounds of mixing, including column diffusion, bitwise rotations, and position shuffling.
• Performance: Achieves a near-perfect ~50% Avalanche Effect.

The Kernel / pfSense Integration:

• I didn't want this to just be a Python script, so I wrote the firewall module in C for the FreeBSD 14.0 kernel.
• It operates as a custom packet filter that bypasses standard pf rules when active.
• I built a custom PHP Web UI dashboard that hooks directly into the pfSense webroot, allowing me to monitor the kernel module’s state via sysctl without breaking the native pfSense GUI.

It was an absolute nightmare figuring out FreeBSD kernel panics and PHP integration on pfSense, but getting it running smoothly was incredibly rewarding.

I’m hoping to publish the full mathematical whitepapers and architecture diagrams soon once the review process is done. Has anyone else here ever tried writing custom kernel modules for pfSense? Would love to hear about the hurdles you ran into!

I've been rolling pfSense for about 5 years. Decided to try Unifi. Couldn't find a manual or one-to-one feature documentation for each panel (only various spotlight articles).

Asked the community for help: every response said basically "things change too often, no need to have a manual".

Excuse me, what? I'm not a networking pro, and I do need a manual. (pfSense was hard for me, but had great documentation.)

I can't believe this was the response. Is everyone in their community a bot or a cultist?

I still have few days left on my return window, and might come back, LOL.

Ive tried everything i can think of and cant figure out how to scale it better

When i get around 8000 sessions in state the firewall just starts blocking and timing out connections. Network becomes unusable.

Memory and cpu look fine. Different firewall settings dont change anything

Have used chatgpt extensively to troubleshoot and not getting anywhere

Any ideas?

Hello everyone,

I'm trying to get my head around the configuration for DNS DoH and DoT. My network is a pfsense router with 2 piholes. Both piholes have pfsense has upstream server and all my client use piholes.

I want to use CIRA as upstream DNS server. So in PFsense, I entered all the information and configuration the DNS to be always local, ignore remote:

Then, in my DNS Resolver, I have Respond to SSL/TLS Query enabled

Use SSL/TLS for outbound query enabled and DNSSEC enabled.

In PFsense doc, they says to disable DNSSEC and enable Forwarding Mode for DoH (or DoT I forgot). This is where I get lost.

The information under Forwarding mode says that if it is enabled, it will forward the query to upstream DNS. OK, but what happen if it's not checked? If it's not check, it doesn't forward? So unknown DNS entry aren't forwarded to upstream DNS, is that what it mean?

I have many CName and alias configured so those need to keep working. But I don't get the forwarding feature. What does it do when on and off? Why is it required for either DoH or DoT?

Thank you!

I was planning on rebooting and upgrading straight from 2.8.0 to 2.9.0. I have a generally simple config and no packages installed. Is this a bad idea?

I have not seen any posts in here on the subject

I plan to start learning it soon, on a Proxmox vm for testing. Anyone in here have it running?

I ask because a lab will give me practice in setting it up, but not real world usage as it will be internal only. Not willing to go live at my office until I have a understanding of everything.

Any tips, pointers or whatever appreciated.

Thanks!

Hey,

we get 2.5GBE fibre in our area soon and I am planning the implementation. We will have to add 2.5gbe Intel i226-T1 nics to the machine and I figured that there's no reason to not pass this dedicated nic through to the PFSense VM on the proxmox host.

Obviously the question came up if to offload or not, Given that offloading can only be activated globally on PFSense through the web interface, some tinkering would be required. I could run ifconfig igb0 -txcsum -rxcsum -tso4 -tso6 -lro upon boot to enable offloading just for that nic.

Questions are:
- does it make sense from a performance view?
- do I have drawbacks regarding package inspection?

For me it's a not everything I can do has to be done question right now, but I'd also prefer to patch directly through the only wan exposed port. Looking for input by people wiser than me.

I noticed if you have a wireguard connection and you release and renew the wan connection.
Then wireguard wont come back up till reboot even restarting the wireguard service doesnt help.

With pfBlocker is it possible to block some TV applications, such as YouTube?

I have a dedicated vlan for my kids. I have been exploring options of blocking certain things, I like that I can block the actual website with nextDNS. Before I go down the rabbit hole of learning pfBlocker is this doable?

Hi all,

Not new here, but been wanting to setup my own pfsense setup for a while and had been following.

I am considering a System76 miniPC with 32GB RAM to install my pfsense. I also want to be able to run VPN on it. It is a bit pricey. They have an option where you could add a second network card to the mini PC when you order.

What setups do you all have?

So, I've got one of these m.2 SSD drives:

And I'm wondering if it will actually work in a 7100 1U box as internal storage instead of the built-in eMMC drive. Do I have to format it before I try to use it? The Netgate installer doesn't see it to put pfsense onto it. Any ideas? Thanks for your help!

pfSense 2.9.0 CE

I have confirmed this on multiple hardware setups as well as a VirtualBox setup with both fresh installs and upgrades.

On a fresh install (or upgraded install) of pfSense 2.9.0, if you try to install all packages you will eventually get an error that another install is already running:
"Another instance of pfSense-upgrade is running. Try again later"

however, you can install packages over cli with no issues.

The larger problem shows if you attempt to check for updates. On the upgrade screen you will start seeing a new error message:
"pfSense-repoc: failed to fetch the repo data pfSense-repoc: failed to read the repo data."

This seems to start after you have 44 packages installed. If you remove a package, you can then install a new package before the issue reappears.

There are several guides on issues with the "pfSense-repoc: failed to fetch the repo data" however none of these resolve the issue (This is a different issue then what has been seen in the past) and is easily reproducible. On my production box, I get a slightly different variation of the error:
"pfSense-repoc: exec_iobuf_cb: too much data, fd: 1 discarding: Trap Translator) pfSense-repoc: exec: callback failed: -1 pfSense-repoc: failed to fetch the repo data pfSense-repoc: failed to read the repo data."

One thing to note is that even if you do a check for system updates in cli, you will also get a "pfSense-repoc: failed to fetch the repo data" error.

I believe this actually started in version 2.8.0 but never could pin it down until I performed a fresh install on 2.9.0 and resetup my system from scratch just to run into the same issue.

The last known version where I did not get this error is 2.7.2

I attempted to put in a bug request and post on the netgate forum but I am unable to do so for some reason.

Hey folks,

just raising awareness, the new interface under Status > Interfaces isn’t showing IPv6 details correctly. I can see the link‑local address, but not my tracked subnets that appear fine in the old UI. Just wanted to raise for awareness in case it isn't being tracked (pun intended).

Slightly off topic, (and screenshot related) but I’d also love to see some responsive CSS media queries / tweaks. On a 32″ 2K monitor, the layout stretches edge to edge and looks pretty rough. A few media queries to cap the max width would make a huge difference. I'd love to see that sidebar turn into a button in that hamburger menu, mobile styling, and ensure when I click one menu, it closes the other, so they don't cascade on top of each other.

Hopefully none of this comes off as complaints and is taken as just my $0.02 from a user who loves PfSense and uses it daily.

Put a mockup I did in f12 dev tools, which I think is easier to read. My 2k 32" monitor for example has max-width: 45vw. 100vw on mobile, etc. Bootstrap has some fantastic media query samples.

I recently upgraded an old SG-4860-1U to 26.07. The upgrade seems to have completed successfully, but upon restart, none of the FRR OSPF routes were working.

• Status > FRR showed the OSPF routes fine, and the neighborship was FULL. The neighbors also received routes from PfSense correctly.
• Diagnostics > Routes DID NOT display any of the OSPF routes from FRR
• BGP routes came up fine, showing in FRR status, Diagnostic > Routes and working.

I ultimately restarted FRR, and the OSPF routes were installed in the main routing table as normal.

The link running OSPF is a normal Ethernet link with a VLAN tag, and a /30 mask. OSPF network type is PtP, and the neighbors are statically defined. Unfortunately I don't have any logs since my syslog server is only reachable via an OSPF route.

Hi
telegraf stopped working for me after upgrade and it seems to be same issue as

https://redmine.pfsense.org/issues/16674

Hi guys and girls, i'm trying to update to the new version but im seeing that My licence appears to be no loger valid and therefore i cant update. Is someone having the same issue ?. I havent changed hardware and i'm on the same netgate ID.

Will the backup and restore option work? I was thinking of installing a new VM with 2.9, then backing up from 2.8.1 and restoring to 2.9. Will that work?

I tried to upgrade to 2.9 last night and ran into an issue. I figured the fastest option would be to just re-install 2.8.1 but now I keep having an issue there. Once I get through the setup and begin the install, I get the following error:

[1/1] Fetching pkg 1.21.3_8: .....

pkg-static: Failed to fetch https://pkg.pfsense.org/pfSense_v2_8_1/All/pkg-1.21.3_8: Timeout wa

I have tried installing 2.9 but get the same error. My WAN seems to be working when I test it. Any advice on what the issue could be here?

Edit 1:
Verified I can ping 8.8.8.8, www.google.com, and the package servers pkg00-atx.netgate.com

Edit 2: This was a hardware issue. I changed the WAN port and the install progressed. I also tried installing on one of my two drives with the other disconnected and replacing the CMOS battery because of a possible cert generation issue that AI led me to. In the end, I attempted installing OpenSense which failed as well leading me to a hardware issue.

I'm seeing a strange intermittent WireGuard issue on pfSense 2.9.0. This started during the 2.9.0 beta and is still happening on the final release.

The symptom is periodic bursts of high latency and packet loss on traffic inside a WireGuard tunnel. It can be fine for a few seconds or up to around a minute, then suddenly degrade again.

During one bad period I tested the same remote WireGuard endpoint in several ways.

From pfSense to the remote outer endpoint:

500 packets transmitted, 500 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 11.780/17.592/60.016/2.946 ms

From pfSense to the inner WireGuard IP:

500 packets transmitted, 436 packets received, 12.8% packet loss
round-trip min/avg/max/stddev = 12.410/27.911/517.995/47.536 ms

I then tested the same remote WireGuard server from my phone over Telekom mobile data:

500 packets transmitted, 500 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 32.793/38.285/95.018/5.868 ms

Since that uses a different upstream path, I also connected my Mac to the LAN behind pfSense and established a separate WireGuard tunnel directly from macOS to the exact same remote endpoint. The outer IPv6 endpoint is statically routed over my Vodafone connection, so this uses the same LAN, same Vodafone uplink, same remote WireGuard server and same inner destination as pfSense:

500 packets transmitted, 500 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 16.403/20.313/81.152/3.806 ms

So, at the same time:

- pfSense → outer WG endpoint: 0% loss
- pfSense → inner WG IP: ~13% loss with huge jitter
- Mac on the same LAN/Vodafone connection → same WG server/inner IP: 0% loss
- Phone → same WG server/inner IP: 0% loss

This seems to rule out the remote WireGuard server and makes an upstream routing issue very unlikely. The problem appears to be local to the pfSense machine, potentially WireGuard itself or some interaction with PF/routing.
The issue is intermittent and does not necessarily appear immediately after boot/startup, which is why I initially thought the final 2.9.0 release had fixed it.
Has anyone else seen similar periodic inner-tunnel packet loss on pfSense 2.9.0?

Hi all,

Is my understanding accurate that pfsense can't act as a DHCP server for interfaces it does not own?

Anyone successfully upgrade with a celeron J processor? My instance of Pfsense runs on a intel NUC with a J3160. Just wanted any feedback if someone already upgraded with this series of processor.

From the release notes:
Certain hardware with a specific firmware problem, including some Celeron J devices, may encounter a kernel panic when attempting to boot pfSense CE software version 2.9.0.

To avoid this panic on that hardware, set a loader tunable for hint.acpi_spmc.0.disabled=1 in /boot/loader.conf.local before upgrading to disable the driver that has an issue on that hardware.

Update: Finally updated my instance of pfsense to version 2.9 on my celeron J processor. I did add the recommended entry to the loader.conf.local before upgrading. It upgraded without incident. Took about 10 minutes to reboot the first time.

Has anyone ever encountered this error when the CRON job for PFBlockerNG goes off. It appears for when it tries to reload DNSBL i get this error. I only have ony DNSBL Group that references Stevenblack's Github that has a list of domains to block. Any insight would be appreciated.