Recommended Posts

Right!

It looks like we are getting somewhere now.

I setup SquidGuard as your instructions above, stopped and restarted squidguard and now it appears everything is working.

At the bottom of the long BLOCKLIST i choose allow all for now until i can figure out how to apply a certain category to only 1 IP.

Your an amazing chap Bud :D Thanks again.

That would be an ACL, let me take a look at how you do that.

edit:

Here you go, create a group ACL, put in your kids IP as source, I used 192.168.1.40

post-14624-0-70605800-1300226076.jpg

Then I created a new category, kids - and put in yahoo.com

post-14624-0-36338200-1300226104.jpg

In the group ACL block your new custom cat or categories you want - and shazam

in my virtual machine that is on 192.168.1.40 can not access yahoo.com

But my host machine on .100 can.

post-14624-0-46501600-1300226175.jpg

  • Like 2

--Budman

Spent a while lat night looking at the different options in SQUIDGUARD and managed to get an ACL setup for 192.168.33.253 which worked, so after all your help i have finally got it working and i think i now know what i was doing wrong, when specifying to use the blocklist i wasn't telling it to use the LOCAL database also i hadn't setup any categories for it to block or deny so it looks like it was BLOCKING everything by default.

I am going to take the screenshots you posted above and make a reference guide for the future, i also noticed a CONFIG BACKUP package which i can install to backup the configuration of the firewall which may be worth doing.

Earlier on at the start of this thread you also mentioned in an edit so i didn't catch it until i was reading back over the thread but you said something about DNS and not using the ISP DNS and you also said something about installing UNBOUND which i can't find so i have either read something wrong done something wrong or need to do something i haven't done. -- I also notice that on the general settings page i have the box ticked which says something about getting DNS from the ISP.

Thanks again for all your help

:woot: :woot: :woot:

yeah you can run your own recursive nameserver, install the unbound package

post-14624-0-83209600-1300281644.jpg

So my clients never talk to my isp dns, or forward a dns request -- pfsense is the dns server. It talks to roots directly, etc. You can use dnssec this way.

maybe you play with what you got working for awhile - and we can move on to DNS at a later date ;)

Ok -- come on now.. Who rep'd a post that says in essence "Im using 2.0 RC1"

But the 3 pages of posts where I walk him through every step, tell him what he did wrong and post screenshots, etc. etc. Gets none??

Something wrong with this picture! ;)

  • Like 1

Ok -- come on now.. Who rep'd a post that says in essence "Im using 2.0 RC1"

But the 3 pages of posts where I walk him through every step, tell him what he did wrong and post screenshots, etc. etc. Gets none??

Something wrong with this picture! ;)

Ahaha thats actually kind of funny. Crazy world we live in eh Budman, what with earthquakes and Tsunamis and all.

Perhaps its PfSense developers trying to push their latest release :shiftyninja: :shiftyninja:

:p

Im not knocking you getting a rep - good for you(but did you earn it?), it just did not make sense to me - I got a PM that he rep'd me for the help I did which is great.. To be honest I could care less, just here to help people - I have gotten my fair share of rep around the forum - it feels good when people upvote you - don't get me wrong. But as long as the post help the OP or the next guy is what matters.

I just found it odd that someone rep'd a post that I had already posted he should do a few times - I agree the 2.0 line is more than stable enough to run in a home, or even a production environment to be sure. And quite a few +'s to doing so.. But the 1.2.3 line REALLY STABLE and great as well. But I like to be on the cutting edge myself - and 2.0 makes more sense with the ipv6 suff I have been playing with lately!!

But come on -- who stops by and reps a post like yours, which is a great kick in the ass for the OP mind you to move to the latest version - dont get me wrong.. But they clearly do not understand what the rep system is suppose to do.. You don't rep +1 type posts, you don't rep "me too" type posts, you don't rep "yeah I agree with that" type posts -- its suppose to be for posts that HELPED/SOLVED the users problem. And sorry but you run 2.0 does not fall into that area no way no how :)

Maybe you have great other posts? But to me I look at 631 posts in like 7 years = LURKER!! Not even part of the community at all. Sorry!

The rep system is not meant to be a 'like" type system - atleast from my take of it. Its not reddit clicking upvote, etc. But I do feel you should be able to click to see who rep'd -- can you???

  • Like 1

Im not knocking you getting a rep - good for you(but did you earn it?), it just did not make sense to me - I got a PM that he rep'd me for the help I did which is great.. To be honest I could care less, just here to help people - I have gotten my fair share of rep around the forum - it feels good when people upvote you - don't get me wrong. But as long as the post help the OP or the next guy is what matters.

I just found it odd that someone rep'd a post that I had already posted he should do a few times - I agree the 2.0 line is more than stable enough to run in a home, or even a production environment to be sure. And quite a few +'s to doing so.. But the 1.2.3 line REALLY STABLE and great as well. But I like to be on the cutting edge myself - and 2.0 makes more sense with the ipv6 suff I have been playing with lately!!

But come on -- who stops by and reps a post like yours, which is a great kick in the ass for the OP mind you to move to the latest version - dont get me wrong.. But they clearly do not understand what the rep system is suppose to do.. You don't rep +1 type posts, you don't rep "me too" type posts, you don't rep "yeah I agree with that" type posts -- its suppose to be for posts that HELPED/SOLVED the users problem. And sorry but you run 2.0 does not fall into that area no way no how :)

Maybe you have great other posts? But to me I look at 631 posts in like 7 years = LURKER!! Not even part of the community at all. Sorry!

The rep system is not meant to be a 'like" type system - atleast from my take of it. Its not reddit clicking upvote, etc. But I do feel you should be able to click to see who rep'd -- can you???

now you're making something out of nothing.. and now making this personal. You say you dont care, yet you make a post ALL about it, and NOW you target me, specifically the bold part.

I've always respected your knowledge of things Budman, but this is disrespectful to something I havnt done. Thanks for derailing this, and if you have a problem with my "post count" and calling me a lurker. PM NEXT TIME.

Insulted. You tend to do that a lot.

Ridiculous BudMan.

Also, stop being concerned about "message board rep" it means nothing in life. I'm not going to forget this next time I see you being targeted... which I have seen before in other posts. Why should I rep your posts now? When I have plenty of times in the past...

I might have worded that a bit harsh.. :blush:

I did not mean anything bad directed at you to be honest, but more at the person that rep'd you.. The lurker comment was uncalled for, sorry!!

This is more what should of stood out - and clearly not direct towards you since you can not rep your own posts.

"You don't rep +1 type posts, you don't rep "me too" type posts, you don't rep "yeah I agree with that" type posts -- its suppose to be for posts that HELPED/SOLVED the users problem"

"The rep system is not meant to be a 'like" type system - atleast from my take of it. Its not reddit clicking upvote,"

The beers and irish whisky I had been consuming since 2pm might have had a bit to do with my lurker comment? :blush:

I might have worded that a bit harsh.. :blush:

I did not mean anything bad directed at you to be honest, but more at the person that rep'd you.. The lurker comment was uncalled for, sorry!!

This is more what should of stood out - and clearly not direct towards you since you can not rep your own posts.

"You don't rep +1 type posts, you don't rep "me too" type posts, you don't rep "yeah I agree with that" type posts -- its suppose to be for posts that HELPED/SOLVED the users problem"

"The rep system is not meant to be a 'like" type system - atleast from my take of it. Its not reddit clicking upvote,"

The beers and irish whisky I had been consuming since 2pm might have had a bit to do with my lurker comment? :blush:

Apology accepted.

  • 1 month later...

Pfsense Rocks.. I am running 2.0 RC2 now.. Did the OP solve this issue in the end ?

And Glad you 2 kissed and made up ;-)

Seriously tho... got to see the funny side of all this..

Take care.

Phillip.

Yes he did get it worked out. His internet access problem was fixed when he turned his gateway device into just a modem - see earlier in the thread

"I changed the DG834G router into modem only mode which makes it into a modem only device"

Then to his accessing his modems private IP - that was fixed too, he had the wrong virtual IP set on his wan interface to allow talking to his modems internal private IP. He had set the virtual ip to the same as his modems IP 192.168.10.1 vs .2

we used teamviewer and I got on his box so I could look at his pfsense config - once he corrected that it worked just fine.

The link to the pfsense doc is earlier in the thread, but for quick reference here it is again

http://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall

I dont want to knock anyone or PFsense, but with all the trouble the OP had, I think he might of had an easier time going with smoothwall, compared to PFsense (at least to me), it may have been easier to configure OOB. Budman you sure do have a lot of patience :) Sometimes it can be difficult trying to explain stuff to people without being able to be physically there to show someone, I have to do it daily to people deployed overseas in hot zones.

The user most likely would of had issues with any router distro to be honest.. His "modem" was not a modem - it was a gateway (modem/router combo) doing NAT. And he setup his LAN network on pfsense to be the same as what his gateway was using as its private network 192.168.33/24 -- so he had the same network on both his lan and his wan of his pfsense box.

I have chatted with him quite a bit on PM, he is trying but his basic understanding of networking needs work ;)

But he is getting there - and last I heard very happy with his setup now that he got it figured out in his head what he was doing wrong.

Nothing wrong with smoothwall -- its a great firewall/router distro.. I have not played with it for quite some time. But sure it's a fantastic choice as well - there are many firewall/router distro's out there - they all have pluses and minuses.. For the last few years I have been a using pfsense, but ipcop, smoothwall, etc all work too.

lately have been running the development ipv6 stuff from pfsense, which is working out great. Not a lot of distro's out there will full tunnel/firewall support for ipv6 - and its not in the mainline for pfsense either yet, not til they start work on the 2.1 version.

How is smoothwalls ipv6 support? Is it in the mainline version - if it is a more mature implementation I might have to take another look at it.

The user most likely would of had issues with any router distro to be honest.. His "modem" was not a modem - it was a gateway (modem/router combo) doing NAT. And he setup his LAN network on pfsense to be the same as what his gateway was using as its private network 192.168.33/24 -- so he had the same network on both his lan and his wan of his pfsense box.

I have chatted with him quite a bit on PM, he is trying but his basic understanding of networking needs work ;)

But he is getting there - and last I heard very happy with his setup now that he got it figured out in his head what he was doing wrong.

Nothing wrong with smoothwall -- its a great firewall/router distro.. I have not played with it for quite some time. But sure it's a fantastic choice as well - there are many firewall/router distro's out there - they all have pluses and minuses.. For the last few years I have been a using pfsense, but ipcop, smoothwall, etc all work too.

lately have been running the development ipv6 stuff from pfsense, which is working out great. Not a lot of distro's out there will full tunnel/firewall support for ipv6 - and its not in the mainline for pfsense either yet, not til they start work on the 2.1 version.

How is smoothwalls ipv6 support? Is it in the mainline version - if it is a more mature implementation I might have to take another look at it.

Ipv6 is still in it's infant stages with smoothwall, with update 8 that was just pushed out they added kernel support, but I don't think it's ready for prime time. I touched pfsense briefly when setting up my firewall/router, but when i gave smoothwall a test 2 years ago, it just worked. I spent maybe 5 minutes out of the box with it's setup tool and it just launched. installing packages/mods requires a little more work (usually requires the terminal), but it's very robust, and if you're into caching/im filtering, that's already built into the box (imspector and squid). for those with multicore processors, SMP is now supported as well.

All of those features are available on pfsense - it works out of the box as well.. Its normally a 5 minute install to up and running.. The OP just for some strange reason setup his lan network to the same as his router he already had. That would of caused an issue with any router distro.

Understanding that he was already doing nat, or for that matter keeping the default lan ip range would of worked with a double nat, etc.

Squid is click to install no terminal access required to install packages like squid, squidguard, im inspector, etc.

Im glad your happy with smoothwall - its a good distro and all.. But with what the OP did smoothwall would of had the same issue.

Hard to route traffic and nat when your lan IP is the same IP as the gateway on your wan interface ;)

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Indeed. But note that this has Wifi7, HDMI 2.1, BlueTooth 5.4, and 5G Ethernet, so even in the additional features list this bundle blows the Steam Machine away. And, with the money saved, one could improve this dramatically.
    • One of the strangest galaxies in our Universe could help answer some long overdue questions by Sayan Sen Image by Pixabay via Pexels | Not representative An international team of astronomers led by the Department of Astronomy at Tsinghua University has discovered an unusually metal-poor galaxy that may contain signs of first-generation star formation. The galaxy, named Metal-Pristine Galaxy COSMOS Redshift 3 (MPG-CR3), or CR3, was identified using observations from the James Webb Space Telescope (JWST), the Very Large Telescope (VLT), and the Subaru Telescope. The findings, published in The Astrophysical Journal Letters, describe CR3 as the most metal-poor galaxy known from the period known as "cosmic noon," around 11.5 billion years ago. Cosmic noon refers to a period when the universe was producing stars at its highest rate and galaxies were growing rapidly. In astronomy, "metals" refers to all elements heavier than helium, including oxygen, carbon, and iron. Because CR3 contains so few of these heavier elements, researchers say it closely resembles what scientists expect the earliest galaxies in the universe may have looked like. The discovery is significant because it could offer clues about Population III (Pop III) stars, the first generation of stars thought to have formed after the Big Bang. These stars are believed to have formed from gas made almost entirely of hydrogen and helium, before heavier elements were created inside stars and spread across the universe through supernova explosions. Hence this is why CR3 has been referred to as a "living fossil." Scientists have long believed that Population III stars existed only in the very early universe. As more generations of stars formed and died, they enriched surrounding gas with heavier elements, making the conditions needed for metal-free star formation increasingly rare. Because of this, researchers expected the formation of such stars to have largely ended after the epoch of reionization, a period when radiation from the first stars and galaxies transformed the neutral hydrogen filling the universe and made it largely transparent to ultraviolet light. CR3 appears to challenge that idea. The galaxy was observed at a redshift of z = 3.193 ± 0.016. Redshift measures how much light from a distant object has been stretched as the universe expands and helps astronomers determine how far back in time they are looking. In this case, the redshift corresponds to roughly 11.5 billion years ago during cosmic noon. Although the universe was already several billion years old by that point, CR3 shows characteristics more commonly associated with much earlier galaxies. Observations revealed exceptionally strong emissions from hydrogen and helium, including Lyα, Hα, and He I λ10830. Lyα, or Lyman-alpha emission, is a specific wavelength of light produced by hydrogen and is widely used to study distant galaxies. Hα emission is another hydrogen signature commonly used to trace active star formation, while He I λ10830 is produced by helium and can indicate the presence of very hot, young stars. The measured equivalent widths of EW₀(Lyα) = 822 ± 101 Å and EW₀(Hα) = 2814 ± 327 Å are among the highest ever observed in star-forming galaxies. Equivalent width is a measure of the strength of an emission line relative to the surrounding light, and such large values are typically associated with intense and very recent star formation. At the same time, researchers found no statistically significant detections of metal emission lines, including [O III] λλ4959, 5007 and C IV λλ1548, 1550. Emission lines act as chemical fingerprints that reveal which elements are present in a galaxy. Oxygen and carbon lines are commonly seen in galaxies that have already undergone significant chemical enrichment. Their absence in CR3 suggests an unusually pristine environment. Using abundance calibration methods developed with JWST observations, the team placed a 2σ upper limit on the galaxy's gas-phase metallicity of 12+log(O/H)<6.52, corresponding to less than 0.7% of the Sun's metallicity (Z < 7 × 10⁻³ Z⊙). Gas-phase metallicity measures the abundance of heavy elements in a galaxy's gas. A 2σ upper limit indicates that the true value is very unlikely to be higher than the quoted threshold. Even when accounting for uncertainties in the calibration methods, the most conservative limit remains 12+log(O/H)<6.95, making CR3 the most metal-poor galaxy identified at cosmic noon. The galaxy also appears to contain very little dust. Researchers measured a Lyα/Hα flux ratio of 13.9 ± 2.5, a result that suggests negligible dust attenuation, meaning very little of the galaxy's light is being absorbed or scattered by cosmic dust. Because dust is usually produced by earlier generations of stars, this finding further supports the idea that CR3 has experienced very little chemical enrichment. Further analysis using spectral energy distribution modelling, a technique that compares observed light with theoretical models, suggests that CR3 contains an extremely young stellar population only around 2 million years old. The modelling, which used Population III stellar templates, also indicates the galaxy has a stellar mass of approximately 6.1 × 10⁵ M⊙. The symbol M⊙ represents one solar mass, or the mass of the Sun. One of the key questions raised by the discovery is how such a chemically primitive galaxy could exist in a universe that had already spent billions of years producing heavier elements. To investigate this, the researchers examined CR3's surroundings. Their analysis suggests the galaxy may lie in a slightly underdense environment, with a density contrast of roughly δ ≈ −0.12. An underdense region contains less matter and fewer galaxies than average. The team suggests that this relative isolation may have helped preserve pockets of pristine gas. Metal-rich material expelled from nearby galaxies may never have reached CR3, while the lower rate of galaxy mergers and interactions could have slowed the mixing of enriched gas into the system. If future observations confirm these findings, CR3 could provide some of the strongest evidence yet that first-generation star formation continued well after the epoch of reionization. Such a result would challenge the conventional view that pristine star formation ended by z ≳ 6 and suggest that small pockets of metal-free gas survived much longer than previously thought. Researchers stress that more observations will be needed to determine the galaxy's true nature. Future spectroscopic studies with higher resolution and better signal quality could help confirm whether CR3 is genuinely hosting Population III star formation. The discovery is also expected to encourage searches for other similar galaxies, which could help astronomers better understand how the first stars formed and how galaxies evolved in the early universe. Source: Tsinghua University, IOPscience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "I think in the immediate absence of a partner to apply relief" In the words of Sterling Archer... "Phrasing!"
    • For me, the fundamental problems with these "smartglasses" is that they really don't work well for people with significant prescriptions and massively up the price if you use attached lenses if they have displays, and if they don't, then they're not actually "smart" anything, rather just connecting to your phone and relaying voice to an AI. In a few cases like this, they throw in small cameras to feed video to the AI. All around, these feel like both a solution looking for a problem, and the problems it tries to solve seem more easily solved by different approaches and designs. Oddly, if the rumours are true, Apple may actually have invented something for once and it kind of does this right: put cameras in ear buds and manage the interface to AI exactly as most of us do: tapping on an ear bud and saying "Hey Google" or "Hey Siri." That makes them compatible with almost everyone, can double up as a hearing assist device, an impaired vision assist device, a "smart" device... and answer your phone and play music. That just seems like a better solution all around.
  • Recent Achievements

    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
  • Popular Contributors

    1. 1
      +primortal
      454
    2. 2
      +Edouard
      161
    3. 3
      PsYcHoKiLLa
      107
    4. 4
      Michael Scrip
      84
    5. 5
      Steven P.
      71
  • Tell a friend

    Love Neowin? Tell a friend!