kitz wiki - User contributions [en]

Pfsense

2025-09-22T17:05:28Z

Chrysalis: /* pfSense patches contributed by the kitz community */

== pfSense patches contributed by the kitz community ==

The following patches have been created to work on pfSense version 2.8.1. They are added or amended as ''Custom System Patches'' in the ''System Patches'' package on pfSense, there is information about this below the list of patches.

*[[LimitersFW_patch281|Remove Schedule from Firewall GUI and also replace Queues with Limiters]]
*[[DiagLimiters_patch270|Improved Limiters information page layout]]
*[[servicecyclev4_patch281|Only cycle services on IP change IPv4]]
*[[servicecyclev6_patch281|Only cycle services on IP change IPv6]]
*[[bash_patch|Add Bash shell as option to console/terminal login menu]]
*[[MuteWebAccess_patch|Mute web UI access log for cleaner logs]]
*[[FWdefLAN_patch270|Firewall page default to LAN instead of WAN]]
*[[CompactTrafficTotals|Compact the Traffic Total page]]
*[[ShaperVPNDefs|OpenVPN page default to client, Traffic shaper page default to limiters]]
*[[BetterTemps|More Accurate Temperatures]]
*[[GranularServeExpired|Improved DNS Resolver Options]]

Note adding these patches with the instructions provided wont activate the patch, system behaviour is only changed after clicking apply for that patch, and can be reverted any time. Auto apply defaults to off, meaning they wont be applied on system updates.

[[Click here for pfSense 2.6.0 patches]] | [[Click here for pfSense 2.7.0 patches]]

----

To use patches on pfSense you first need to install the ''System Patches'' package, this can be installed in the following way.

1 - First login to pfSense. 
2 - Second click on the ''System'' pulldown menu on the top bar and select Package Manager. 
[[File:PFpackagemanager.png]] 
3 - Select ''Available Packages''. 
[[File:pfavailablepackages.png]] 
4 - You should see a list of packages appear on the screen. 
5 - Scroll down to the ''System Patches'' package and then click on the green install button on the right. 
[[File:pfsystempatches.png]] 
[[File:pfinstall.png]] 
6 - After a delay the package should be installed. 

----

Now with the ''System Patches'' package installed there wont be any patches installed by default, this package just facilitates easy patch management.

The interface can be accessed first by clicking the ''System'' pulldown menu again, then by clicking ''patches'' on the menu.

At this point there will be two boxes.

The top box will be titled ''Custom System Patches''. 
[[File:pfcustompatches.png]] 
The bottom box will be titled ''Recommended System Patches for Netgate pfSense® software version 2.6.0''. 
[[File:pfreccomendedpatches.png]] 

The bottom box is akin to hotfixes. These patches are made by contributors to pfSense code and are things that will be patched in the next release of pfSense. But have been deemed important enough to backport to the current stable version via a hotfix.

To install any of these recommended system patches, you just need to click the blue ''Apply'' button, they can be safely reverted by clicking the blue ''Revert'' button. The blue ''View'' button allows you to view the patch code, and the blue ''Debug'' button confirms if the patch applies cleanly or not.

One patch in this section might be considered especially useful called ''Disable pf counter data preservation to temporarily work around latency when reloading large rulesets'', this patch will prevent network drops during any firewall rule reloads.

Now on to user contributed patches.

The top box mentioned earlier titled ''Custom System Patches'' works similar once a patch has been added, it will have the same blue buttons, and the same failsafe's notably patches that dont apply cleanly will not have the option to be applied.

To add one of the patches linked to in this wiki or to make your own patch, there is a green button labelled ''Add New Patch''. 
[[File:pfaddnewpatch.png]]

[[Category:Pfsense Patches]]

GranularServeExpired

2025-09-21T21:26:10Z

Chrysalis:

Since pfSense 2.8.1. The unbound DNS resolver that is distributed in the firewall has a new default behaviour for the serve expired feature, this is because a new RFC 8767 was drawn up which now has reccomended practice of using the feature for serving stale queries only, so the default value now makes the feature only serve expired queries from the cache if a upstream DNS lookup fails to respond within 1800ms.

If you wish to only utilise the new default behaviour, then there is no need for this patch, if you wish to preserve the old behaviour to maximise DNS query performance, then this patch will alow you to choose between the two behaviours, as well as keeping serve expired disabled.

This patch wont allow you to configure a custom timeout, to do that, select the new behaviour which wont set the variable, just relying on the default, and then can set it in the custom box on advanced settings as an override, I deliberatly designed the patch this way in case there is a desire to set a custom timeout value.

---

Paste the below code into the Patch Contents box.

Add a description such as 'Unbound new serve expired toggle' in the Description box.

Set Path Strip Count to '0'.

Base Directory to '/'

<pre>--- /etc/inc/unbound.inc 2025-09-21 19:05:38.753690000 +0100
+++ /etc/inc/unbound.inc 2025-09-21 20:35:22.638223000 +0100
@@ -376,7 +376,14 @@
$harden_dnssec_stripped = isset($unboundcfg['dnssecstripped']) ? "yes" : "no";
$prefetch = isset($unboundcfg['prefetch']) ? "yes" : "no";
$prefetch_key = isset($unboundcfg['prefetchkey']) ? "yes" : "no";
- $dns_record_cache = isset($unboundcfg['dnsrecordcache']) ? "yes" : "no";
+ if (is_null($unboundcfg['dnsrecordcache']) || ($unboundcfg['dnsrecordcache'] == '0')) {
+ $dns_record_cache = "no";
+ } else {
+ $dns_record_cache = "yes";
+ }
+ if ($unboundcfg['dnsrecordcache'] == '1') {
+ $dns_record_cache_ttl = "serve-expired-client-timeout: 0";
+ }
$sock_queue_timeout = empty($unboundcfg['sock_queue_timeout']) ? '0' : $unboundcfg['sock_queue_timeout'];
$aggressivensec = isset($unboundcfg['aggressivensec']) ? "yes" : "no";
$outgoing_num_tcp = isset($unboundcfg['outgoing_num_tcp']) ? $unboundcfg['outgoing_num_tcp'] : "10";
@@ -531,6 +538,7 @@
prefetch-key: {$prefetch_key}
use-caps-for-id: {$use_caps}
serve-expired: {$dns_record_cache}
+{$dns_record_cache_ttl}
sock-queue-timeout: {$sock_queue_timeout}
aggressive-nsec: {$aggressivensec}

--- /usr/local/www/services_unbound_advanced.php 2025-09-21 19:05:38.754169000 +0100
+++ /usr/local/www/services_unbound_advanced.php 2025-09-21 20:43:39.841217000 +0100
@@ -49,7 +49,7 @@
$pconfig['prefetch'] = config_path_enabled('unbound', 'prefetch');
$pconfig['prefetchkey'] = config_path_enabled('unbound', 'prefetchkey');
$pconfig['dnssecstripped'] = config_path_enabled('unbound', 'dnssecstripped');
-$pconfig['dnsrecordcache'] = config_path_enabled('unbound', 'dnsrecordcache');
+$pconfig['dnsrecordcache'] = config_get_path('unbound/dnsrecordcache', 0);
$pconfig['sock_queue_timeout'] = config_get_path('unbound/sock_queue_timeout', 0);
$pconfig['aggressivensec'] = config_path_enabled('unbound', 'aggressivensec');

@@ -173,11 +173,7 @@
} else {
config_del_path('unbound/dnssecstripped');
}
- if (isset($_POST['dnsrecordcache'])) {
- config_set_path('unbound/dnsrecordcache', true);
- } else {
- config_del_path('unbound/dnsrecordcache');
- }
+ config_set_path('unbound/dnsrecordcache', $_POST['dnsrecordcache']);
config_set_path('unbound/sock_queue_timeout', $_POST['sock_queue_timeout']);
if (isset($_POST['aggressivensec'])) {
config_set_path('unbound/aggressivensec', true);
@@ -315,12 +311,12 @@
$pconfig['dnssecstripped']
))->setHelp('If such data is absent, the zone becomes bogus. If Disabled and no DNSSEC data is received, then the zone is made insecure. Requires DNSSEC enabled. ');

-$section->addInput(new Form_Checkbox(
+$section->addInput(new Form_Select(
'dnsrecordcache',
'Serve Expired',
- 'Serve cache records even with TTL of 0',
- $pconfig['dnsrecordcache']
-))->setHelp('When enabled, allows unbound to serve one query even with a TTL of 0, if TTL is 0 then new record will be requested in the background when the cache is served to ensure cache is updated without latency on service of the DNS request.');
+ $pconfig['dnsrecordcache'],
+ array_combine(array("0", "1", "2"), array("Off: Unbound Default", "Serve Expired/Stale - Old behaviour", "Serve Stale - RFC8767"))
+))->setHelp('When enabled, allows unbound cache to serve one query even with a TTL of 0, if TTL is 0 then new record will be requested in the background when the cache is served to ensure cache is updated without latency on service of the DNS request.');

$section->addInput(new Form_Input(
'sock_queue_timeout',</pre>

[[Category:Pfsense Patches]]

Pfsense

2025-09-21T21:25:10Z

Chrysalis: /* pfSense patches contributed by the kitz community */

== pfSense patches contributed by the kitz community ==

The following patches have been created to work on pfSense version 2.8.1. They are added or amended as ''Custom System Patches'' in the ''System Patches'' package on pfSense, there is information about this below the list of patches.

*[[LimitersFW_patch281|Remove Schedule from Firewall GUI and also replace Queues with Limiters]]
*[[DiagLimiters_patch270|Improved Limiters information page layout]]
*[[servicecyclev4_patch281|Only cycle services on IP change IPv4]]
*[[servicecyclev6_patch281|Only cycle services on IP change IPv6]]
*[[bash_patch|Add Bash shell as option to console/terminal login menu]]
*[[MuteWebAccess_patch|Mute web UI access log for cleaner logs]]
*[[FWdefLAN_patch270|Firewall page default to LAN instead of WAN]]
*[[CompactTrafficTotals|Compact the Traffic Total page]]
*[[ShaperVPNDefs|OpenVPN page default to client, Traffic shaper page default to limiters]]
*[[BetterTemps|More Accurate Temperatures]]
*[[GranularServeExpired|Improved DNS Resolver Options]]

Note adding these patches with the instructions provided wont activate the patch, system behaviour is only changed after clicking apply for that patch, and can be reverted any time. Auto apply defaults to off, meaning they wont be applied on system updates.

[[Click here for pfSense 2.6.0 patches]] | [[Click here for pfSense 2.7.0 patches]]

----

To use patches on pfSense you first need to install the ''System Patches'' package, this can be installed in the following way.

1 - First login to pfSense. 
2 - Second click on the ''System'' pulldown menu on the top bar and select Package Manager. 
[[File:PFpackagemanager.png]] 
3 - Select ''Available Packages''. 
[[File:pfavailablepackages.png]] 
4 - You should see a list of packages appear on the screen. 
5 - Scroll down to the ''System Patches'' package and then click on the green install button on the right. 
[[File:pfsystempatches.png]] 
[[File:pfinstall.png]] 
6 - After a delay the package should be installed. 

----

Now with the ''System Patches'' package installed there wont be any patches installed by default, this package just facilitates easy patch management.

The interface can be accessed first by clicking the ''System'' pulldown menu again, then by clicking ''patches'' on the menu.

At this point there will be two boxes.

The top box will be titled ''Custom System Patches''. 
[[File:pfcustompatches.png]] 
The bottom box will be titled ''Recommended System Patches for Netgate pfSense® software version 2.6.0''. 
[[File:pfreccomendedpatches.png]] 

The bottom box is akin to hotfixes. These patches are made by contributors to pfSense code and are things that will be patched in the next release of pfSense. But have been deemed important enough to backport to 2.6.0 via a hotfix.

To install any of these recommended system patches, you just need to click the blue ''Apply'' button, they can be safely reverted by clicking the blue ''Revert'' button. The blue ''View'' button allows you to view the patch code, and the blue ''Debug'' button confirms if the patch applies cleanly or not.

One patch in this section might be considered especially useful called ''Disable pf counter data preservation to temporarily work around latency when reloading large rulesets'', this patch will prevent network drops during any firewall rule reloads.

Now on to user contributed patches.

The top box mentioned earlier titled ''Custom System Patches'' works similar once a patch has been added, it will have the same blue buttons, and the same failsafe's notably patches that dont apply cleanly will not have the option to be applied.

To add one of the patches linked to in this wiki or to make your own patch, there is a green button labelled ''Add New Patch''. 
[[File:pfaddnewpatch.png]]

[[Category:Pfsense Patches]]

GranularServeExpired

2025-09-21T21:23:59Z

Chrysalis: Created page with "Since pfSense 2.8.1. The unbound DNS resolver that is distributed in the firewall has a new default behaviour for the serve expired feature, this is because a new RFC 8767 was..."

Servicecyclev6 patch281

2025-09-21T21:06:35Z

Chrysalis: Created page with "Default behaviour on pfSense is to cycle all services if any configured gateways go offline, this can include VPN's and tunnels not just broadband connectivity. This can caus..."

Default behaviour on pfSense is to cycle all services if any configured gateways go offline, this can include VPN's and tunnels not just broadband connectivity.

This can cause problems e.g. if your pfSense is hosting LAN services such as a NTP server or UPS daemon. Consider a scenario e.g. if you have a power cut, your WAN goes offline, pfSense then puts services into a cycle loop, which in turn drops connectivity to the UPS daemon so client machines are unaware of power status and battery level which might prevent automated safe shutdown/hibernation.

This patch changes the behaviour so services will only get cycled if a external non OpenVPN interface comes back online with a different IP address, if its a cycle keeping the existing IP, then it will not cycle all services.

This is the IPv6 version of the patch, there is also a IPv4 version.

This patch also reduces log noise from dhcp6 client renewals on the WAN connection that was added in recent builds of pfSense.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Better diagnostics limiters layout' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/'.

<pre>--- /etc/rc.newwanipv6 2022-01-31 19:53:42.000000000 +0000
+++ /etc/rc.newwanipv6 2023-04-18 03:15:33.061352000 +0100
@@ -62,7 +62,5 @@
}

if (!empty($reason) && ($reason != 'RENEW')) {
log_error("rc.newwanipv6: Info: starting on {$argument} due to {$reason}.");
-} else {
- log_error("rc.newwanipv6: Info: starting on {$argument}.");
}
@@ -255,11 +253,6 @@
/* reconfigure IPsec tunnels */
ipsec_force_reload($interface, 'inet6');

-/* start OpenVPN server & clients */
-if (substr($interface_real, 0, 4) != "ovpn") {
- openvpn_resync_all($interface, 'inet6');
-}
-
/* reconfigure GRE/GIF tunnels */
$gre = link_interface_to_tunnelif($interface, 'gre', 'inet6');
array_walk($gre, 'interface_gre_configure');
@@ -286,7 +279,6 @@
/* reload graphing functions */
enable_rrd_graphing();

- restart_packages();
}

unlink_if_exists("{$g['tmp_path']}/{$interface}_upstart6");

[[Category:Pfsense Patches]]

Servicecyclev4 patch281

2025-09-21T21:03:11Z

Default behaviour on pfSense is to cycle all services if any configured gateways go offline, this can include VPN's and tunnels not just broadband connectivity.

This can cause problems e.g. if your pfSense is hosting LAN services such as a NTP server or UPS daemon. Consider a scenario e.g. if you have a power cut, your WAN goes offline, pfSense then puts services into a cycle loop, which in turn drops connectivity to the UPS daemon so client machines are unaware of power status and battery level which might prevent automated safe shutdown/hibernation.

This patch changes the behaviour so services will only get cycled if a external non OpenVPN interface comes back online with a different IP address, if its a cycle keeping the existing IP, then it will not cycle all services.

This is the IPv4 version of the patch, there is also a IPv6 version.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Better diagnostics limiters layout' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/'.

<pre>--- /etc/rc.newwanip 2023-06-28 04:51:31.000000000 +0100
+++ /etc/rc.newwanip 2023-07-22 00:12:33.150672000 +0100
@@ -41,9 +41,13 @@
function restart_packages() {
global $oldip, $curwanip, $g;

- /* restart packages */
- log_error("{$g['product_label']} package system has detected an IP change or dynamic WAN reconnection - $oldip -> $curwanip - Restarting packages.");
- send_event("service reload packages");
+ if (substr($interface_real, 0, 4) != "ovpn") {
+ if ($curwanip != $oldip) {
+ /* restart packages */
+ log_error("{$g['product_label']} package system has detected an IP change or dynamic WAN reconnection - $oldip -> $curwanip - Restarting packages.");
+ send_event("service reload packages");
+ }
+ }
}

/* Interface IP address has changed */

[[Category:Pfsense Patches]]

LimitersFW patch281

2025-09-21T20:54:38Z

Chrysalis: Created page with "By default the firewall rules screen will display the configured queue (ALTQ) in the Queue column, if you are using limiters instead (dummynet) which is common to use fq_codel..."

By default the firewall rules screen will display the configured queue (ALTQ) in the Queue column, if you are using limiters instead (dummynet) which is common to use fq_codel, then this patch can be used to display the configured limiter in that column instead of the queue, new column name Limiter. In addition to free up space, it also removes the schedule column which is unlikely to be used.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Remove schedule and add limiters Firewall UI' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/usr/local/www/'.

<pre>--- firewall_rules.php 2022-09-28 20:57:55.827968000 +0100
+++ firewall_rules.php 2022-09-28 20:55:22.694754000 +0100
@@ -499,8 +499,7 @@
<th><?=gettext('Destination')?></th>
<th><?=gettext('Port')?></th>
<th><?=gettext('Gateway')?></th>
- <th><?=gettext('Queue')?></th>
- <th><?=gettext('Schedule')?></th>
+ <th><?=gettext('Limiter')?></th>
<th><?=gettext('Description')?></th>
<th><?=gettext('Actions')?></th>
</tr>
@@ -992,24 +992,18 @@
</td>
<td>
<?php
- if (isset($filterent['ackqueue']) && isset($filterent['defaultqueue'])) {
- $desc = str_replace('_', ' ', $filterent['ackqueue']);
- echo "<a href=\"firewall_shaper_queues.php?queue={$filterent['ackqueue']}&action=show\">{$desc}</a>";
- $desc = str_replace('_', '_', $filterent['defaultqueue']);
- echo "/<a href=\"firewall_shaper_queues.php?queue={$filterent['defaultqueue']}&action=show\">{$desc}</a>";
- } else if (isset($filterent['defaultqueue'])) {
- $desc = str_replace('_', '_', $filterent['defaultqueue']);
- echo "<a href=\"firewall_shaper_queues.php?queue={$filterent['defaultqueue']}&action=show\">{$desc}</a>";
+ if (isset($filterent['pdnpipe']) && isset($filterent['dnpipe'])) {
+ $desc = str_replace('_', ' ', $filterent['pdnpipe']);
+ echo "<a href=\"firewall_shaper_vinterface.php\">{$desc}</a>";
+ $desc = str_replace('_', '_', $filterent['dnpipe']);
+ echo "/<a href=\"firewall_shaper_vinterface.php\">{$desc}</a>";
+ } else if (isset($filterent['dnpipe'])) {
+ $desc = str_replace('_', '_', $filterent['dnpipe']);
+ echo "<a href=\"firewall_shaper_vinterface.php\">{$desc}</a>";
} else {
echo gettext("none");
}
?>
- </td>
- <td>
- <?php if ($printicon) { ?>
- <?=$dispcolor?>" title="<?=$alttext;?>">
- <?php } ?>
- <?=$schedule_span_begin;?><?=str_replace('_', '_', htmlspecialchars($filterent['sched']));?> <?=$schedule_span_end;?>
</td>
<td>
<?=htmlspecialchars($filterent['descr']);?>

[[Category:Pfsense Patches]]

Click here for pfSense 2.7.0 patches

2025-09-21T20:50:12Z

Chrysalis: New pfSense 2.7.0 patches page

The following patches have been created to work on pfSense version 2.7.0. They are added or amended as ''Custom System Patches'' in the ''System Patches'' package on pfSense, there is information about this below the list of patches.

*[[LimitersFW_patch|Remove Schedule from Firewall GUI and also replace Queues with Limiters]]
*[[DiagLimiters_patch270|Improved Limiters information page layout]]
*[[servicecyclev4_patch270|Only cycle services on IP change IPv4]]
*[[servicecyclev6_patch|Only cycle services on IP change IPv6]]
*[[bash_patch|Add Bash shell as option to console/terminal login menu]]
*[[MuteWebAccess_patch|Mute web UI access log for cleaner logs]]
*[[FWdefLAN_patch270|Firewall page default to LAN instead of WAN]]
*[[CompactTrafficTotals|Compact the Traffic Total page]]
*[[ShaperVPNDefs|OpenVPN page default to client, Traffic shaper page default to limiters]]
*[[BetterTemps|More Accurate Temperatures]]

Note adding these patches with the instructions provided wont activate the patch, system behaviour is only changed after clicking apply for that patch, and can be reverted any time. Auto apply defaults to off, meaning they wont be applied on system updates.

[[Category:Pfsense Patches]]

Pfsense

2025-09-21T20:49:43Z

Chrysalis: add link to pfSense 2.7.0 patches

== pfSense patches contributed by the kitz community ==

The following patches have been created to work on pfSense version 2.7.0. They are added or amended as ''Custom System Patches'' in the ''System Patches'' package on pfSense, there is information about this below the list of patches.

*[[LimitersFW_patch|Remove Schedule from Firewall GUI and also replace Queues with Limiters]]
*[[DiagLimiters_patch270|Improved Limiters information page layout]]
*[[servicecyclev4_patch270|Only cycle services on IP change IPv4]]
*[[servicecyclev6_patch|Only cycle services on IP change IPv6]]
*[[bash_patch|Add Bash shell as option to console/terminal login menu]]
*[[MuteWebAccess_patch|Mute web UI access log for cleaner logs]]
*[[FWdefLAN_patch270|Firewall page default to LAN instead of WAN]]
*[[CompactTrafficTotals|Compact the Traffic Total page]]
*[[ShaperVPNDefs|OpenVPN page default to client, Traffic shaper page default to limiters]]
*[[BetterTemps|More Accurate Temperatures]]

Note adding these patches with the instructions provided wont activate the patch, system behaviour is only changed after clicking apply for that patch, and can be reverted any time. Auto apply defaults to off, meaning they wont be applied on system updates.

[[Click here for pfSense 2.6.0 patches]] | [[Click here for pfSense 2.7.0 patches]]

----

To use patches on pfSense you first need to install the ''System Patches'' package, this can be installed in the following way.

1 - First login to pfSense. 
2 - Second click on the ''System'' pulldown menu on the top bar and select Package Manager. 
[[File:PFpackagemanager.png]] 
3 - Select ''Available Packages''. 
[[File:pfavailablepackages.png]] 
4 - You should see a list of packages appear on the screen. 
5 - Scroll down to the ''System Patches'' package and then click on the green install button on the right. 
[[File:pfsystempatches.png]] 
[[File:pfinstall.png]] 
6 - After a delay the package should be installed. 

----

Now with the ''System Patches'' package installed there wont be any patches installed by default, this package just facilitates easy patch management.

The interface can be accessed first by clicking the ''System'' pulldown menu again, then by clicking ''patches'' on the menu.

At this point there will be two boxes.

The top box will be titled ''Custom System Patches''. 
[[File:pfcustompatches.png]] 
The bottom box will be titled ''Recommended System Patches for Netgate pfSense® software version 2.6.0''. 
[[File:pfreccomendedpatches.png]] 

The bottom box is akin to hotfixes. These patches are made by contributors to pfSense code and are things that will be patched in the next release of pfSense. But have been deemed important enough to backport to 2.6.0 via a hotfix.

To install any of these recommended system patches, you just need to click the blue ''Apply'' button, they can be safely reverted by clicking the blue ''Revert'' button. The blue ''View'' button allows you to view the patch code, and the blue ''Debug'' button confirms if the patch applies cleanly or not.

One patch in this section might be considered especially useful called ''Disable pf counter data preservation to temporarily work around latency when reloading large rulesets'', this patch will prevent network drops during any firewall rule reloads.

Now on to user contributed patches.

The top box mentioned earlier titled ''Custom System Patches'' works similar once a patch has been added, it will have the same blue buttons, and the same failsafe's notably patches that dont apply cleanly will not have the option to be applied.

To add one of the patches linked to in this wiki or to make your own patch, there is a green button labelled ''Add New Patch''. 
[[File:pfaddnewpatch.png]]

[[Category:Pfsense Patches]]

BetterTemps

2024-06-16T14:25:43Z

Chrysalis: adjust text format

When the temperatures are polled to plot the temperature graph in 'status monitoring' on hardware that utilises hardware p-states (speed shift) the clock speeds are so sensitive that this can add a significant amount of temperature for a brief moment during the polling period, which will cause elevated temperatures to be recorded on the graph that don't accurately represent the average temperature of the unit. This patch will make it fetch a cached value from a previous poll instead, the actual poll will need to be added to the cron.

First check if you see the 'Cron' item on the 'Services' menu. If it is missing then go to the 'System' menu and select 'Package Manager', from there select 'Available Packages' and then install the 'Cron' Package.

Go to the 'Services' menu, select 'Cron', then click on the green '+Add' button. 
For the top 5 boxes which are Minute, Hour, Day of the month, Month of the Year, and Day of the week, populate the box with the asterisk symbol '*'. 
For the user box enter 'root'. 
For the command box add the following. All pasted in as one line. '''''/sbin/sysctl -q hw.acpi.thermal dev.cpu dev.t5nex dev.armada_thermal dev.cordbuc dev.pchtherm | /usr/bin/grep temperature > /tmp/rrd.temps'''''. 
Finally click the blue 'Save' Button

Next add and apply the the patch as below. 

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'better cpu temp monitoring, requires sysctl temp cron' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/etc/inc/'.

<pre>--- rrd.inc 2024-06-13 10:40:51.931237000 +0100
+++ rrd.inc 2024-06-13 11:03:17.066678000 +0100
@@ -744,7 +744,7 @@
$unknown = "";
$rrdupdateds = "";
$rrdsensors = "";
- $_gb = exec("/sbin/sysctl -q hw.acpi.thermal dev.cpu dev.t5nex dev.armada_thermal dev.cordbuc dev.pchtherm | /usr/bin/grep temperature | /usr/bin/cut -d':' -f1", $sensors_array);
+ $_gb = exec("cat /tmp/rrd.temps | /usr/bin/cut -d':' -f1", $sensors_array);

if (!empty($sensors_array)) {
foreach ($sensors_array as $sensor) {
@@ -753,7 +753,7 @@
$rrdcreateds .= "DS:$sensor_name:GAUGE:$sensorsvalid:0:100 ";
$unknown .= ":U";
$rrddsname = strtoupper($sensor_name);
- $rrdupdateds .= "$rrddsname=`$sysctl -qn $sensor | $sed 's/C//'`\n";
+ $rrdupdateds .= "$rrddsname=`/usr/bin/grep $sensor /tmp/rrd.temps | /usr/bin/cut -d' ' -f2 | $sed 's/C//'`\n";
$rrdsensors .= ":\${$rrddsname}";
}
if (!file_exists("$rrddbpath$ifname$sensors")) {</pre>

[[Category:Pfsense Patches]]

BetterTemps

2024-06-16T14:21:50Z

Chrysalis: better temps patch

When the temperatures are polled to plot the temperature graph in 'status monitoring' on hardware that utilises hardware p-states (speed shift) the clock speeds are so sensitive that this can add a significant amount of temperature for a brief moment during the polling period, which will cause elevated temperatures to be recorded on the graph that don't accurately represent the average temperature of the unit. This patch will make it fetch a cached value from a previous poll instead, the actual poll will need to be added to the cron.

First check if you see the 'Cron' item on the 'Services' menu. If it is missing then go to the 'System' menu and select 'Package Manager', from there select 'Available Packages' and then install the 'Cron' Package.

Go to the 'Services' menu, select 'Cron', then click on the green '+Add' button.
For the top 5 boxes which are Minute, Hour, Day of the month, Month of the Year, and Day of the week, populate the box with the asterisk symbol '*'.
For the user box enter 'root'
For the command box add the following. All pasted in as one line. ''/sbin/sysctl -q hw.acpi.thermal dev.cpu dev.t5nex dev.armada_thermal dev.cordbuc dev.pchtherm | /usr/bin/grep temperature > /tmp/rrd.temps''
Finally click the blue 'Save' Button

Next add and apply the the patch as below.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'better cpu temp monitoring, requires sysctl temp cron' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/etc/inc/'.

<pre>--- rrd.inc 2024-06-13 10:40:51.931237000 +0100
+++ rrd.inc 2024-06-13 11:03:17.066678000 +0100
@@ -744,7 +744,7 @@
$unknown = "";
$rrdupdateds = "";
$rrdsensors = "";
- $_gb = exec("/sbin/sysctl -q hw.acpi.thermal dev.cpu dev.t5nex dev.armada_thermal dev.cordbuc dev.pchtherm | /usr/bin/grep temperature | /usr/bin/cut -d':' -f1", $sensors_array);
+ $_gb = exec("cat /tmp/rrd.temps | /usr/bin/cut -d':' -f1", $sensors_array);

if (!empty($sensors_array)) {
foreach ($sensors_array as $sensor) {
@@ -753,7 +753,7 @@
$rrdcreateds .= "DS:$sensor_name:GAUGE:$sensorsvalid:0:100 ";
$unknown .= ":U";
$rrddsname = strtoupper($sensor_name);
- $rrdupdateds .= "$rrddsname=`$sysctl -qn $sensor | $sed 's/C//'`\n";
+ $rrdupdateds .= "$rrddsname=`/usr/bin/grep $sensor /tmp/rrd.temps | /usr/bin/cut -d' ' -f2 | $sed 's/C//'`\n";
$rrdsensors .= ":\${$rrddsname}";
}
if (!file_exists("$rrddbpath$ifname$sensors")) {</pre>

[[Category:Pfsense Patches]]

Pfsense

2024-06-16T14:12:25Z

Chrysalis: add temperature patch link

== pfSense patches contributed by the kitz community ==

The following patches have been created to work on pfSense version 2.7.0. They are added or amended as ''Custom System Patches'' in the ''System Patches'' package on pfSense, there is information about this below the list of patches.

*[[LimitersFW_patch|Remove Schedule from Firewall GUI and also replace Queues with Limiters]]
*[[DiagLimiters_patch270|Improved Limiters information page layout]]
*[[servicecyclev4_patch270|Only cycle services on IP change IPv4]]
*[[servicecyclev6_patch|Only cycle services on IP change IPv6]]
*[[bash_patch|Add Bash shell as option to console/terminal login menu]]
*[[MuteWebAccess_patch|Mute web UI access log for cleaner logs]]
*[[FWdefLAN_patch270|Firewall page default to LAN instead of WAN]]
*[[CompactTrafficTotals|Compact the Traffic Total page]]
*[[ShaperVPNDefs|OpenVPN page default to client, Traffic shaper page default to limiters]]
*[[BetterTemps|More Accurate Temperatures]]

Note adding these patches with the instructions provided wont activate the patch, system behaviour is only changed after clicking apply for that patch, and can be reverted any time. Auto apply defaults to off, meaning they wont be applied on system updates.

[[Click here for pfSense 2.6.0 patches]]

----

To use patches on pfSense you first need to install the ''System Patches'' package, this can be installed in the following way.

1 - First login to pfSense. 
2 - Second click on the ''System'' pulldown menu on the top bar and select Package Manager. 
[[File:PFpackagemanager.png]] 
3 - Select ''Available Packages''. 
[[File:pfavailablepackages.png]] 
4 - You should see a list of packages appear on the screen. 
5 - Scroll down to the ''System Patches'' package and then click on the green install button on the right. 
[[File:pfsystempatches.png]] 
[[File:pfinstall.png]] 
6 - After a delay the package should be installed. 

----

Now with the ''System Patches'' package installed there wont be any patches installed by default, this package just facilitates easy patch management.

The interface can be accessed first by clicking the ''System'' pulldown menu again, then by clicking ''patches'' on the menu.

At this point there will be two boxes.

The top box will be titled ''Custom System Patches''. 
[[File:pfcustompatches.png]] 
The bottom box will be titled ''Recommended System Patches for Netgate pfSense® software version 2.6.0''. 
[[File:pfreccomendedpatches.png]] 

The bottom box is akin to hotfixes. These patches are made by contributors to pfSense code and are things that will be patched in the next release of pfSense. But have been deemed important enough to backport to 2.6.0 via a hotfix.

To install any of these recommended system patches, you just need to click the blue ''Apply'' button, they can be safely reverted by clicking the blue ''Revert'' button. The blue ''View'' button allows you to view the patch code, and the blue ''Debug'' button confirms if the patch applies cleanly or not.

One patch in this section might be considered especially useful called ''Disable pf counter data preservation to temporarily work around latency when reloading large rulesets'', this patch will prevent network drops during any firewall rule reloads.

Now on to user contributed patches.

The top box mentioned earlier titled ''Custom System Patches'' works similar once a patch has been added, it will have the same blue buttons, and the same failsafe's notably patches that dont apply cleanly will not have the option to be applied.

To add one of the patches linked to in this wiki or to make your own patch, there is a green button labelled ''Add New Patch''. 
[[File:pfaddnewpatch.png]]

[[Category:Pfsense Patches]]

Servicecyclev4 patch

2023-07-22T14:30:44Z

Chrysalis: fix mistake

Default behaviour on pfSense is to cycle all services if any configured gateways go offline, this can include VPN's and tunnels not just broadband connectivity.

This can cause problems e.g. if your pfSense is hosting LAN services such as a NTP server or UPS daemon. Consider a scenario e.g. if you have a power cut, your WAN goes offline, pfSense then puts services into a cycle loop, which in turn drops connectivity to the UPS daemon so client machines are unaware of power status and battery level which might prevent automated safe shutdown/hibernation.

This patch changes the behaviour so services will only get cycled if a interface comes back online with a different IP address, if its a cycle keeping the existing IP, then it will not cycle all services, services such as OpenVPN should still behave the same as before.

This is the IPv4 version of the patch, there is also a IPv6 version.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Better diagnostics limiters layout' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/'.

<pre>--- /etc/rc.newwanip 2023-04-18 03:05:04.404321000 +0100
+++ /etc/rc.newwanip 2023-04-18 03:05:50.740612000 +0100
@@ -233,10 +233,12 @@
if (isset($config['system']['ip_change_kill_states'])) {
log_error("IP Address has changed, killing all states (ip_change_kill_states is set).");
pfSense_kill_states(utf8_encode($oldip));
+ restart_packages();
filter_flush_state_table();
} else {
log_error("IP Address has changed, killing states on former IP Address $oldip.");
pfSense_kill_states(utf8_encode($oldip));
+ restart_packages();
}
}

@@ -270,7 +272,7 @@
/* restart snmp */
services_snmpd_configure();

- restart_packages();
+ // restart_packages();
} else {
/* signal filter reload */
filter_configure();</pre>

Servicecyclev6 patch

2023-07-22T14:29:58Z

Chrysalis: fix mistake

Default behaviour on pfSense is to cycle all services if any configured gateways go offline, this can include VPN's and tunnels not just broadband connectivity.

This can cause problems e.g. if your pfSense is hosting LAN services such as a NTP server or UPS daemon. Consider a scenario e.g. if you have a power cut, your WAN goes offline, pfSense then puts services into a cycle loop, which in turn drops connectivity to the UPS daemon so client machines are unaware of power status and battery level which might prevent automated safe shutdown/hibernation.

This patch changes the behaviour so services will only get cycled if a interface comes back online with a different IP address, if its a cycle keeping the existing IP, then it will not cycle all services, services such as OpenVPN should still behave the same as before.

This is the IPv6 version of the patch, there is also a IPv4 version.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Better diagnostics limiters layout' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/'.

<pre>--- /etc/rc.newwanipv6 2022-01-31 19:53:42.000000000 +0000
+++ /etc/rc.newwanipv6 2023-04-18 03:15:33.061352000 +0100
@@ -161,6 +161,7 @@
}
} elseif (does_interface_exist($interface_real) && !empty($oldipv6)) {
mwexec("/sbin/ifconfig {$interface_real} inet6 {$oldipv6} delete");
+ restart_packages();
}

file_put_contents("{$g['vardb_path']}/{$interface}_cacheipv6", $curwanipv6);
@@ -211,7 +212,7 @@
/* reload graphing functions */
enable_rrd_graphing();

- restart_packages();
+ // restart_packages();
}

?></pre>

Servicecyclev4 patch270

2023-07-22T14:29:22Z

Chrysalis: fixed mistake

Default behaviour on pfSense is to cycle all services if any configured gateways go offline, this can include VPN's and tunnels not just broadband connectivity.

This can cause problems e.g. if your pfSense is hosting LAN services such as a NTP server or UPS daemon. Consider a scenario e.g. if you have a power cut, your WAN goes offline, pfSense then puts services into a cycle loop, which in turn drops connectivity to the UPS daemon so client machines are unaware of power status and battery level which might prevent automated safe shutdown/hibernation.

This patch changes the behaviour so services will only get cycled if a interface comes back online with a different IP address, if its a cycle keeping the existing IP, then it will not cycle all services, services such as OpenVPN should still behave the same as before.

This is the IPv4 version of the patch, there is also a IPv6 version.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Better diagnostics limiters layout' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/'.

<pre>--- /etc/rc.newwanip 2023-06-28 04:51:31.000000000 +0100
+++ /etc/rc.newwanip 2023-07-22 00:12:33.150672000 +0100
@@ -103,7 +103,7 @@
}
log_error("rc.newwanip called with empty interface.");
filter_configure();
- restart_packages();
+ // restart_packages();
return;
}

@@ -233,10 +233,12 @@
if (isset($config['system']['ip_change_kill_states'])) {
log_error("IP Address has changed, killing all states (ip_change_kill_states is set).");
pfSense_kill_states($oldip);
+ restart_packages();
filter_flush_state_table();
} else {
log_error("IP Address has changed, killing states on former IP Address $oldip.");
pfSense_kill_states($oldip);
+ restart_packages();
}
}

@@ -273,7 +275,7 @@
/* restart L2TP VPN */
vpn_l2tp_configure($interface);

- restart_packages();
+ // restart_packages();

unlink_if_exists("{$g['tmp_path']}/{$interface}_upstart4");
if (empty($config['interfaces'][$interface]['ipaddrv6'])) {</pre>

FWdefLAN patch270

2023-07-22T14:19:38Z

Chrysalis: updated description for 2.7.0

By default pfSense will take you to the first active interface (usually WAN) in the firewall rules section, I have found that the majority of my editing was in the LAN tab, this patch will save clicks by defaulting to the LAN tab when accessing the firewall rules page.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Firewall rules page default to LAN' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/usr/local/www/'.

<pre>--- firewall_rules.php 2023-07-21 20:39:04.612936000 +0100
+++ firewall_rules.php 2023-07-22 15:08:57.833838000 +0100
@@ -151,7 +151,7 @@
$if != 'EthernetRules' &&
$if != 'FloatingRules') {
/* default to the first configured interface */
- $if = array_key_first($ifdescs);
+ $if = 'lan';
}
}</pre>

FWdefLAN patch270

2023-07-22T14:14:00Z

Chrysalis: Created page with "By default pfSense will take you to the WAN tab in the firewall rules section, I have found that the majority of my editing was in the LAN tab, this patch will save clicks by..."

By default pfSense will take you to the WAN tab in the firewall rules section, I have found that the majority of my editing was in the LAN tab, this patch will save clicks by defaulting to the LAN tab when accessing the firewall rules page.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Firewall rules page default to LAN' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/usr/local/www/'.

<pre>--- firewall_rules.php 2023-07-21 20:39:04.612936000 +0100
+++ firewall_rules.php 2023-07-22 15:08:57.833838000 +0100
@@ -151,7 +151,7 @@
$if != 'EthernetRules' &&
$if != 'FloatingRules') {
/* default to the first configured interface */
- $if = array_key_first($ifdescs);
+ $if = 'lan';
}
}</pre>

Servicecyclev4 patch270

Chrysalis: /* pfSense patches contributed by the kitz community */

== pfSense patches contributed by the kitz community ==

The following patches have been created to work on pfSense version 2.6.0. They are added or amended as ''Custom System Patches'' in the ''System Patches'' package on pfSense, there is information about this below the list of patches.

*[[LimitersFW_patch|Remove Schedule from Firewall GUI and also replace Queues with Limiters]]
*[[DiagLimiters_patch|Improved Limiters information page layout]]
*[[servicecyclev4_patch|Only cycle services on IP change IPv4]]
*[[servicecyclev6_patch|Only cycle services on IP change IPv6]]
*[[bash_patch|Add Bash shell as option to console/terminal login menu]]
*[[MuteWebAccess_patch|Mute web UI access log for cleaner logs]]
*[[FWdefLAN_patch|Firewall page default to LAN instead of WAN]]
*[[CompactTrafficTotals|Compact the Traffic Total page]]
*[[ShaperVPNDefs|OpenVPN page default to client, Traffic shaper page default to limiters]]

Note adding these patches with the instructions provided wont activate the patch, system behaviour is only changed after clicking apply for that patch, and can be reverted any time. Auto apply defaults to off, meaning they wont be applied on system updates.

----

To use patches on pfSense you first need to install the ''System Patches'' package, this can be installed in the following way.

1 - First login to pfSense. 
2 - Second click on the ''System'' pulldown menu on the top bar and select Package Manager. 
[[File:PFpackagemanager.png]] 
3 - Select ''Available Packages''. 
[[File:pfavailablepackages.png]] 
4 - You should see a list of packages appear on the screen. 
5 - Scroll down to the ''System Patches'' package and then click on the green install button on the right. 
[[File:pfsystempatches.png]] 
[[File:pfinstall.png]] 
6 - After a delay the package should be installed. 

----

Now with the ''System Patches'' package installed there wont be any patches installed by default, this package just facilitates easy patch management.

The interface can be accessed first by clicking the ''System'' pulldown menu again, then by clicking ''patches'' on the menu.

At this point there will be two boxes.

The top box will be titled ''Custom System Patches''. 
[[File:pfcustompatches.png]] 
The bottom box will be titled ''Recommended System Patches for Netgate pfSense® software version 2.6.0''. 
[[File:pfreccomendedpatches.png]] 

The bottom box is akin to hotfixes. These patches are made by contributors to pfSense code and are things that will be patched in the next release of pfSense. But have been deemed important enough to backport to 2.6.0 via a hotfix.

To install any of these recommended system patches, you just need to click the blue ''Apply'' button, they can be safely reverted by clicking the blue ''Revert'' button. The blue ''View'' button allows you to view the patch code, and the blue ''Debug'' button confirms if the patch applies cleanly or not.

One patch in this section might be considered especially useful called ''Disable pf counter data preservation to temporarily work around latency when reloading large rulesets'', this patch will prevent network drops during any firewall rule reloads.

Now on to user contributed patches.

The top box mentioned earlier titled ''Custom System Patches'' works similar once a patch has been added, it will have the same blue buttons, and the same failsafe's notably patches that dont apply cleanly will not have the option to be applied.

To add one of the patches linked to in this wiki or to make your own patch, there is a green button labelled ''Add New Patch''. 
[[File:pfaddnewpatch.png]]

2023-06-05T18:35:44Z

Chrysalis: fix error on base path

Default behaviour on pfSense is to cycle all services if any configured gateways go offline, this can include VPN's and tunnels not just broadband connectivity.

This can cause problems e.g. if your pfSense is hosting LAN services such as a NTP server or UPS daemon. Consider a scenario e.g. if you have a power cut, your WAN goes offline, pfSense then puts services into a cycle loop, which in turn drops connectivity to the UPS daemon so client machines are unaware of power status and battery level which might prevent automated safe shutdown/hibernation.

This patch changes the behaviour so services will only get cycled if a gateway comes back online with a different IP address, if its a cycle keeping the existing IP, then it will not cycle all services, services such as OpenVPN should still behave the same as before.

This is the IPv4 version of the patch, there is also a IPv6 version.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Better diagnostics limiters layout' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/'.

<pre>--- /etc/rc.newwanip 2023-04-18 03:05:04.404321000 +0100
+++ /etc/rc.newwanip 2023-04-18 03:05:50.740612000 +0100
@@ -233,10 +233,12 @@
if (isset($config['system']['ip_change_kill_states'])) {
log_error("IP Address has changed, killing all states (ip_change_kill_states is set).");
pfSense_kill_states(utf8_encode($oldip));
+ restart_packages();
filter_flush_state_table();
} else {
log_error("IP Address has changed, killing states on former IP Address $oldip.");
pfSense_kill_states(utf8_encode($oldip));
+ restart_packages();
}
}

@@ -270,7 +272,7 @@
/* restart snmp */
services_snmpd_configure();

- restart_packages();
+ // restart_packages();
} else {
/* signal filter reload */
filter_configure();</pre>

LimitersFW patch

2023-06-05T18:29:36Z

Chrysalis:

By default the firewall rules screen will display the configured queue (ALTQ) in the Queue column, if you are using limiters instead (dummynet) which is common to use fq_codel, then this patch can be used to display the configured limiter in that column instead of the queue, new column name Limiter. In addition to free up space, it also removes the schedule column which is unlikely to be used.

----

Paste the below code into the ''Patch Contents'' box.

Add a description such as 'Remove schedule and add limiters Firewall UI' in the ''Description'' box.

Set ''Path Strip Count'' to '0'.

''Base Directory'' to '/usr/local/www/'.

<pre>--- firewall_rules.php 2022-09-28 20:57:55.827968000 +0100
+++ firewall_rules.php 2022-09-28 20:55:22.694754000 +0100
@@ -405,8 +405,7 @@
<th><?=gettext("Destination")?></th>
<th><?=gettext("Port")?></th>
<th><?=gettext("Gateway")?></th>
- <th><?=gettext("Queue")?></th>
- <th><?=gettext("Schedule")?></th>
+ <th><?=gettext("Limiter")?></th>
<th><?=gettext("Description")?></th>
<th><?=gettext("Actions")?></th>
</tr>
@@ -859,26 +858,20 @@
</td>
<td>
<?php
- if (isset($filterent['ackqueue']) && isset($filterent['defaultqueue'])) {
- $desc = str_replace('_', ' ', $filterent['ackqueue']);
- echo "<a href=\"firewall_shaper_queues.php?queue={$filterent['ackqueue']}&action=show\">{$desc}</a>";
- $desc = str_replace('_', '_', $filterent['defaultqueue']);
- echo "/<a href=\"firewall_shaper_queues.php?queue={$filterent['defaultqueue']}&action=show\">{$desc}</a>";
- } else if (isset($filterent['defaultqueue'])) {
- $desc = str_replace('_', '_', $filterent['defaultqueue']);
- echo "<a href=\"firewall_shaper_queues.php?queue={$filterent['defaultqueue']}&action=show\">{$desc}</a>";
+ if (isset($filterent['pdnpipe']) && isset($filterent['dnpipe'])) {
+ $desc = str_replace('_', ' ', $filterent['pdnpipe']);
+ echo "<a href=\"firewall_shaper_vinterface.php\">{$desc}</a>";
+ $desc = str_replace('_', '_', $filterent['dnpipe']);
+ echo "/<a href=\"firewall_shaper_vinterface.php\">{$desc}</a>";
+ } else if (isset($filterent['dnpipe'])) {
+ $desc = str_replace('_', '_', $filterent['dnpipe']);
+ echo "<a href=\"firewall_shaper_vinterface.php\">{$desc}</a>";
} else {
echo gettext("none");
}
?>
</td>
<td>
- <?php if ($printicon) { ?>
- <?=$dispcolor?>" title="<?=$alttext;?>">
- <?php } ?>
- <?=$schedule_span_begin;?><?=str_replace('_', '_', htmlspecialchars($filterent['sched']));?> <?=$schedule_span_end;?>
- </td>
- <td>
<?=htmlspecialchars($filterent['descr']);?>
</td>
<td class="action-icons">,</pre>

2023-06-05T10:40:52Z

Chrysalis:

== pfSense patches contributed by the kitz community ==

'''WORK IN PROGRESS'''.

The following patches have been created to work on pfSense version 2.6.0. They are added or amended as ''Custom System Patches'' in the ''System Patches'' package on pfSense, there is information about this below the list of patches.

*[[LimitersFW_patch|Remove Schedule from Firewall GUI and also replace Queues with Limiters]]
*[[DiagLimiters_patch|Improved Limiters information page layout]]
*[[servicecyclev4_patch|Only cycle services on IP change IPv4]]
*[[servicecyclev6_patch|Only cycle services on IP change IPv6]]

----

To use patches on pfSense you first need to install the ''System Patches'' package, this can be installed in the following way.

1 - First login to pfSense. 
2 - Second click on the ''System'' pulldown menu on the top bar and select Package Manager. 
[[File:PFpackagemanager.png]] 
3 - Select ''Available Packages''. 
[[File:pfavailablepackages.png]] 
4 - You should see a list of packages appear on the screen. 
5 - Scroll down to the ''System Patches'' package and then click on the green install button on the right. 
[[File:pfsystempatches.png]] 
[[File:pfinstall.png]] 
6 - After a delay the package should be installed. 

Now with the ''System Patches'' package installed there wont be any patches installed by default, this package just facilitates easy patch management.

The interface can be accessed first by clicking the ''System'' pulldown menu again, then by clicking ''patches'' on the menu.

At this point there will be two boxes.

The top box will be titled ''Custom System Patches''. 
[[File:pfcustompatches.png]] 
The bottom box will be titled ''Recommended System Patches for Netgate pfSense® software version 2.6.0''. 
[[File:pfreccomendedpatches.png]] 

The bottom box is akin to hotfixes. These patches are made by contributors to pfSense code and are things that will be patched in the next release of pfSense. But have been deemed important enough to backport to 2.6.0 via a hotfix.

To install any of these recommended system patches, you just need to click the blue ''Apply'' button, they can be safely reverted by clicking the blue ''Revert'' button. The blue ''View'' button allows you to view the patch code, and the blue ''Debug'' button confirms if the patch applies cleanly or not.

One patch in this section might be considered especially useful called ''Disable pf counter data preservation to temporarily work around latency when reloading large rulesets'', this patch will prevent network drops during any firewall rule reloads.

Now on to user contributed patches.

The top box mentioned earlier titled ''Custom System Patches'' works similar once a patch has been added, it will have the same blue buttons, and the same failsafe's notably patches that dont apply cleanly will not have the option to be applied.

To add one of the patches linked to in this wiki or to make your own patch, there is a green button labelled ''Add New Patch''.

Patches will be added here on the next revision of this page.