David Pesticcio DavidPesticcio

pfSense Simple Home Configuration - 2.4.3 / 2.4.4

Starting from Scratch

This is my personal guide for installing pfSense. I had to make notes to capture the details of the "install from scratch" to ensure I didn't forget the important details. Also, I'm trying to follow the philosophy of building systems with discrete "disposable" components that make a system mutable and less rigid. It does not cover installing any packages like Squid or Suricata as that's way beyond the scope of a basic, functional install.

I migrated from an environment that was at various times running Tomato Toastman 1.28 or Asuswrt-Merlin on Netgear and ASUS routers across four access points (one always acting as the firewall/gateway). It was pretty fast, but had roaming problems, and I was using full Wifi routers with half the stuff disabled. Also, even with 300mb internet service, I found that I could easily swamp the connection and drastically affect VOIP and Wifi Calling without even trying. The only fix was to throttle ever

Preparation Steps:

Read other materials first to familiarize yourself with wireguard and wireguard on FreeBSD / Android: genneko has a nice writeup that is easy to follow and much better formatting here:

https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-android/

Backup your entire pfsense system, or run this on a vm after a good snapshot. Failure to do this can easily break you, you have been warned. This is entirely unsupported. Wireguard on PFSense is experimental at this time. Nothing has been tested by me on non AMD64 arch, so unsure if arm pkgs are available. Backup your package database just in case since this impacts core PFSense runtime dependancies.

IBM ServeRAID M1015: crossflashing to a LSI9211-8i IR/IT Mode

Note: applicable to M1115 and similar LSI SAS2008 chips.

One of the most popular SAS 6.0gbps/ SATA III controllers for enthusiasts is the IBM M1015. In its native form, it is a very capable host bus adapter (HBA) based on the LSI SAS2008 chip. With the low price on places such as ebay (see here for an ebay search for the M1015) and an enthusiastic community that has learned to unlock many features, it has quickly become a go-to choice for low-cost SATA III connectivity. This series of articles was written by Pieter Schaar perhaps best known as the one behind laptopvideo2go.com. He has been a regular contributor in the STH forums and has been detailing his learning in threads such as these. I do want to note that these modifications are not endorsed by this site, LSI, IBM or others and the information herein is purely for educational purposes. If you do encounter problems, you are solely responsible for those consequences.

There are now

Overview

Ubuntu Desktop 20.04 supports a single ZFS boot drive out of the box. I wanted a ZFS mirror, without going through an entirely manual setup of Ubuntu as described by OpenZFS

This adds a mirror to an existing Ubuntu ZFS boot drive after the fact.

ZFS requires native encryption to be added at pool / dataset creation. Ubuntu 21.04 supports this during installation. Whether these instructions are suitable for mirroring such a setup has not been tested. For Ubuntu 20.04, these instructions are not suitable for creating an encrypted ZFS boot disk, please use the full instructions linked above for that. You can, however, add an encrypted dataset after the fact: You could encrypt just the portion of your file system that holds secrets.

Note: If your use case is running docker instances, and not a full-fledged Ubuntu install, then take a look at TrueNAS SCALE

Problem

You have installed GPG, then tried to commit and suddenly you see this error message after it:

error: gpg failed to sign the data
fatal: failed to write commit object

Debug

OpenPGP SSH access with Yubikey and GnuPG

Yubikey, Smart Cards, OpenSC and GnuPG are pain in the ass to get working. Those snippets here sould help alleviate pain.

Yubikey Config under Ubuntu

To reset and disable not used modes on Yubikey you need the ykman program

You can install it using those commands

	## Setting up the middleware for redirect to https ##
	http:
	middlewares:
	redirect:
	redirectScheme:
	scheme: https


	version: "3.3"

	services:
	################################################
	#### Traefik Proxy Setup #####
	###############################################
	traefik:
	image: traefik:v2.0
	restart: always

	#!/bin/bash
	# ===================================
	# Origianly from https://forum.manjaro.org/t/solved-manjaro-16-06-01-zfs-root-installation-problem/4469
	# ===================================

	loadkeys us
	systemctl enable --now systemd-timesyncd
	pacman-mirrors --api --set-branch unstable --url http://ftp.cuhk.edu.hk/pub/Linux/manjaro

	# ===================================

	#!/usr/bin/env python3
	#
	# Simple Intel x520 EEPROM patcher
	# Modifies the EEPROM to unlock the card for non-intel branded SFP modules.
	#
	# Copyright 2020 Andreas Thienemann <[email protected]>
	#
	# Licensed under the GPLv3
	#
	# Based on research described at https://forums.servethehome.com/index.php?threads/patching-intel-x520-eeprom-to-unlock-all-sfp-transceivers.24634/