Firewall on Holmq.dk

Caddy + GeoIP + Fail2Ban (Pushover) — Setup Notes

Tue, 27 Jan 2026 13:50:37 +0100

This document describes:

Building a custom Caddy container image with the GeoIP plugin (so Caddy can enrich access logs with country code/name). - Configuring Caddy JSON access logs to include GeoIP fields. - Setting up Fail2Ban to parse Caddy logs and send Pushover notifications with GeoIP info via mmdblookup. - Optional “SOC dashboard” style fields (severity, jail type, ban time, until).

DHCP over Route-Based IPSec in Sophos Firewal

Wed, 19 Mar 2025 15:15:51 +0100

Set up Sophos Firewall as a DHCP relay to forward client requests to a central DHCP server via a route-based IPsec VPN.

Anycast DNS PfSense

Mon, 15 Apr 2024 11:33:04 +0200

Ubuntu Anycast DNS Server with BGP announcement to pfSense

Update Tailscale on GLiNet AXT-1800

Sun, 10 Mar 2024 11:35:45 +0100

How to upgrade tailscale on GL-iNet AXT-1800

IPtables

Tue, 06 Feb 2024 10:08:29 +0100

## Set default policies
iptables -P INPUT DROP
iptables -P FOWARD DROP
iptables -P OUTPUT DROP

## Allow traffic to and from the loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

## Allow outbound connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## Allow others to ping this machine
iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## Ratelimit incomming SSH connections
iptables -A INPUT -p tcp --dport ssh -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
iptabes -A INPUT -p tcp --dport ssh -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport ssh -m state --state NEW -j ACCEPT

## Save rules on Debian/Ubuntu
apt install iptables-persistent
netfilter-persistent save

## Save rules on RHEL
chkconfig iptables on
service iptables save

General network settings

## Drop ICMP echo-request messages. Setting net.ipv4.icmp_echo_ignore_broadcasts to 1 will cause the system to ignore all ICMP echo and timestamp requests to broadcast and multicast addresses
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

## Drop source routed packets. Source routing allows a sender to partially or fully specify the route packets take through a network. In contrast, non-source routed packets travel a path determined by routers in the network.
sysctl -w net.ipv4.conf.all.accept_source_route=0
sysctl -w net.ipv6.conf.all.accept_source_route=0

## Enable TCP SYN cookie protection from SYN floods. Attackers use SYN flood attacks to perform a denial of service attacked on a system by sending many SYN packets without completing the three way handshake
sysctl -w net.ipv4.tcp_syncookie=1

## Don't accept ICMP redirect messages. Attackers could use bogus ICMP redirect messages to maliciously alter the system routing tables and get them to send packets to incorrect networks and allow your system packets to be captured
sysctl -w net.ipv4.conf.all.accept_redirects=0
sysctl -w net.ipv6.conf.all.accept_redirects=0
 
## Don't send ICMP redirect messages.
syctl -w net.ipv4.conf.all.send_redirects=0

## Enable Reverse Path Filtering. Essentially, with reverse path filtering, if the return packet does not go out the same interface that the corresponding source packet came from, the packet is dropped (and logged if log_martians is set)
sysctl -w net.ipv4.conf.all.rp_filter=1
 
## Log packets with wrong source addresses
sysctl -w net.ipv4.conf.interface.log_martians=1

VPN with overlapping networks

Mon, 28 Aug 2023 11:19:48 +0200

I recently needed to create a new site to site VPN, but there was a few challenges to this. First of all the router of the new site is behind NAT and it would be moved to other physical locations everynow and then. I needed something that works both behind NAT and initiates the connection, that’s when I started to think about wireguard. I have used wireguard in the past, so it wasn’t exactly new to me.

Speedtest using curl

Fri, 14 Jul 2023 11:48:28 +0200

Run a speedtest using CLI

VyOS - Hiper IPv6

Fri, 14 Jul 2023 10:48:26 +0200

IPv6 on VyOS with danish ISP Hiper

Running Cloudflared on VyOS

Mon, 10 Jul 2023 10:34:58 +0200

Run cloudflared as a container in VyOS

Sophos XG CLI Diagnostics

Thu, 04 May 2023 15:14:46 +0200

From the console of Sophos XG.

Cloudflared on pfSense - Part 2

Wed, 08 Mar 2023 09:26:10 +0100

This is an update to my original post about cloudflared installation on pfSense

Build VyOS From Source

Mon, 03 Oct 2022 13:05:02 +0200

Brief demonstation on how to build VyOS from source

DNS over HTTPS in VyOS

Mon, 03 Oct 2022 10:13:52 +0200

This is instructions for running DNS over HTTPS on your VyOS router, by using Cloudflare Tunnel

Install Cloudflared on pfSense

Fri, 16 Sep 2022 10:05:32 +0200

NOTE: Remember to create a backup before you proceed!

Start by editing /usr/local/etc/pkg/repos/pfsense.repo and change the first line so it looks like this

FreeBSD: {
 url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest",
 mirror_type: "srv",
 signature_type: "fingerprints",
 fingerprints: "/usr/share/keys/pkg",
 enabled: yes
}

Install Cloudflared

pkg install cloudflared

Output:

[22.05-RELEASE]/root: pkg install cloudflared
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
New version of pkg detected; it needs to be installed first.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
	pkg: 1.17.5_2 -> 1.18.4 [FreeBSD]

Number of packages to be upgraded: 1

The process will require 15 MiB more space.
7 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching pkg-1.18.4.pkg: 100% 7 MiB 7.7MB/s 00:01 
Checking integrity... done (0 conflicting)
[1/1] Upgrading pkg from 1.17.5_2 to 1.18.4...
[1/1] Extracting pkg-1.18.4: 100%
You may need to manually remove /usr/local/etc/pkg.conf if it is no longer needed.
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 22 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	brotli: 1.0.9,1 [FreeBSD]
	cloudflared: 2022.7.1_2 [FreeBSD]
	fontconfig: 2.14.0,1 [FreeBSD]
	freetype2: 2.12.1_2 [FreeBSD]
	gdbm: 1.23 [FreeBSD]
	giflib: 5.2.1 [FreeBSD]
	gmp: 6.2.1 [FreeBSD]
	graphite2: 1.3.14 [FreeBSD]
	jbigkit: 2.1_1 [FreeBSD]
	jpeg-turbo: 2.1.4 [FreeBSD]
	libdeflate: 1.13 [FreeBSD]
	libfontenc: 1.1.4 [FreeBSD]
	libsodium: 1.0.18 [FreeBSD]
	libunwind: 20211201_1 [FreeBSD]
	libyaml: 0.2.5 [FreeBSD]
	lua53: 5.3.6 [FreeBSD]
	nettle: 3.8.1 [FreeBSD]
	pixman: 0.40.0_1 [FreeBSD]
	png: 1.6.37_1 [FreeBSD]
	tcl86: 8.6.12 [FreeBSD]
	tiff: 4.4.0 [FreeBSD]
	zstd: 1.5.2_1 [FreeBSD]

Number of packages to be installed: 22

The process will require 71 MiB more space.
16 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/22] Fetching freetype2-2.12.1_2.pkg: 100% 1 MiB 1.1MB/s 00:01 
[2/22] Fetching nettle-3.8.1.pkg: 100% 1 MiB 1.4MB/s 00:01 
[3/22] Fetching giflib-5.2.1.pkg: 100% 232 KiB 237.5kB/s 00:01 
[4/22] Fetching graphite2-1.3.14.pkg: 100% 100 KiB 102.2kB/s 00:01 
[5/22] Fetching gdbm-1.23.pkg: 100% 208 KiB 212.9kB/s 00:01 
[6/22] Fetching libunwind-20211201_1.pkg: 100% 127 KiB 130.3kB/s 00:01 
[7/22] Fetching zstd-1.5.2_1.pkg: 100% 587 KiB 601.3kB/s 00:01 
[8/22] Fetching brotli-1.0.9,1.pkg: 100% 355 KiB 363.7kB/s 00:01 
[9/22] Fetching fontconfig-2.14.0,1.pkg: 100% 455 KiB 465.7kB/s 00:01 
[10/22] Fetching jbigkit-2.1_1.pkg: 100% 73 KiB 74.6kB/s 00:01 
[11/22] Fetching tiff-4.4.0.pkg: 100% 854 KiB 874.4kB/s 00:01 
[12/22] Fetching tcl86-8.6.12.pkg: 100% 2 MiB 2.5MB/s 00:01 
[13/22] Fetching png-1.6.37_1.pkg: 100% 290 KiB 297.2kB/s 00:01 
[14/22] Fetching jpeg-turbo-2.1.4.pkg: 100% 366 KiB 374.6kB/s 00:01 
[15/22] Fetching libyaml-0.2.5.pkg: 100% 71 KiB 72.4kB/s 00:01 
[16/22] Fetching libdeflate-1.13.pkg: 100% 74 KiB 75.7kB/s 00:01 
[17/22] Fetching lua53-5.3.6.pkg: 100% 281 KiB 288.1kB/s 00:01 
[18/22] Fetching cloudflared-2022.7.1_2.pkg: 100% 6 MiB 6.3MB/s 00:01 
[19/22] Fetching libfontenc-1.1.4.pkg: 100% 19 KiB 19.9kB/s 00:01 
[20/22] Fetching gmp-6.2.1.pkg: 100% 477 KiB 488.4kB/s 00:01 
[21/22] Fetching pixman-0.40.0_1.pkg: 100% 324 KiB 331.6kB/s 00:01 
[22/22] Fetching libsodium-1.0.18.pkg: 100% 263 KiB 268.9kB/s 00:01 
Checking integrity... done (0 conflicting)
[1/22] Installing brotli-1.0.9,1...
[1/22] Extracting brotli-1.0.9,1: 100%
[2/22] Installing png-1.6.37_1...
[2/22] Extracting png-1.6.37_1: 100%
[3/22] Installing freetype2-2.12.1_2...
[3/22] Extracting freetype2-2.12.1_2: 100%
[4/22] Installing zstd-1.5.2_1...
[4/22] Extracting zstd-1.5.2_1: 100%
[5/22] Installing jbigkit-2.1_1...
[5/22] Extracting jbigkit-2.1_1: 100%
[6/22] Installing jpeg-turbo-2.1.4...
[6/22] Extracting jpeg-turbo-2.1.4: 100%
[7/22] Installing libdeflate-1.13...
[7/22] Extracting libdeflate-1.13: 100%
[8/22] Installing gmp-6.2.1...
[8/22] Extracting gmp-6.2.1: 100%
[9/22] Installing nettle-3.8.1...
[9/22] Extracting nettle-3.8.1: 100%
[10/22] Installing giflib-5.2.1...
[10/22] Extracting giflib-5.2.1: 100%
[11/22] Installing graphite2-1.3.14...
[11/22] Extracting graphite2-1.3.14: 100%
[12/22] Installing gdbm-1.23...
[12/22] Extracting gdbm-1.23: 100%
[13/22] Installing libunwind-20211201_1...
[13/22] Extracting libunwind-20211201_1: 100%
[14/22] Installing fontconfig-2.14.0,1...
[14/22] Extracting fontconfig-2.14.0,1: 100%
[15/22] Installing tiff-4.4.0...
[15/22] Extracting tiff-4.4.0: 100%
[16/22] Installing tcl86-8.6.12...
[16/22] Extracting tcl86-8.6.12: 100%
[17/22] Installing libyaml-0.2.5...
[17/22] Extracting libyaml-0.2.5: 100%
[18/22] Installing lua53-5.3.6...
[18/22] Extracting lua53-5.3.6: 100%
[19/22] Installing cloudflared-2022.7.1_2...
[19/22] Extracting cloudflared-2022.7.1_2: 100%
[20/22] Installing libfontenc-1.1.4...
[20/22] Extracting libfontenc-1.1.4: 100%
[21/22] Installing pixman-0.40.0_1...
[21/22] Extracting pixman-0.40.0_1: 100%
[22/22] Installing libsodium-1.0.18...
[22/22] Extracting libsodium-1.0.18: 100%
Running fc-cache to build fontconfig cache...
=====
Message from freetype2-2.12.1_2:

--
The 2.7.x series now uses the new subpixel hinting mode (V40 port's option) as
the default, emulating a modern version of ClearType. This change inevitably
leads to different rendering results, and you might change port's options to
adapt it to your taste (or use the new "FREETYPE_PROPERTIES" environment
variable).

The environment variable "FREETYPE_PROPERTIES" can be used to control the
driver properties. Example:

FREETYPE_PROPERTIES=truetype:interpreter-version=35 \
	cff:no-stem-darkening=1 \
	autofitter:warping=1

This allows to select, say, the subpixel hinting mode at runtime for a given
application.

If LONG_PCF_NAMES port's option was enabled, the PCF family names may include
the foundry and information whether they contain wide characters. For example,
"Sony Fixed" or "Misc Fixed Wide", instead of "Fixed". This can be disabled at
run time with using pcf:no-long-family-names property, if needed. Example:

FREETYPE_PROPERTIES=pcf:no-long-family-names=1

How to recreate fontconfig cache with using such environment variable,
if needed:
# env FREETYPE_PROPERTIES=pcf:no-long-family-names=1 fc-cache -fsv

The controllable properties are listed in the section "Controlling FreeType
Modules" in the reference's table of contents
(/usr/local/share/doc/freetype2/reference/index.html, if documentation was installed).

Disable the FreeBSD repo again by setting enabled to no in /usr/local/etc/pkg/repos/pfsense.repo

FreeBSD: {
 url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest",
 mirror_type: "srv",
 signature_type: "fingerprints",
 fingerprints: "/usr/share/keys/pkg",
 enabled: no
}

Revert some of the packages to the pfSense maintained version

pkg upgrade

Output:

[22.05-RELEASE]/root: pkg update
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
[22.05-RELEASE]/root: pkg upgrade
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Checking for upgrades (13 candidates): 100%
Processing candidates (13 candidates): 100%
The following 5 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
	brotli-1.0.9,1 [pfSense] (options changed)
	giflib-5.2.1 [pfSense] (options changed)
	jbigkit-2.1_1 [pfSense] (options changed)
	libsodium-1.0.18 [pfSense] (options changed)
	lua53-5.3.6 [pfSense] (options changed)

Number of packages to be reinstalled: 5

The operation will free 1 MiB.
899 KiB to be downloaded.

Proceed with this action? [y/N]: y
[1/5] Fetching lua53-5.3.6.pkg: 100% 196 KiB 200.4kB/s 00:01 
[2/5] Fetching giflib-5.2.1.pkg: 100% 71 KiB 73.1kB/s 00:01 
[3/5] Fetching brotli-1.0.9,1.pkg: 100% 352 KiB 360.7kB/s 00:01 
[4/5] Fetching libsodium-1.0.18.pkg: 100% 215 KiB 220.1kB/s 00:01 
[5/5] Fetching jbigkit-2.1_1.pkg: 100% 65 KiB 66.1kB/s 00:01 
Checking integrity... done (0 conflicting)
[1/5] Reinstalling lua53-5.3.6...
[1/5] Extracting lua53-5.3.6: 100%
[2/5] Reinstalling giflib-5.2.1...
[2/5] Extracting giflib-5.2.1: 100%
[3/5] Reinstalling brotli-1.0.9,1...
[3/5] Extracting brotli-1.0.9,1: 100%
[4/5] Reinstalling libsodium-1.0.18...
[4/5] Extracting libsodium-1.0.18: 100%
[5/5] Reinstalling jbigkit-2.1_1...
[5/5] Extracting jbigkit-2.1_1: 100%

cloudflared can be found in /usr/local/bin/cloudflared

Restart Sophos XG SSL VPN

Tue, 14 Sep 2021 00:00:00 +0000

From the console of Sophos XG.

Sophos XG v18 CLI Commands

Tue, 13 Apr 2021 00:00:00 +0000

5. Device Management > 3. Advanced Shell

Hiper IPv6 configuration on pfSense

Thu, 26 Mar 2020 00:00:00 +0000

Den danske ISP Hiper tilbyder sine DSL og Fiberkunder en /48 (65536 net, så det burde være rigeligt) native IPv6 adresser. Hiper tilbyder også at man kan benytte sin egen router i stedet for den Zyxel router de udleverer. For at bruge sin egen router skal man konfigurere sit WAN interface med VLAN 101 tagged. Se mere her https://www.hiper.dk/bredbaand/fiber

Sophos XG v18 Webinar

Mon, 18 Nov 2019 00:00:00 +0000

Sophos recently hosted a webinar with some updates to their version 18 EAP.