pfSense bugtracker: Issues 2021-05-15T12:20:50Z pfSense bugtracker Redmine pfSense - Feature #11927 (New): Allow DHCP not to serve a gateway - small fix 2021-05-15T12:20:50Z Jori Huisman <p>Currently pfSense cannot serve dual homed machine on DHCP without giving both interfaces a default gateway as leaving the default gateway field empty means pfSense will send the firewall interface as default gateway. As jimp suggested either a checkbox to suppress sending a gateway or entering the word "none" into the gateway box to prevent the gateway from being supplied to clients will be an easy and adequate solution for dual or multi homed machines. More information can be found on: <a class="external" href=""></a></p> pfSense - Bug #11926 (New): Advanced DHCP Client Configuration help text 2021-05-15T09:57:14Z Danilo Zrenjanin <p>Under Interface setup > DHCP Client Configuration > Advanced configuration, help text for protocol timing is at the wrong place.</p> pfSense - Bug #11925 (New): Calling-Station-Id always set to WAN IP 2021-05-14T14:27:29Z Viktor Gurov <p>RADIUS attribute Calling-Station-Id always set to WAN IP address,<br />no matter which interface OpenVPN server is listening on:<br /><a class="external" href=""></a></p> pfSense - Bug #11923 (Pull Request Review): NAT 1:1 fail to validate aliases 2021-05-14T10:07:43Z Massimiliano Cianelli <p>We have some NAT 1:1 configured with the "Destination" field with alias. <br />Today we discovered that we could not either add or modify any NAT with a destination alias, the answer will be:<br />The following input errors were detected:</p> <pre><code>The destination address is not from the specified address family.</code></pre> <p>The NAT I'm tryin to edit contain the following parameters:<br />Interface: LAN<br />Address Family: IPv4<br />External subnet IP: Single Host - 10.xx.224.0<br />Internal IP: Network - 10.xx.0.0/24<br />Destination: Single host or alias - Our_Object_Alias</p> <p>The alias "Our_Object_Aliases" contain:<br />10.xx.128.32/29<br />10.xx.128.40/29</p> <p>With pfSense version 2.4.5-p1 work without problem, with pfSense 2.5.0 and 2.5.1 we receive the error.</p> pfSense - Bug #11922 (Pull Request Review): Certificate manager reports CA as in use by LDAP serv... 2021-05-14T09:33:27Z Viktor Gurov <p>If you create a LDAP Authentication server entry with transport = "Standard TCP" and select a non-global peer CA,<br />it will show this peer CA certificate as "In Use" on the CAs page</p> pfSense - Feature #11921 (New): Feature Request: Compile unbound with EDNS Client Subnet (ECS) mo... 2021-05-14T08:03:54Z M Felden <p>There are use cases for the subnet module in unbound to be able to configure EDNS client subnet behavior via the</p> <p>"send-client-subnet:" and "client-subnet-zone:" directives. This requires the subnet module. As of pfSense 2.5.1 this is not available.</p> <pre><code class="text syntaxhl"><span class="CodeRay">unbound -V Version 1.13.1 Configure line: --with-ssl=/usr --with-libexpat=/usr/local --disable-dnscrypt --disable-dnstap --with-libnghttp2 --enable-ecdsa --disable-event-api --enable-gost --with-libevent --with-pyunbound=yes --with-pythonmodule=yes LDFLAGS=-L/usr/local/lib ac_cv_path_SWIG=/usr/local/bin/swig --disable-subnet --disable-tfo-client --disable-tfo-server --with-pthreads --prefix=/usr/local --localstatedir=/var --mandir=/usr/local/man --infodir=/usr/local/share/info/ --build=amd64-portbld-freebsd12.2 Linked libs: libevent 2.1.12-stable (it uses kqueue), OpenSSL 1.1.1k-freebsd 25 Mar 2021 Linked modules: dns64 python respip validator iterator </span></code></pre> <p>Feature request is for unbound to be compiled with "--enable-subnet" to facilitate this.</p> <p>Reference 1: <a class="external" href=""></a><br />Reference 2: <a class="external" href=""></a></p> pfSense - Regression #11857 (New): Match rules cause pf error parsing rules 2021-04-27T14:21:35Z Jim Pingle <p>Having a match rule, either manually or from ALTQ traffic shaping, leads to a pfctl error loading the rules:</p> <pre> pfctl: Invalid rule type 12 </pre> <p>Happens on Plus 21.05 snapshots as well as 2.6.0 snapshots.</p> <p>Simple to reproduce, add a rule on the Floating tab with the action set to match. The other parameters don't seem to matter, so set a random TCP port, save and apply. Then after applying, there will be an notification of the error.</p> <p>Remove the match rule(s) and/or remove ATLQ traffic shaping and the rules load as expected.</p> <p>Rule from /tmp/rules.debug:<br /><pre> match on { ix3 } inet proto tcp from any to any port 65164 tracker 1619532858 flags S/SA label "USER_RULE: match test" </pre></p> <p>Same rules load fine on 21.02.2/2.5.1.</p> pfSense - Bug #11850 (Feedback): NTP authentication input validation rejects valid keys 2021-04-24T17:44:47Z Thomas Paetzold <p>I run into issues with the "Enable NTPv3 authentication (RFC 1305)" and more precisely whit entering a valit SHA-1 key.</p> <p>According to "*services_ntpd.php*" following condition is coded:</p> <pre><code>elseif (($pconfig['serverauthalgo'] == 'sha1') &#38;&#38; ((<strong>strlen(base64_decode($pconfig['serverauthkey'])) != 40</strong>) ||<br /> <strong>!ctype_xdigit($pconfig['serverauthkey'])</strong>)) {<br /> $input_errors[] = gettext("The supplied value for NTP Authentication key for SHA1 digest must be hex-encoded string of 40 characters.");</code></pre> <p>Thus as soon as either (strlen(base64_decode($pconfig['serverauthkey'])) != 40) OR !ctype_xdigit($pconfig['serverauthkey']) the key is not accepted by pfSense. Obviously a base64 decoded 40 character long hex string will fail such check. And in case it would be base64 encoded string it would fail the !ctype_xdigit($pconfig['serverauthkey']) check. Thus it seems difficult to enter any valid key (?)</p> <p>Assuming my key is: <br />$ echo '*094c533b614d9e4bcb6e18a97a7b0e4d459025bd*' | base64<br />MDk0YzUzM2I2MTRkOWU0YmNiNmUxOGE5N2E3YjBlNGQ0NTkwMjViZAo=</p> <p>and other try:</p> <p>$ echo '094c533b614d9e4bcb6e18a97a7b0e4d459025bd' | base64 --decode<br />����}��^����q���ƽ��������tۖ�</p> <p>So what ever I insert - it ends up in:</p> <p>The following input errors were detected:</p> <pre><code>The supplied value for NTP Authentication key for SHA1 digest must be hex-encoded string of 40 characters.</code></pre> pfSense - Bug #11846 (Pull Request Review): Logging configuration added by a package is not remov... 2021-04-23T05:43:39Z Viktor Gurov <p>How to reproduce:</p> <p>1) Install HAProxy-devel;<br />2) Check /var/etc/syslog.d/haproxy.log.conf file;<br />3) Uninstall HAProxy-devel;<br />4) /var/etc/syslog.d/haproxy.log.conf still there, and you can see `syslogd: /var/log/haproxy.log: No such file or directory` errors</p> <p>workaround - reboot the system</p> pfSense - Regression #11751 (Feedback): Input validation prevents creating 1:1 NAT rules on IPsec 2021-03-29T14:41:31Z Steve Wheeler <p>Additional input validation in the GUI in 21.02/2.5 prevents creating a 1:1 NAT rule on the IPSec interface because it expects an IP family and enc doesnot have one:<br /><pre> The following input errors were detected: The interface do not have address from the specified address family. </pre></p> <p>Should also read "interface does not have address".</p> <p>This is an edge case because NAT is not expected to work on IPSec. However there are situation where us can work and did in pfSense < 2.5. <br />Specifically if the P2 in use carries it will carry the NAT'd traffic still.</p> <p>This only applies to 1:1 NAT</p> <p>Tested in:<br /><pre> 21.02.2-RC (arm64) built on Mon Mar 29 03:04:00 EDT 2021 FreeBSD 12.2-STABLE </pre></p> pfSense - Bug #11698 (Feedback): Incomplete PPPoE custom reset values lead to invalid cron entry 2021-03-18T13:50:22Z Viktor Gurov <p>If you configure the "Custom Reset" option and only fill in the "Minutes" or "Hour" field, but not other fields,<br />an invalid crontab entry will be generated:<br /><pre> 30 * * * root /var/etc/pppoe_restart_pppoe0 </pre><br />or <br /><pre> 1 * * * root /var/etc/pppoe_restart_pppoe0 </pre></p> pfSense - Bug #11370 (New): firewall_aliases_edit.php is limited in the number of input entries i... 2021-02-04T18:18:11Z Marcos Mendoza <p>This is likely related to <a class="issue tracker-1 status-1 priority-4 priority-default" title="Bug: HAProxy frontend and backend entry limit (New)" href="">#10937</a></p> <p>When creating a new alias of type "host", the number of entries that get saved is limited to a relatively small number.</p> <p>Steps to reproduce:</p> <p>- Under "Firewall / Aliases", import a list containing 520 lines of IP addresses<br />- Apply changes<br />- Under "Diagnostics / Tables", select the test alias<br />- The number of records shown is less than what was imported<br />- This can also be seen with the command: pfctl -t test_alias -T show | wc -l</p> <p>Switching the alias type to "Network", saving, then applying, leads to a table with 0 entries.</p> pfSense - Regression #11316 (In Progress): Unbound crashing with signal 11 2021-01-26T20:21:55Z Martin Müller <p>Seems to be the same as here... <br /><a class="external" href=""></a></p> <p>My workaround: I have moved to DNS forwarder.</p> <ul> <li>Why has the command opnsense-revert not been adopted for pfSense?</li> </ul> pfSense - Bug #11091 (In Progress): Interfaces set as disabled in the configuration have an UP st... 2020-11-21T06:05:58Z Viktor Gurov <p>If you disable interface on interfaces.php page it's disabled <br />there is no UP in ifconfig output and `get_interface_info()` returns 'status' = 'down', 'enable' = 'false'</p> <p>but after system reboot interface status is UP in ifconfig output and `get_interface_info()` returns 'status' = 'up', 'enable' = 'false', which is incorrect</p> <p>it seems `interfaces_configure()` doesn't disable interfaces on boot</p> pfSense - Todo #6647 (New): Enable Additional Security Headers 2016-07-27T01:30:24Z Chris Buechler <p>The nginx instance for the web GUI should enable CSP. Just adding the following works:</p> <pre> add_header Content-Security-Policy "default-src 'self';"; </pre> <p>though I suspect that may break some edge case I'm not thinking of. The captive portal nginx instance shouldn't have that set, as people routinely include external resources that would be broken by that.</p> <p>Adding upgrade-insecure-requests while there wouldn't hurt either.</p>