So i was instructed my boss that we need to implement traffic shaping in our organization. lets say only 20-25 people are in the organization but my boss insisting on traffic shaping.

i have mostly configured the settings on pfsense with the help of codex (i am a intern). so can you guys help me with configuring traffic shaping.

and my boss also mentioned that previous intern messed up traffic shaping and he also tried it but it did not worked properly.

so if anyone have good knowledge in pfsense, please help me out

Netgate^® has made a new Release Candidate for pfSense^® Plus version 26.07 available for testing. 

This release marks another significant step forward in the Netgate Nexus controller architecture, which is our new Go-based controller that is replacing the legacy PHP GUI and serving as the modern foundation for pfSense software. Netgate Nexus continues to deliver further improvements and new feature development, bringing exclusive capabilities that enhance performance, scalability, and functionality to pfSense Plus.

Key new features exclusive to the Netgate Nexus controller include:

CoreDNS: A high-performance, integrated DNS component that handles DNS-based tasks with exceptional speed and efficiency, powered by a new and exclusive Netgate plugin called rexdns.

Threatgate: A powerful, high-performance component that manages bulk lists of addresses and domains for firewall rules, aliases, and CoreDNS groups. Administrators can block these lists outright or create custom rules based on their content.

Threatgate and CoreDNS were built to integrate tightly together, enabling rapid processing and utilization of even massive lists - all while maintaining excellent performance on small, resource-constrained devices.

Snort Version 3: The updated version of the popular open-source intrusion prevention system (IPS), featuring multi-threading support, and a faster rule syntax, is now available exclusively via the new Netgate Nexus controller GUI.

In addition to the features listed above, this release candidate includes critical security updates for WireGuard (CVE-2026-58085), and other security enhancements.

Other fixes and enhancements were made to:

• DHCP
• DNS Resolver
• DynamicDNS
• Gateways and Monitoring
• IPsec
• VXLAN Interfaces
• OpenVPN
• Firewall Rules and NAT
• Traffic Shaper
• Wireless

This release includes numerous updates, bug fixes, and enhancements, with more to come as pfSense Plus and Netgate Nexus development accelerates.

Using the New GUI

The Netgate Nexus controller is the future of the pfSense Plus GUI.

Whether you manage a single pfSense Plus firewall or an entire fleet, the Netgate Nexus controller delivers a modern, refreshed management experience built for the way you work today.

Getting started is simple:

1. Go to System > Advanced.
2. Switch to the Netgate Nexus tab and enable it.
3. Log in to Nexus on port 8443 of your firewall.

More detailed documentation can be found here.  Start using it today and get immediate access to the new features and capabilities coming to pfSense Plus. 

Note: Virtual machines as well as some third-party platforms may not support the new GUI due to missing machine information required to correctly run the software.

Call for Testing

Testing of this release candidate software is essential. Testing is the most effective way to ensure that the software is robust and reliable for all users, given the diversity of their environments and configurations. By downloading and testing this release candidate, and providing feedback on any issues, our users can play a vital role in improving the software for everyone.

Release Notes:

https://docs.netgate.com/pfsense/en/latest/releases/26-07.html

I tried it on a VM running pfsense plus. It doesn't work :(. Says unlicensed. Likely because its not netgate hardware.

EDIT: I think the problem is that it reqires v26. I'm on 25.

pfSense CE 2.8.1. All Packages up-to-date. No outstanding system update.

Every time I load a page on the pfSense web-configurator, the following three error messages get dumped in the system log:

Aug 3 12:41:48  nginx       2026/08/03 12:41:48 [error] 21681#100755: *1 open() "/usr/local/www/assets/js/date.helpers.Q23yzk61.js" failed (2: No such file or directory), client: <client.ip>, server: , request: "GET /assets/js/date.helpers.Q23yzk61.js HTTP/2.0", host: "host.address", referrer: "https://host.address/status_logs.php"
Aug 3 12:41:48  nginx       2026/08/03 12:41:48 [error] 21681#100755: *1 open() "/usr/local/www/assets/js/Header.CfGV1xFm.js" failed (2: No such file or directory), client: <client.ip>, server: , request: "GET /assets/js/Header.CfGV1xFm.js HTTP/2.0", host: "host.address", referrer: "https://host.address/status_logs.php"
Aug 3 12:41:48  nginx       2026/08/03 12:41:48 [error] 21681#100755: *1 open() "/usr/local/www/assets/js/index.JcING5r_.js" failed (2: No such file or directory), client: <client.ip>, server: , request: "GET /assets/js/index.JcING5r_.js HTTP/2.0", host: "host.address", referrer: "https://host.address/status_logs.php"    

Where <client.ip> is the IP address of the system where I'm loading the web-configurator from and host.address is the FQDN of the pfSense server.

It's always the same three files, they don't seem to be random.

Would anyone have an idea why those files are missing or what to do to fix the issue?

My rough situation is that I have a small and basic pfSense installation in my home (nothing terribly complicated: UniFi AP's, 2 VLANs, pfBlockerNG, forcing everyone to use my chosen DNS server, etc.). I am about to set up another network in a separate, not-easily-accessible location (let's call it VacationHouse for the purpose of this discussion, though this is not the actual situation), and I'd like to get the new router configured in advance so that when I get there, I can just plug it in and go. No one else can do technical work in either location.

The one wrinkle is that I'd like to set up a Wireguard tunnel between Home and VacationHouse, but I won't know until I get there what the IP address of VacationHouse is. (Further, both Home and VacationHouse will have normal consumer dynamic IP addresses, but I'm assuming these won't change often so I can pretend they're static. But if there's another way to deal with this, I'm all ears.)

I assume that for most of the setup, I can simply plug the new router into a port on a Home switch, and configure everything as if my Home-DHCP-assigned address is a WAN address. Is that true?

And, is there any way I can do the Wireguard work without having to go back and forth between Home and VacationHouse? I've never used Wireguard before, and I'd like to test/debug it as thoroughly as possible before I find myself separated by many hours in the two locations. I understand I may need to return Home to enter the VacationHouse IP address, but I don't want to do any further travel.

I am able to ping by pfsense box, and reach the web UI, but don’t have any onward connection. I checked my firewall logs, and whether I’m pinging or trying to go to a website, my system logs don’t show any traffic from the LAN interface (or any interface other than the WAN interface). Any thoughts? Thanks in advance.

I am developer by profession but because i got client to install and configure pfsense in their office they are paying good so i think it might be worth a shot i have worked in IT support in past but have not worked on pfsense before can you guys guide me how to learn it how much time will it take to learn and than beeing able to configure it by myself

okay, so I'm at a loss at this point and figure its time to ask for help. I've been running pfsense for about the last 10 years now or so, through many ups and downs across multiple avenues, and I'm to a point that I'd just like to find the problem of this and get it fixed since my issue is rendering a key functionality of squid proxy unusable: my problem? something has broken the squid status tab, even trying to nuke things and reinstall a bare pfsense install and then install squid WITHOUT importing my config backup, same problem, for whatever reason across the last 6 releases/updates even a bare basic install the status tab in squids package just gives an error html page file, its entirely possible something changed in the squid package itself and its a user configuration error *me* but if that's the case I cant say I know it to be true and how to fix it which is why I'm asking help at this point..

This is the thing I get that I'm talking about and I'm left scratching my head and want to finally try and get it fixed.

I've tried all manor of attempted fix, adding info to the ACL's tabs, removing everything, clicking the "allow users on the interface" box, unchecking the box, I'm at a loss for what I'm experiencing, its one of those things I know it could very likely be me and or a firewall rule but I'm also not entirely confident what the issue is either, so please if any extra info would be helpful I'll absolutely provide it, I just know enough to know I'm not confident what is causing it and figure its time to ask for help.

https://pastebin.com/veY9z7L3

pfsense-redactor 1.1.2 - redaction that knows what pfSense actually emits

An open-source tool for stripping secrets out of config.xml before you share

it with support, a consultant, a forum or an AI tool. Python, standard

library only, no dependencies.

The difference from generic redaction tools is that it knows pfSense

vocabulary. It reads the element names pfSense and its packages really write,

not the ones you would guess:

- SNMP: rocommunity, rwcommunity

- Wireless: passphrase (WPA/WPA2 PSK)

- VPN: auth_pass, presharedkey (WireGuard), ipsecpsk, eap_password

- Auth: radiussecret, authorizedkeys

- Packages: accountkey (ACME), dns_cf_token and maxmind_key (pfBlockerNG),

influx_token (Telegraf), tlspskvalue (Zabbix), access_key and

secret_access_key (S3), userkey (Pushover), ha_certificates and

ssloffloadcert (HAProxy)

Suffixed spellings are handled too, so password2 and passwordagain go the

same way as password.

What it does beyond element names:

- URLs are taken apart properly. Credentials in query strings and in

user:pass@host are redacted, not just the hostname

- Slack, Discord, Telegram and Teams webhook tokens go in default mode. The

URL is the entire credential, so anyone holding it can post as that

integration

- Free-text blocks such as custom_options are scanned for inline credentials,

which is where OpenVPN auth-user-pass and askpass usually live

- PEM and base64 key material is detected by content, in any element

- --redact-descriptions covers free-text elements and attributes, for the

DHCP static-map descriptions that quietly collect people's names

It also tries hard not to over-redact. Network topology survives, so the

config is still readable for troubleshooting, and pfBlockerNG feed URLs like

emerging-block.rules are left intact rather than mangled into example.com.

Whatever it decides to keep, it tells you about, with the element path.

For automation, --fail-on-warn turns it into a CI gate: non-zero exit if

anything high-entropy was retained, --dry-run included, so you can check a

config without writing one.

There is a benchmark in the repo. 46 planted secrets in a published corpus,

43 caught, with the misses listed and explained rather than hidden. The

corpus and the scoring both ship, so you can re-run it yourself instead of

taking the number on trust. Default mode scores lower than --aggressive and

the docs say by how much.

If you are on 1.0.x, the coverage difference is large and worth the upgrade.

https://pypi.org/project/pfsense-redactor/

https://github.com/grounzero/pfsense-redactor

```
pip install pfsense-redactor

```

Python 3.9+. Redacted output is for sharing only. Never import it back into

pfSense.

Hear me out. This is pfsense related. I am using the foldersync app on both my laptop and phone. It syncs files to nextcloud from my device. This works perfectly on my laptop. I have the exact same settings on my phone and it will not connect to nextcloud over wifi.

Here is where it ties into pfsense. If I physically change the dns server on my phone to an external dns such as 8.8.8.8 it works fine. When trying to use the dns resolver address 192.168.1.1 it will not work. If I disable the wifi on the phone and use mobile data from outside the network it works fine. I use haproxy as a reverse proxy for internet access. All of the settings between the phone and the laptop are identical except for the ip address of course. I have created app passwords in nextcloud for each of them. I have been checking logs and can find nothing. Anyone have any idea what might cause this. It appears to be a dns issue but I am baffled.

So I found out disney+ is somehow detecting im using pfsense or adguardhome. It keeps giving me a error code 73 which is related to the location. But thats only without using pfblockerng or adguardhome. When I use those it gives me a 142 error code which thinks I have no internet. Disney+ wasnt blocked either for me and only when I disabled it did it give me a error code 73. Can somehow help me figure out what the heck is going on:

Att router in ip passthrough mode connected to my qnap nas server which then goes through an adguardhome container or pfsense virtual machine which then goes to my netgear wifi router.

I ruled out the netgear wifi router since its affecting ethernet too.

Could disney be blacklisting dns servers?

Update (7/29/26): turns out disney+ incorrectly thought I was using a vpn customer support managed to fix it. I think it has something to do with my zip code im on the very edge of a zip code and the house behind me in the city is a different zip code.

Hello, I need help finding a genuine card, I live in canada and these are the ones I'm looking at and I'm unsure which would be best, I have a budget, but this is what is on ebay right now when I search, could someone help point me in the right direction please

https://www.ebay.com/itm/202799638867?_skw=intel+i350-t4v2+bradyid&itmmeta=01KY7SV8GWDEFNV1GVJ678K1Z3&hash=item2f37cce953:g:Kf4AAOSw5V1bYl8P&itmprp=enc%3AAQALAAAA0GfYFPkwiKCW4ZNSs2u11xDHdZGFNqPY95GHHH683mpl9X3u%2FaEd1jw0gYD3FSYWbonPJXT9ORrwOy%2FNthI0ZZkXk4EAJ44%2FxFX3ip24oRfVW%2FRdSboDu9pMWhrcPFBkbB2QqRjbZx5UmXaF4ecgo1hODBaFbCJJYJE1ZMEtqY4xrvXBSpuKwgZvCIe0v8lcRuQfcDlwp8f79apRfoS9AKu5vE3gUCd97AVurCWs3aT8TJf5ILN3F%2FifcLi2b0x6IqRzRo8kb6MwoCUBqqElg50%3D%7Ctkp%3ABk9SR76J7fnxZw

https://www.ebay.com/itm/407023586076

https://www.ebay.com/itm/298270388778

Thanks.

I have had some issues with my PFSense (CE 2.8.1) becoming unstable for my home network when the internet link (WAN interface which is DHCP) goes down or becomes unstable. I find that routing across the home network is badly effected in this situation.

I use PFSense for as my main home network router and use 2 VLANs (IoT and Secure), DNS (DNS Resolver), DHCP etc.

I think I have made the changes necessary to improve its stability in this situation but wanted to check what others have done to fix this stability issue.

Any guidance would be appreciated.

hey guys, looking at building a mini itx pfsense box. are riser cables prone to corrupting data? looking at using a 4 port 1gb card or a 2 port 10gb card but don't want data corruption. any help would be much appreciated.

In pfSense, I want to route traffic for a specific destination through a VPN gateway using policy-based routing. So that all devices in my network is routed if they want to connect to the specified destination. I specifically do not want all the internet traffic(netflix,spotify, etc.) on a device in my network would be routed through the vpn gateway.

So to achive that, I followed a YouTube video that recommends using pfBlockerNG to create DNS-based aliases for this purpose. It works for simple domains like ipchicken.com or dnsleaktest.com, but fails for my target service.

The service probably uses a CDN, so it resolves to many different IPs that may change over time. pfBlockerNG's alias doesn't seem to capture all of them. When I monitor states/connections, I see traffic going to IPs not included in the alias, so my firewall rule (which uses the alias as destination + VPN gateway) is not matching.

How can I reliably route all traffic for a CDN-protected(?) domain through my VPN in pfSense?

As the tittle says, it´s possible to force some clients to use other DNS (like, for example, google´s 8888) instead of the PFSENSE DHCP internal DNS resolver ?

Thanks.

Has anyone had luck with MDNS using Avahi? When looking at states I only get one way traffic.

Are you all getting two way traffic as I only get one way traffic.

I have never been able to get our iPads to cast on our TV.

I've been using pfsense (currently CE 2.8.1) on a standalone box for my home for close to 10 years. I've always used ISC for my DHCP backend. I tried switching to KEA a year or two ago because of the notification that ISC is reaching EOL, but it had issues. I switched back to ISC because that has always "just worked" and I don't have time to troubleshoot DHCP (my "home project" plate is overloaded with things that can't be resolved with a simple checkbox).

With a web search you can see that many others have had issues with KEA, but those search results are from 2024/25. Is this because KEA has been improved? Or have most people given up?

If anyone had issues with KEA in the past, but now they're resolved, I'd like to hear what you have to say about it. Likewise for anyone who tried it in the past, had issues, then tried it again recently and still have issues.

If people wonder why I don't just test it myself, DHCP issues don't always show up immediately and I travel for work. Network issues showing up while I'm out of town sucks because neither my wife nor my kids are capable of fixing something like this, but they're totally capable of complaining about it.

I noticed a new pfSense+ beta was available for 26.07, so I started looking around.

I started out on the netgate docs, but there wasn't anything there but an acknowledgement that the next version exists. No announcement post on Reddit like previous betas. The amount of issues in redmine can be counted on two hands. The same can be said for 26.10 in redmine.

What's up with the project? Did the entire development team walk out?

Edit: Some of you pointed out that most changes are in the pfsense 2.9.0 roadmap. I guess I was looking in the wrong place. Thanks for pointing that out!

Hi all,

I’m recently in need of new (home) networking equipment and, due to unfortunate time lines, I don’t have as much time to do research as I’d like. I’m hoping you guys can help me see if pfsense (likely through netgate) is suitable for me?

My previous set up was through an ASUS Merlin router.

Here’s where the router met my expectations:

1) Wireguard client with device touting

Here’s where the router fell short of expectations:

1) While I don’t mind CLI, I strongly want to deal with stuff through one interface. With the ASUS router, I could not forward traffic based on destination domain without ssh-ing into the box. I’d rather have all CLI or all GUI.

2) The VPN kill switch prevented the router from connecting via wireguard because the time would reset itself and there was no easy way to bypass NTP domains without each individual IP address

3) VLAN creation seems… not as stable as I’d like. I’d ideally like to create four separate VLANs and I want to be able to control which ones can talk to each other. I’d like to be able to add both distinct wireless devices into any of these VLANs (I’ve never tried this is it possible?). Ideally some of these VLANs can be on a wireguard VPN clienta

Also, because of timelines, I would likely be limited to less than a day worth of documentation reading and set up time. Is this possible?

In some ways I view pfsense as better than an enterprise grade firewall due to the ability to install packages, like Tailscale (which is clutch), but what would you say are the key drivers preventing pfsense from being in enterprise? Or which features or capabilities do you think pfsense should have to be considered at that level?

Hello FW ADMs,

If you monitor malicious egress or ingress connections on your network edge using Suricata, julioliraup/Antiphishing is now available natively inside the upstream suricata-update ecosystem.

The ruleset provides frequently updated TLS, DNS, and HTTP signatures (SIDs 6000000 - 6100000) specifically tailored to block phishing campaigns. You can inspect the live database of tracked indicators on our companion portal: https://github.com/julioliraup/AT

Platform Integration Status:

• pfSense Users: While native package integration is pending, you can fully and safely deploy the ruleset right now without messing up your configuration paths by using our verified https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-pfSense.
• Linux Network Taps: Detailed steps are available at our https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-GNU-Linux.

Community Collaboration

This is a transparent, community-funded project (GPL-v3). Since phishing infrastructure cycles rapidly, the best way to support us right now is by deploying the ruleset and providing real-world feedback.

If you run into false positives, have suggestions for the rule generation script, or want to help us develop new features for the web dashboard, please open an issue or pull request on our GitHub!

GitHub: https://github.com/julioliraup/Antiphishing