Hi, I need some help with configuring dual ProtonVpn Wireguard tunnels on PFsense 2.9.0. A couple of weeks ago after lots of emails with support my dual wireguard config started randomly working one day. For some reason earlier this week it stopped working (after I restarted after php update). Tunnel 1 works perfectly and now tunnel 2 does not work.

I have tunnel 1 configured to 10.2.0.1 as the gateway and 10.2.0.2/32 for the interface address (with upstream set to tunnel 1 (10.2.0.1)
I have tunnel 2 configured to 10.3.0.1 as the gateway and 10.3.0.2/32 for the interface address (with upstream set to tunnel 2 (10.3.0.1).

The last handshake for both tunnels are under 2 mins (1,26 tunnel 1 and 22 for tunnel 2)
If I go to Diagnostics--->Ping and try pinging 1.1.1.1 (or any ip/domain) it works fine out of tunnel 1 but fails out of tunnel 2
Im lost on how to fix this... If anyone has WireGuard running on pfsense with dual Proton WireGuard tunnels can you please tell me what config you have it set up as?

I have verified NAT outbound and Firewall rules, I have tried lowering mtu, I have tried restarting pfsense, and Ive tried changing monitor ip’s and or removing them (If I set no monitor ip and check Do not add static route then Dpinger believes the tunnel is up).

Below is a packet capture of the tunnel 2 interface when im trying to pass traffic

19:25:50.290967 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 196, length 9

19:25:50.329132 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 196, length 9

19:25:50.791070 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 197, length 9

19:25:50.829680 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 197, length 9

19:25:51.291156 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 198, length 9

19:25:51.328702 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 198, length 9

19:25:51.767142 IP 10.3.0.2.15879 > 216.239.34.10.53: UDP, length 43

19:25:51.791257 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 199, length 9

19:25:51.829759 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 199, length 9

19:25:52.121413 IP 10.3.0.2.18547 > 216.239.36.10.53: UDP, length 43

19:25:52.291373 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 200, length 9

19:25:52.328860 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 200, length 9

19:25:52.522081 IP 10.3.0.2.9185 > 216.239.32.10.53: UDP, length 43

19:25:52.791570 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 201, length 9

19:25:52.829495 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 201, length 9

19:25:52.879822 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:52.879833 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:52.879840 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:52.880084 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 79

19:25:52.880396 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1246

19:25:52.880438 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1105

19:25:52.928389 IP 10.3.0.1 > 10.3.0.2: ICMP echo request, id 4660, seq 8, length 1260

19:25:52.964111 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 49

19:25:53.010873 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:53.010909 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:53.273644 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:53.291650 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 202, length 9

19:25:53.329692 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 202, length 9

19:25:53.791740 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 203, length 9

19:25:53.797482 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:53.828717 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 203, length 9

19:25:54.291806 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 204, length 9

19:25:54.328666 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 204, length 9

19:25:54.791859 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 205, length 9

19:25:54.828969 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 205, length 9

19:25:54.844237 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:55.291929 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 206, length 9

19:25:55.329092 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 206, length 9

19:25:55.791981 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 207, length 9

19:25:55.830538 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 207, length 9

19:25:56.292057 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 208, length 9

19:25:56.328733 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 208, length 9

19:25:56.792164 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 209, length 9

19:25:56.828691 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 209, length 9

19:25:56.879870 IP 10.3.0.2.59508 > 142.251.152.119.443: UDP, length 1250

19:25:57.292251 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 210, length 9

19:25:57.328803 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 210, length 9

19:25:57.792317 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 211, length 9

19:25:57.831920 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 211, length 9

19:25:58.292384 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 212, length 9

19:25:58.329423 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 212, length 9

19:25:58.792447 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 213, length 9

19:25:58.828732 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 213, length 9

19:25:59.292532 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 214, length 9

19:25:59.328764 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 214, length 9

19:25:59.792603 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 215, length 9

19:25:59.829282 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 215, length 9

19:26:00.292715 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 216, length 9

19:26:00.328997 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 216, length 9

19:26:00.792775 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 217, length 9

19:26:00.828864 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 217, length 9

19:26:01.292817 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 218, length 9

19:26:01.328712 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 218, length 9

19:26:01.792867 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 219, length 9

19:26:01.828815 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 219, length 9

19:26:02.292919 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 220, length 9

19:26:02.331735 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 220, length 9

19:26:02.792971 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 221, length 9

19:26:02.828942 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 221, length 9

19:26:03.293036 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 222, length 9

19:26:03.328713 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 222, length 9

19:26:03.793077 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 223, length 9

19:26:03.828761 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 223, length 9

19:26:04.293151 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 224, length 9

19:26:04.330017 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 224, length 9

19:26:04.793249 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 225, length 9

19:26:04.828882 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 225, length 9

19:26:05.293319 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 226, length 9

19:26:05.329527 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 226, length 9

19:26:05.793386 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 227, length 9

19:26:05.828711 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 227, length 9

19:26:06.293489 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 228, length 9

19:26:06.328763 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 228, length 9

19:26:06.793583 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 229, length 9

19:26:06.836466 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 229, length 9

19:26:07.293642 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 230, length 9

19:26:07.346916 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 230, length 9

19:26:07.793709 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 231, length 9

19:26:07.829230 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 231, length 9

19:26:08.293787 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 232, length 9

19:26:08.328709 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 232, length 9

19:26:08.614879 IP 10.3.0.2.36491 > 216.239.34.10.53: UDP, length 39

19:26:08.615068 IP 10.3.0.2.64194 > 216.239.32.10.53: UDP, length 39

19:26:08.793879 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 233, length 9

19:26:08.828738 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 233, length 9

19:26:09.222420 IP 10.3.0.2.53611 > 216.239.34.10.53: UDP, length 39

19:26:09.293978 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 234, length 9

19:26:09.328846 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 234, length 9

19:26:09.794076 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 235, length 9

19:26:09.829250 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 235, length 9

19:26:09.897793 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 1, length 64

19:26:10.294154 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 236, length 9

19:26:10.329543 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 236, length 9

19:26:10.794261 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 237, length 9

19:26:10.828773 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 237, length 9

19:26:10.904149 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 2, length 64

19:26:11.294338 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 238, length 9

19:26:11.328683 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 238, length 9

19:26:11.794427 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 239, length 9

19:26:11.836286 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 239, length 9

19:26:11.928066 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 3, length 64

19:26:12.294535 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 240, length 9

19:26:12.359810 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 240, length 9

19:26:12.794626 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 241, length 9

19:26:12.830814 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 241, length 9

19:26:12.952052 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 4, length 64

19:26:13.294692 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 242, length 9

19:26:13.332778 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 242, length 9

19:26:13.794764 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 243, length 9

19:26:13.833012 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 243, length 9

19:26:13.975715 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 5, length 64

19:26:14.294833 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 244, length 9

19:26:14.333258 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 244, length 9

19:26:14.794948 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 245, length 9

19:26:14.836797 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 245, length 9

19:26:14.999652 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 6, length 64

19:26:15.295035 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 246, length 9

19:26:15.332738 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 246, length 9

19:26:15.795138 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 247, length 9

19:26:15.832866 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 247, length 9

19:26:16.024053 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 7, length 64

19:26:16.295249 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 248, length 9

19:26:16.342127 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 248, length 9

19:26:16.795381 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 249, length 9

19:26:16.856392 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 249, length 9

19:26:17.047676 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 8, length 64

19:26:17.295461 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 250, length 9

19:26:17.373767 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 250, length 9

19:26:17.795529 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 251, length 9

19:26:17.845638 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 251, length 9

19:26:18.071836 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 9, length 64

19:26:18.295608 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 252, length 9

19:26:18.332805 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 252, length 9

19:26:18.795709 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 253, length 9

19:26:18.843908 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 253, length 9

19:26:19.095774 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 10, length 64

19:26:19.295780 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 254, length 9

19:26:19.334753 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 254, length 9

19:26:19.795846 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 255, length 9

19:26:19.834005 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 255, length 9

19:26:20.120159 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 11, length 64

19:26:20.295907 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 256, length 9

19:26:20.332711 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 256, length 9

19:26:20.796020 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 257, length 9

19:26:20.832835 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 257, length 9

19:26:21.143831 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 12, length 64

19:26:21.296097 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 258, length 9

19:26:21.332835 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 258, length 9

19:26:21.796170 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 259, length 9

19:26:21.832719 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 259, length 9

19:26:22.168114 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 13, length 64

19:26:22.296270 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 260, length 9

19:26:22.334844 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 260, length 9

19:26:22.796351 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 261, length 9

19:26:22.832841 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 261, length 9

19:26:23.192100 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 14, length 64

19:26:23.296427 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 262, length 9

19:26:23.332812 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 262, length 9

19:26:23.796528 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 263, length 9

19:26:23.832837 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 263, length 9

19:26:24.216252 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 15, length 64

19:26:24.296582 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 264, length 9

19:26:24.332700 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 264, length 9

19:26:24.796652 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 265, length 9

19:26:24.836042 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 265, length 9

19:26:25.239898 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 16, length 64

19:26:25.296704 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 266, length 9

19:26:25.332513 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 266, length 9

19:26:25.796784 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 267, length 9

19:26:25.832405 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 267, length 9

19:26:26.264154 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 17, length 64

19:26:26.296868 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 268, length 9

19:26:26.333373 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 268, length 9

19:26:26.796977 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 269, length 9

19:26:26.837392 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 269, length 9

19:26:27.288098 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 18, length 64

19:26:27.297043 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 270, length 9

19:26:27.339195 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 270, length 9

19:26:27.797137 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 271, length 9

19:26:27.832485 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 271, length 9

19:26:28.297200 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 272, length 9

19:26:28.312013 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 19, length 64

19:26:28.332471 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 272, length 9

19:26:28.797292 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 273, length 9

19:26:28.833588 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 273, length 9

19:26:29.297358 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 274, length 9

19:26:29.332450 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 274, length 9

19:26:29.335716 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 20, length 64

19:26:29.797426 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 275, length 9

19:26:29.832427 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 275, length 9

19:26:30.297529 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 276, length 9

19:26:30.332424 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 276, length 9

19:26:30.359667 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 21, length 64

19:26:30.797606 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 277, length 9

19:26:30.832462 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 277, length 9

19:26:31.297689 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 278, length 9

19:26:31.332967 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 278, length 9

19:26:31.333085 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 1, length 64

19:26:31.383872 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 22, length 64

19:26:31.797748 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 279, length 9

19:26:31.836313 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 279, length 9

19:26:32.297851 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 280, length 9

19:26:32.340258 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 280, length 9

19:26:32.343700 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 2, length 64

19:26:32.407870 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 23, length 64

19:26:32.797938 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 281, length 9

19:26:32.833815 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 281, length 9

19:26:33.298065 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 282, length 9

19:26:33.332381 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 282, length 9

19:26:33.367661 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 3, length 64

19:26:33.431594 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 24, length 64

19:26:33.798139 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 283, length 9

19:26:33.833160 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 283, length 9

19:26:34.298201 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 284, length 9

19:26:34.332441 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 284, length 9

19:26:34.391767 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 4, length 64

19:26:34.456141 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 25, length 64

19:26:34.798233 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 285, length 9

19:26:34.832420 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 285, length 9

19:26:35.298288 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 286, length 9

19:26:35.341258 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 286, length 9

19:26:35.416074 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 5, length 64

19:26:35.479765 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 26, length 64

19:26:35.784357 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:35.784376 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:35.784387 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:35.786748 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 76

19:26:35.798356 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 287, length 9

19:26:35.827526 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:35.827541 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:35.832590 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 287, length 9

19:26:35.911862 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:36.080445 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:36.298396 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 288, length 9

19:26:36.333150 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 288, length 9

19:26:36.416425 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:36.440110 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 6, length 64

19:26:36.503995 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 27, length 64

19:26:36.798481 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 289, length 9

19:26:36.838670 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 289, length 9

19:26:37.087572 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:37.298541 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 290, length 9

19:26:37.346594 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 290, length 9

19:26:37.463994 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 7, length 64

19:26:37.528181 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 28, length 64

19:26:37.798641 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 291, length 9

19:26:37.839680 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 291, length 9

19:26:38.298692 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 292, length 9

19:26:38.336447 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 292, length 9

19:26:38.427615 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:38.488108 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 8, length 64

19:26:38.552001 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 29, length 64

19:26:38.798779 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 293, length 9

19:26:38.833199 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 293, length 9

19:26:39.298873 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 294, length 9

19:26:39.336646 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 294, length 9

19:26:39.512012 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 9, length 64

19:26:39.575998 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 30, length 64

19:26:39.786535 IP 10.3.0.2.43763 > 142.251.210.78.443: UDP, length 1250

19:26:39.788211 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 1250

19:26:39.788234 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 1250

19:26:39.788249 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 1250

19:26:39.788439 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 80

19:26:39.788792 IP 10.3.0.2.19024 > 142.251.210.78.443: tcp 0

19:26:39.798933 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 295, length 9

19:26:39.830203 IP 142.251.210.78.443 > 10.3.0.2.19024: tcp 0

19:26:39.830863 IP 10.3.0.2.19024 > 142.251.210.78.443: tcp 0

19:26:39.831849 IP 10.3.0.2.19024 > 142.251.210.78.443: tcp 948

19:26:39.831871 IP 10.3.0.2.19024 > 142.251.210.78.443: tcp 948

19:26:39.831891 IP 10.3.0.2.19024 > 142.251.210.78.443: tcp 596

19:26:39.842102 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 295, length 9

19:26:39.874111 IP 142.251.210.78.443 > 10.3.0.2.19024: tcp 0

19:26:39.874119 IP 142.251.210.78.443 > 10.3.0.2.19024: tcp 0

19:26:39.874144 IP 142.251.210.78.443 > 10.3.0.2.19024: tcp 0

19:26:40.088790 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 1250

19:26:40.088817 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 1250

19:26:40.127500 IP 142.251.210.78.443 > 10.3.0.2.19024: tcp 0

19:26:40.128601 IP 10.3.0.2.19024 > 142.251.210.78.443: tcp 0

19:26:40.128988 IP 10.3.0.2.55817 > 142.251.210.78.443: tcp 0

19:26:40.169522 IP 142.251.210.78.443 > 10.3.0.2.19024: tcp 0

19:26:40.169592 IP 142.251.210.78.443 > 10.3.0.2.55817: tcp 0

19:26:40.170381 IP 10.3.0.2.55817 > 142.251.210.78.443: tcp 0

19:26:40.171494 IP 10.3.0.2.55817 > 142.251.210.78.443: tcp 948

19:26:40.171509 IP 10.3.0.2.55817 > 142.251.210.78.443: tcp 948

19:26:40.171552 IP 10.3.0.2.55817 > 142.251.210.78.443: tcp 628

19:26:40.213111 IP 142.251.210.78.443 > 10.3.0.2.55817: tcp 0

19:26:40.213121 IP 142.251.210.78.443 > 10.3.0.2.55817: tcp 0

19:26:40.213133 IP 142.251.210.78.443 > 10.3.0.2.55817: tcp 0

19:26:40.298996 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 296, length 9

19:26:40.341238 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 296, length 9

19:26:40.419782 IP 142.251.210.78.443 > 10.3.0.2.55817: tcp 0

19:26:40.421002 IP 10.3.0.2.55817 > 142.251.210.78.443: tcp 0

19:26:40.456460 IP 142.251.210.78.443 > 10.3.0.2.55817: tcp 0

19:26:40.536065 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 10, length 64

19:26:40.599831 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 31, length 64

19:26:40.689945 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 1250

19:26:40.799087 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 297, length 9

19:26:40.836451 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 297, length 9

19:26:41.299181 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 298, length 9

19:26:41.336583 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 298, length 9

19:26:41.559720 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 11, length 64

19:26:41.623665 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 32, length 64

19:26:41.799320 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 299, length 9

19:26:41.836482 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 299, length 9

19:26:41.891710 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 1250

19:26:42.299432 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 300, length 9

19:26:42.344620 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 300, length 9

19:26:42.584012 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 12, length 64

19:26:42.647988 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 33, length 64

19:26:42.799498 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 301, length 9

19:26:42.836623 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 301, length 9

19:26:43.299582 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 302, length 9

19:26:43.336414 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 302, length 9

19:26:43.607955 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 13, length 64

19:26:43.671754 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 34, length 64

19:26:43.788536 IP 10.3.0.2.23466 > 142.251.210.78.443: UDP, length 1250

19:26:43.799655 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 303, length 9

19:26:43.836430 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 303, length 9

19:26:44.299709 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 304, length 9

19:26:44.336555 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 304, length 9

19:26:44.632004 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 14, length 64

19:26:44.695577 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 35, length 64

19:26:44.799766 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 305, length 9

19:26:44.838653 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 305, length 9

19:26:45.299823 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 306, length 9

19:26:45.336426 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 306, length 9

19:26:45.656093 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 15, length 64

19:26:45.719607 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 36, length 64

19:26:45.799906 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 307, length 9

19:26:45.837058 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 307, length 9

19:26:46.299985 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 308, length 9

19:26:46.336478 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 308, length 9

19:26:46.680034 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 16, length 64

19:26:46.744124 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 37, length 64

19:26:46.800105 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 309, length 9

19:26:46.836710 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 309, length 9

19:26:47.300179 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 310, length 9

19:26:47.353072 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 310, length 9

19:26:47.703994 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 17, length 64

19:26:47.767951 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 38, length 64

19:26:47.800292 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 311, length 9

19:26:47.839631 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 311, length 9

19:26:48.245134 IP 10.3.0.2.41889 > 216.239.38.10.53: UDP, length 48

19:26:48.300397 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 312, length 9

19:26:48.339489 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 312, length 9

19:26:48.583494 IP 10.3.0.2.29085 > 216.239.38.10.53: UDP, length 48

19:26:48.727745 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 18, length 64

19:26:48.791696 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 39, length 64

19:26:48.800485 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 313, length 9

19:26:48.836818 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 313, length 9

19:26:48.986757 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 1250

19:26:48.986768 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 1250

19:26:48.986774 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 1250

19:26:48.987064 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 80

19:26:49.158608 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 1250

19:26:49.158623 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 1250

19:26:49.300559 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 314, length 9

19:26:49.338955 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 314, length 9

19:26:49.499909 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 1250

19:26:49.751725 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 19, length 64

19:26:49.800682 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 315, length 9

19:26:49.816005 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 40, length 64

19:26:49.841589 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 315, length 9

19:26:50.182151 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 1250

19:26:50.300765 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 316, length 9

19:26:50.336685 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 316, length 9

19:26:50.775740 IP 10.3.0.2 > 94.140.15.15: ICMP echo request, id 46866, seq 20, length 64

19:26:50.800799 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 317, length 9

19:26:50.836524 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 317, length 9

19:26:50.839838 IP 10.3.0.2 > 142.251.215.110: ICMP echo request, id 64941, seq 41, length 64

19:26:51.300872 IP 10.3.0.2 > 10.3.0.1: ICMP echo request, id 2742, seq 318, length 9

19:26:51.336495 IP 10.3.0.1 > 10.3.0.2: ICMP echo reply, id 2742, seq 318, length 9

19:26:51.544424 IP 10.3.0.2.29405 > 172.253.147.101.443: UDP, length 1250

Hello.

I have two WANs on my pfSense+ and I have configured the LoadBalancing with:

• both WANs are Tier1
• both WANs have Weight=1
• "Use sticky connections" is enabled

The issue is that one WAN represents 80% of the traffic and I prefer to balance 50/50.

Thanks.
Best regards.

Hello.

I want to update my pfSense CE from 2.8.0 to 2.8.1. But when I check for updates, it says I'm on the latest version of the 2.8.0 branch, even though 2.8.1 is out for more than a month now. It does show the 2.9.0 version though.

I tried rehashing the certs on the shell to see if the new version appears, but it didn't:

[2.8.0-RELEASE][admin@foo.arpa]/root: certctl rehash
certctl: Skipping untrusted certificate 0c4c9b6c (/etc/ssl/untrusted/0c4c9b6c.0)
certctl: Skipping untrusted certificate 5a7722fb (/etc/ssl/untrusted/5a7722fb.0)
certctl: Skipping untrusted certificate 5d3033c5 (/etc/ssl/untrusted/5d3033c5.0)
certctl: Skipping untrusted certificate ee1365c0 (/etc/ssl/untrusted/ee1365c0.0)
certctl: Skipping untrusted certificate 26312675 (/etc/ssl/untrusted/26312675.0)
certctl: Skipping untrusted certificate 4304c5e5 (/etc/ssl/untrusted/4304c5e5.0)
certctl: Skipping untrusted certificate c01cdfa2 (/etc/ssl/untrusted/c01cdfa2.0)
certctl: Skipping untrusted certificate 18856ac4 (/etc/ssl/untrusted/18856ac4.0)
certctl: Skipping untrusted certificate 0b7c536a (/etc/ssl/untrusted/0b7c536a.0)
certctl: Skipping untrusted certificate b1b8a7f3 (/etc/ssl/untrusted/b1b8a7f3.0)
certctl: Skipping untrusted certificate 2e5ac55d (/etc/ssl/untrusted/2e5ac55d.0)
certctl: Skipping untrusted certificate 08063a00 (/etc/ssl/untrusted/08063a00.0)
certctl: Skipping untrusted certificate 76cb8f92 (/etc/ssl/untrusted/76cb8f92.0)
certctl: Skipping untrusted certificate 66445960 (/etc/ssl/untrusted/66445960.0)
certctl: Skipping untrusted certificate 5e98733a (/etc/ssl/untrusted/5e98733a.0)
certctl: Skipping untrusted certificate 080911ac (/etc/ssl/untrusted/080911ac.0)
certctl: Skipping untrusted certificate 9c2e7d30 (/etc/ssl/untrusted/9c2e7d30.0)
certctl: Skipping untrusted certificate 4a6481c9 (/etc/ssl/untrusted/4a6481c9.0)
certctl: Skipping untrusted certificate 03179a64 (/etc/ssl/untrusted/03179a64.0)
certctl: Skipping untrusted certificate 7aaf71c0 (/etc/ssl/untrusted/7aaf71c0.0)
certctl: Skipping untrusted certificate 57bcb2da (/etc/ssl/untrusted/57bcb2da.0)
certctl: Skipping untrusted certificate 1636090b (/etc/ssl/untrusted/1636090b.0)
certctl: Skipping untrusted certificate c47d9980 (/etc/ssl/untrusted/c47d9980.0)
certctl: Skipping untrusted certificate dc45b0bd (/etc/ssl/untrusted/dc45b0bd.0)
certctl: Skipping untrusted certificate 1320b215 (/etc/ssl/untrusted/1320b215.0)
certctl: Skipping untrusted certificate 5a4d6896 (/etc/ssl/untrusted/5a4d6896.0)
certctl: Skipping untrusted certificate f90208f7 (/etc/ssl/untrusted/f90208f7.0)
certctl: Skipping untrusted certificate 3e44d2f7 (/etc/ssl/untrusted/3e44d2f7.0)
certctl: Skipping untrusted certificate d853d49e (/etc/ssl/untrusted/d853d49e.0)
certctl: Skipping untrusted certificate 116bf586 (/etc/ssl/untrusted/116bf586.0)
certctl: Skipping untrusted certificate 442adcac (/etc/ssl/untrusted/442adcac.0)
certctl: Skipping untrusted certificate a8dee976 (/etc/ssl/untrusted/a8dee976.0)
certctl: Skipping untrusted certificate cb59f961 (/etc/ssl/untrusted/cb59f961.0)
certctl: Skipping untrusted certificate 349f2832 (/etc/ssl/untrusted/349f2832.0)
certctl: Skipping untrusted certificate 57bcb2da (/etc/ssl/untrusted/57bcb2da.0)
certctl: Skipping untrusted certificate 5e98733a (/etc/ssl/untrusted/5e98733a.0)
certctl: Skipping untrusted certificate 08063a00 (/etc/ssl/untrusted/08063a00.0)
certctl: Skipping untrusted certificate 18856ac4 (/etc/ssl/untrusted/18856ac4.0)

And trying to check new versions on the terminal yields nothing:

[2.8.0-RELEASE][admin@foo.arpa]/root: pfSense-upgrade -d -c
>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Fetching meta.conf:
Fetching data.pkg:
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
Fetching meta.conf:
Fetching data.pkg:
pfSense repository is up to date.
All repositories are up to date.
Your system is up to date

I have a vague memory that I've had this problem in the past, but I don't remember how I solved it.

Anyone knows how to get this update?

Also, should I be concerned about all those untrusted certificates?

Status: updated 2026-10-21 against the official PHP security advisory on php.net.

Findings

• PHP released fixes for two remote code execution flaws in PHP core (CVSS v4.0 9.2): PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Minimal backports are linked for 7.4, 8.0 and 8.1, which no longer receive official updates.

• CVE-2026-109618 (OOM corruption): out-of-memory handling can interrupt PHP while internal request data is only partly initialized, and request cleanup may then treat the invalid data as valid.

• CVE-2026-109619 (stale global state): request-owned internal state can survive after its memory is freed, and a later request handled by the same worker may use it. The confirmed paths go through the session upload-progress handler.

• Scope per the advisory: every PHP installation serving web requests, PHP-FPM included.

• On a test appliance, the session extension is loaded and session.upload_progress.enabled was On (the PHP default; php.ini does not set it).

• pfBlockerNG does not use upload progress: there is no upload_progress or PHP _SESSION_UPLOAD_PROGRESS reference anywhere in src/.

• The DNSBL VIP web server (lighttpd_pfb) forwards .php requests to the system PHP-FPM socket (pfblockerng.inc, fastcgi.server ... /var/run/php-fpm.socket) to serve index.php and dnsbl_default.php. That PHP-FPM pool runs as root.

Risk

• An unauthenticated HTTP request to any PHP endpoint served by PHP-FPM may lead to code execution as root.

• The WebGUI is exposed to anyone who can reach it.

• The DNSBL VIP widens that exposure. It requires no login, it answers every LAN client that can reach it, and clients are steered to it whenever they query a blocked domain. Guest or IoT VLANs that can reach the VIP can reach PHP-FPM.

• Details and exploit research were public before the release.

Mitigation (until patched)

The advisory states there are no complete mitigations; the settings below reduce specific attack paths only. Updating PHP is the only full fix.

1. CVE-2026-109619: disable upload progress. This blocks the confirmed session paths, not other variants. php.ini is regenerated on every PHP-FPM restart and at boot, so use the scan directory; it loads after php.ini, so its values win.

   ```sh

   php --ini | grep -i "scan|additional" # confirm the scan dir is /usr/local/etc/php

   echo 'session.upload_progress.enabled = 0' > /usr/local/etc/php/zz-no-upload-progress.ini

   /etc/rc.php-fpm_restart

   ls -l /usr/local/etc/php/zz-no-upload-progress.ini # file still present after the restart

   php -i | grep session.upload_progress.enabled # expect: Off => Off

   ```

   Verified on the test appliance: the file survives a PHP-FPM restart and the setting reads Off. Re-check after a reboot. HA peers need the file too, because configuration sync does not copy it.

2. CVE-2026-109618: memory limits. The advisory recommends memory_limit = -1 (so allocation failure is not hit inside PHP) and a low post_max_size (8M without uploads, 32M with; keep upload_max_filesize below it). On a firewall both have costs:

• memory_limit = -1 lets one runaway request consume all RAM. The advisory pairs it with a per-process memory boundary (cgroup/container); the FreeBSD equivalent is rctl, which needs kern.racct.enable=1 and a reboot. Do not use RLIMIT_AS/RLIMIT_DATA as a substitute.

• A low post_max_size can break large uploads in the WebGUI, such as a configuration restore.

  Weigh these per site; if applied, add them to the same zz- file and restart PHP-FPM.

1. PHP 8.5 only: set fatal_error_backtraces = 0 (blocks the confirmed fatal-backtrace path). Check the version with php -v.

2. Restrict WebGUI access to a trusted management interface. No WAN or untrusted-VLAN access.

3. Where untrusted networks can reach the DNSBL VIP, consider DNSBL Null Blocking until patched. It takes the VIP web server, and its PHP path, out of service.

4. Watch /var/log/system.log for unexpected PHP-FPM crashes or restarts.

Patches

• The fix is in PHP itself. No pfBlockerNG code change is needed for these CVEs.

• Apply a PHP build at or above 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as one is available, and confirm with php -v.

• After patching, the zz- file can stay (nothing uses upload progress) or be removed, followed by a PHP-FPM restart. Revert any memory_limit/post_max_size changes.

Just saw this and know pfsense uses PHP. I didn’t see this posted before .

Not long ago I put a new SSD into my 2100 after realizing how dangerously near to failure the eMMC was after following this: https://docs.netgate.com/pfsense/en/latest/troubleshooting/disk-lifetime.html#emmc ... but now that I no longer need or use the eMMC I'd like to delete mmc-utils. When I try, however, I get No packages matched for pattern 'mmc-utils.' Fine, so I do a search and it returns mmc-utils-20230807_1. Can I just do a delete/remove of that package and everything will be fine? Do I need to unlock it first? Do I need to remove or do anything else, seeing as it doesn't recognize mmc-utils as an alias or meta-package when attempting to delete it?

I'd rather not do anything permanent without checking first in case something I might've done would break anything.

Edit: Even trying to delete it explicitly with the package name, it still won't work. 🤨

Hey r/pfsense,

I've been building WallWatch, a free Android app to monitor and manage pfSense® Community Edition firewalls from your phone — live dashboard (CPU/RAM/temp/uptime), gateway and interface status, firewall rules, NAT, DHCP, services, OpenVPN/IPsec/WireGuard, home-screen widgets, and background monitoring with alerts when a gateway drops or a cert is about to expire. No account, no ads, no analytics — it only talks to the firewall address you give it.

Before Google lets it go public on Play, it has to sit in closed testing with real testers for 14 days — that's the part I need help with.

What's involved:

- Send me the Gmail address you use on the Play Store

- I add you to the tester list (usually within a day)

- Install it from the Play testing link, open it, and just use it for 14 days

You don't need a pfSense box to help — there's a built-in demo mode with sample data, so you can poke around every screen without connecting to anything real. If you do run pfSense, even better — try it against your own firewall and tell me what's broken or confusing.

Full details and the sign-up steps: https://wallwatch.hackthelab.uk/testers.html

Happy to answer anything here, or come say hi on IRC: #wallwatch on Libera.Chat. Thanks

* WallWatch is an independent app and is not affiliated with, endorsed by, or sponsored by Netgate or Rubicon Communications, LLC. pfSense® is a registered trademark of Rubicon Communications, LLC.

Hello everyone. Due to the lack of options out there and not being super satisfied with Netgate's version of fleet management, I decided to build one with the help of Claude. Please have a look and try it out. I've been running it for a little bit and it is fairly polished, but more eyes on it will likely improve it.

riccanet/ComSense

Good morning/afternoon/evening - I am running into an issue with a combination of CoreDNS and ThreatGate.

Hardware: SG-2100

Version: 26.07-RELEASE (arm64)

All patches applied.

I've enabled Netgate Nexus controller, went through the Easy Setup for CoreDNS and followed the recipe using unbound as its upstream resolver detailed here: https://docs.netgate.com/pfsense/en/latest/recipes/nexus-coredns.html

Upon enabling ThreatGate and adding my MaxMind account categories and either OISD or Hagezi lists - my unit slows to a crawl. Checking the dashboard yields 97 to 100% CPU for close to about 15 minutes before crashing.

After reboot - the process picks back up and is back to 100% CPU and network traffic comes to a complete halt. Only way to get back into operation is by resetting back to factory defaults.

I'm beginning to think it's hardware limitations, but wanted to post to the community to see if anyone else has experienced this with the hardware I have or other Netgate units.

Just installed 2.9.0 and trying to configure easyrule for fail2ban "actionban". ssh is configured and working and when I ssh directly into the firewalll and run "easyrule block wan x.x.x.x" it replies "Block added successfully" but the rule is nowhere to be found in the Aliases (gui). Also running "easyrule showblock wan" says "No entries are blocked on interface: wan". Is there something else that needs to be enabled to create the alias and populate it?

I have a Kasa plug that has Mac address of 22:2f:d0:ae:02:57. I have this set to static IP assignment under my DHCP server.
That Mac is statically assigned to 192.168.1.45 but it is disregarding that and somehow being dynamically assigned IP 192.168.1.111.
The dynamic IP pool is .100-.200
I have flushed ARP and cleared DHCP leases.

Anyone know what is going on?

Is anyone else having issues with ACB?

I receive the following error message:

The AutoConfigBackup service could not find any backups for this device key.

When I checked another firewall at another site, it had the same error message. I reached out to [support@netgate.com](mailto:support@netgate.com), but my email got returned as undeliverable.

Affected devices are 4200's and 6100's.

AT&T fiber, I had the pfatt scripts running on 2.4.5 with a Pace 5268AC for years with no problem until the machine died. Current state is that I have a functioning 2.9 CE build on a new machine, but am having trouble getting back online.

My questions are, is it possible to run the pfatt.sh scripts on 2.9? Should I just pay for pfSense plus and use the native function?

I'm in over my head and I just want my network to work again =(

edit: just noticed I had a legacy sh file, fixed that but still can't get the netgraph to load

edit2: holy freakin crap I got it to work. delete lines 21 & 22 from pfatt.sh

/usr/local/bin/php -r "pfSense_ngctl_attach('.', '$ONT_IF');"
/usr/local/bin/php -r "pfSense_ngctl_attach('.', '$RG_IF');"

I use PFBlockerNG's GEOIP in Alias Native mode. I have Aliases for each country and I select/deselect countries as necessary. The problem is, de-selected countries' prefixes are still being added to the Alias.

I've done a PFBlockerNG "Reload" and a PfSense Filter Reload, no change. It's like PfBlockerNG is refusing to edit it's own aliases.

Ultimately I had to create new IPv4 Alias Native lists with the desired countries and create separate "allow" rules. Ideally I would like to just have the de-selected countries removed from the larger aliases as expected.

Has anyone run into this? I'm on 26.07.

This publishes 5 RCE by Abraxas, most require having WebUI authentication.

NOTE: Updated description to note it's RCE (Remote Code Execution), not CVE.

I created this pfsense theme with matching login page. Fully working. Please let me know what you think. https://github.com/jfranny84/pfsensetheme ---- Dont forget to donate and show your support: https://paypal.me/jfranny1984 or venmo --- https://venmo.com/u/jfranny84

I have another theme if anybody is intersted.

https://github.com/jfranny84/pfsensethem2

I initially had NTP open on the CAMERA interface but then blocked everything and still I am able to both ping any address in the 192.168.3.x network and also SSH into the L2 switch.
How is this traffic getting through if I have a complete block on the interface?

(Reddit suggested the cross-post, so, please, no flame!)

Hello fellow r/PFSENSE Redditors!

I am very much interested in writing, and open-sourcing, a utility (likely in NodeJS, possibly Python3) that reads the Suricata eve.log logfile (in realtime) and creates/inserts documents regarding the alert into a MongoDB database. I'll be storing this information in MongoDB with the intent that eventually an open-source dashboard can be created utilizing MongoDB's aggregation pipelines to gather real-time, actionable insight into the "barbarians at the gate." If you're not familiar with the power of MongoDB's "aggregation pipelines," (and their ability to give you deep insight into your data) then I recommend you ask your local DBA if you want to see them really geek out! Essentially, this whole project revolves around MongoDB's aggregation pipelines - otherwise, we're just storing eve.log in yet another format/place.

However, I lack any real-world log data to develop against. My network here at home is very quiet.

What I'm asking is if there is anyone who would care to share some real-world eve.log log entries (anonymized to your liking - I'm more interested in the various fields available) with me to aid in developing this MongoDB database? The larger the network, the busier the IDS, the better for my purposes here. Please, also, indicate if you've enabled any non-standard logging features.

Please, feel free to DM me regarding transfer of said eve.log logfile(s) or with any suggestions you may have regarding this project. I can likely accomodate sftp, https (upload/download), IRC DCC, etc. Thank you for your time!

So with the NDI-based licensing system coming to an end, does that mean the next version of pfSense Plus will use the new system? What does it mean for existing "grandfathered" pfSense Plus home license?