Cloudflared on pfSense - Part 2

Wed, 08 Mar 2023 09:26:10 +0100

This is an update to my original post about cloudflared installation on pfSense

Secure RDP with Cloudflare Zero Trust

Mon, 24 Oct 2022 09:52:01 +0200

You can use a Cloudflare Tunnel to securely access your Windows machine remotely.

DNS over HTTPS in VyOS

Mon, 03 Oct 2022 10:13:52 +0200

This is instructions for running DNS over HTTPS on your VyOS router, by using Cloudflare Tunnel

Install Cloudflared on pfSense

Fri, 16 Sep 2022 10:05:32 +0200

NOTE: Remember to create a backup before you proceed!

Start by editing /usr/local/etc/pkg/repos/pfsense.repo and change the first line so it looks like this

FreeBSD: {
 url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest",
 mirror_type: "srv",
 signature_type: "fingerprints",
 fingerprints: "/usr/share/keys/pkg",
 enabled: yes
}

Install Cloudflared

pkg install cloudflared

Output:

[22.05-RELEASE]/root: pkg install cloudflared
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
New version of pkg detected; it needs to be installed first.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
	pkg: 1.17.5_2 -> 1.18.4 [FreeBSD]

Number of packages to be upgraded: 1

The process will require 15 MiB more space.
7 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching pkg-1.18.4.pkg: 100% 7 MiB 7.7MB/s 00:01 
Checking integrity... done (0 conflicting)
[1/1] Upgrading pkg from 1.17.5_2 to 1.18.4...
[1/1] Extracting pkg-1.18.4: 100%
You may need to manually remove /usr/local/etc/pkg.conf if it is no longer needed.
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 22 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	brotli: 1.0.9,1 [FreeBSD]
	cloudflared: 2022.7.1_2 [FreeBSD]
	fontconfig: 2.14.0,1 [FreeBSD]
	freetype2: 2.12.1_2 [FreeBSD]
	gdbm: 1.23 [FreeBSD]
	giflib: 5.2.1 [FreeBSD]
	gmp: 6.2.1 [FreeBSD]
	graphite2: 1.3.14 [FreeBSD]
	jbigkit: 2.1_1 [FreeBSD]
	jpeg-turbo: 2.1.4 [FreeBSD]
	libdeflate: 1.13 [FreeBSD]
	libfontenc: 1.1.4 [FreeBSD]
	libsodium: 1.0.18 [FreeBSD]
	libunwind: 20211201_1 [FreeBSD]
	libyaml: 0.2.5 [FreeBSD]
	lua53: 5.3.6 [FreeBSD]
	nettle: 3.8.1 [FreeBSD]
	pixman: 0.40.0_1 [FreeBSD]
	png: 1.6.37_1 [FreeBSD]
	tcl86: 8.6.12 [FreeBSD]
	tiff: 4.4.0 [FreeBSD]
	zstd: 1.5.2_1 [FreeBSD]

Number of packages to be installed: 22

The process will require 71 MiB more space.
16 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/22] Fetching freetype2-2.12.1_2.pkg: 100% 1 MiB 1.1MB/s 00:01 
[2/22] Fetching nettle-3.8.1.pkg: 100% 1 MiB 1.4MB/s 00:01 
[3/22] Fetching giflib-5.2.1.pkg: 100% 232 KiB 237.5kB/s 00:01 
[4/22] Fetching graphite2-1.3.14.pkg: 100% 100 KiB 102.2kB/s 00:01 
[5/22] Fetching gdbm-1.23.pkg: 100% 208 KiB 212.9kB/s 00:01 
[6/22] Fetching libunwind-20211201_1.pkg: 100% 127 KiB 130.3kB/s 00:01 
[7/22] Fetching zstd-1.5.2_1.pkg: 100% 587 KiB 601.3kB/s 00:01 
[8/22] Fetching brotli-1.0.9,1.pkg: 100% 355 KiB 363.7kB/s 00:01 
[9/22] Fetching fontconfig-2.14.0,1.pkg: 100% 455 KiB 465.7kB/s 00:01 
[10/22] Fetching jbigkit-2.1_1.pkg: 100% 73 KiB 74.6kB/s 00:01 
[11/22] Fetching tiff-4.4.0.pkg: 100% 854 KiB 874.4kB/s 00:01 
[12/22] Fetching tcl86-8.6.12.pkg: 100% 2 MiB 2.5MB/s 00:01 
[13/22] Fetching png-1.6.37_1.pkg: 100% 290 KiB 297.2kB/s 00:01 
[14/22] Fetching jpeg-turbo-2.1.4.pkg: 100% 366 KiB 374.6kB/s 00:01 
[15/22] Fetching libyaml-0.2.5.pkg: 100% 71 KiB 72.4kB/s 00:01 
[16/22] Fetching libdeflate-1.13.pkg: 100% 74 KiB 75.7kB/s 00:01 
[17/22] Fetching lua53-5.3.6.pkg: 100% 281 KiB 288.1kB/s 00:01 
[18/22] Fetching cloudflared-2022.7.1_2.pkg: 100% 6 MiB 6.3MB/s 00:01 
[19/22] Fetching libfontenc-1.1.4.pkg: 100% 19 KiB 19.9kB/s 00:01 
[20/22] Fetching gmp-6.2.1.pkg: 100% 477 KiB 488.4kB/s 00:01 
[21/22] Fetching pixman-0.40.0_1.pkg: 100% 324 KiB 331.6kB/s 00:01 
[22/22] Fetching libsodium-1.0.18.pkg: 100% 263 KiB 268.9kB/s 00:01 
Checking integrity... done (0 conflicting)
[1/22] Installing brotli-1.0.9,1...
[1/22] Extracting brotli-1.0.9,1: 100%
[2/22] Installing png-1.6.37_1...
[2/22] Extracting png-1.6.37_1: 100%
[3/22] Installing freetype2-2.12.1_2...
[3/22] Extracting freetype2-2.12.1_2: 100%
[4/22] Installing zstd-1.5.2_1...
[4/22] Extracting zstd-1.5.2_1: 100%
[5/22] Installing jbigkit-2.1_1...
[5/22] Extracting jbigkit-2.1_1: 100%
[6/22] Installing jpeg-turbo-2.1.4...
[6/22] Extracting jpeg-turbo-2.1.4: 100%
[7/22] Installing libdeflate-1.13...
[7/22] Extracting libdeflate-1.13: 100%
[8/22] Installing gmp-6.2.1...
[8/22] Extracting gmp-6.2.1: 100%
[9/22] Installing nettle-3.8.1...
[9/22] Extracting nettle-3.8.1: 100%
[10/22] Installing giflib-5.2.1...
[10/22] Extracting giflib-5.2.1: 100%
[11/22] Installing graphite2-1.3.14...
[11/22] Extracting graphite2-1.3.14: 100%
[12/22] Installing gdbm-1.23...
[12/22] Extracting gdbm-1.23: 100%
[13/22] Installing libunwind-20211201_1...
[13/22] Extracting libunwind-20211201_1: 100%
[14/22] Installing fontconfig-2.14.0,1...
[14/22] Extracting fontconfig-2.14.0,1: 100%
[15/22] Installing tiff-4.4.0...
[15/22] Extracting tiff-4.4.0: 100%
[16/22] Installing tcl86-8.6.12...
[16/22] Extracting tcl86-8.6.12: 100%
[17/22] Installing libyaml-0.2.5...
[17/22] Extracting libyaml-0.2.5: 100%
[18/22] Installing lua53-5.3.6...
[18/22] Extracting lua53-5.3.6: 100%
[19/22] Installing cloudflared-2022.7.1_2...
[19/22] Extracting cloudflared-2022.7.1_2: 100%
[20/22] Installing libfontenc-1.1.4...
[20/22] Extracting libfontenc-1.1.4: 100%
[21/22] Installing pixman-0.40.0_1...
[21/22] Extracting pixman-0.40.0_1: 100%
[22/22] Installing libsodium-1.0.18...
[22/22] Extracting libsodium-1.0.18: 100%
Running fc-cache to build fontconfig cache...
=====
Message from freetype2-2.12.1_2:

--
The 2.7.x series now uses the new subpixel hinting mode (V40 port's option) as
the default, emulating a modern version of ClearType. This change inevitably
leads to different rendering results, and you might change port's options to
adapt it to your taste (or use the new "FREETYPE_PROPERTIES" environment
variable).

The environment variable "FREETYPE_PROPERTIES" can be used to control the
driver properties. Example:

FREETYPE_PROPERTIES=truetype:interpreter-version=35 \
	cff:no-stem-darkening=1 \
	autofitter:warping=1

This allows to select, say, the subpixel hinting mode at runtime for a given
application.

If LONG_PCF_NAMES port's option was enabled, the PCF family names may include
the foundry and information whether they contain wide characters. For example,
"Sony Fixed" or "Misc Fixed Wide", instead of "Fixed". This can be disabled at
run time with using pcf:no-long-family-names property, if needed. Example:

FREETYPE_PROPERTIES=pcf:no-long-family-names=1

How to recreate fontconfig cache with using such environment variable,
if needed:
# env FREETYPE_PROPERTIES=pcf:no-long-family-names=1 fc-cache -fsv

The controllable properties are listed in the section "Controlling FreeType
Modules" in the reference's table of contents
(/usr/local/share/doc/freetype2/reference/index.html, if documentation was installed).

Disable the FreeBSD repo again by setting enabled to no in /usr/local/etc/pkg/repos/pfsense.repo

FreeBSD: {
 url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest",
 mirror_type: "srv",
 signature_type: "fingerprints",
 fingerprints: "/usr/share/keys/pkg",
 enabled: no
}

Revert some of the packages to the pfSense maintained version

pkg upgrade

Output:

[22.05-RELEASE]/root: pkg update
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
[22.05-RELEASE]/root: pkg upgrade
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Checking for upgrades (13 candidates): 100%
Processing candidates (13 candidates): 100%
The following 5 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
	brotli-1.0.9,1 [pfSense] (options changed)
	giflib-5.2.1 [pfSense] (options changed)
	jbigkit-2.1_1 [pfSense] (options changed)
	libsodium-1.0.18 [pfSense] (options changed)
	lua53-5.3.6 [pfSense] (options changed)

Number of packages to be reinstalled: 5

The operation will free 1 MiB.
899 KiB to be downloaded.

Proceed with this action? [y/N]: y
[1/5] Fetching lua53-5.3.6.pkg: 100% 196 KiB 200.4kB/s 00:01 
[2/5] Fetching giflib-5.2.1.pkg: 100% 71 KiB 73.1kB/s 00:01 
[3/5] Fetching brotli-1.0.9,1.pkg: 100% 352 KiB 360.7kB/s 00:01 
[4/5] Fetching libsodium-1.0.18.pkg: 100% 215 KiB 220.1kB/s 00:01 
[5/5] Fetching jbigkit-2.1_1.pkg: 100% 65 KiB 66.1kB/s 00:01 
Checking integrity... done (0 conflicting)
[1/5] Reinstalling lua53-5.3.6...
[1/5] Extracting lua53-5.3.6: 100%
[2/5] Reinstalling giflib-5.2.1...
[2/5] Extracting giflib-5.2.1: 100%
[3/5] Reinstalling brotli-1.0.9,1...
[3/5] Extracting brotli-1.0.9,1: 100%
[4/5] Reinstalling libsodium-1.0.18...
[4/5] Extracting libsodium-1.0.18: 100%
[5/5] Reinstalling jbigkit-2.1_1...
[5/5] Extracting jbigkit-2.1_1: 100%

cloudflared can be found in /usr/local/bin/cloudflared

Argo on Holmq.dk

Cloudflared on pfSense - Part 2

Secure RDP with Cloudflare Zero Trust

DNS over HTTPS in VyOS

Install Cloudflared on pfSense

NOTE: Remember to create a backup before you proceed!