{prefix}{significant destination octets}{router} per route, in hex; 0.0.0.0/0 has zero destination octets. Always include the default route in 121, because the client discards the option 3 router when it receives 121. Windows asks for it as 249 besides 121; Kea 2.4+ writes it as ‘192.0.2.0/24 - 192.168.1.254’; MikroTik as 0x… with code=121.
Logs Explorer with resource.type=vpn_gateway and the IKE status text. ‘peer not responding’ = IKE version, PSK, IP or UDP 500/4500; ’traffic selectors narrowed’ = phase 2 subnets that do not match. With pfSense and BGP: permit route maps in/out or no routes are accepted.
pfctl -sT lists tables; pfctl -t -T show|add|delete|test|flush|replace -f. On pfSense aliases are tables, sshguard is the failed-login lockout, and manual changes vanish on the next rules reload.
LAN → public IP traffic never leaves through the WAN, it dies at the firewall. Split DNS (host override → internal IP) is the clean way; Pure NAT + automatic outbound NAT for reflection when the DNS is not yours.
pkg-static does not depend on libssl and keeps working. certctl rehash, pkg-static install -fy pkg, pkg-static install -xfy pfSense-repo pfSense-upgrade, then the upgrade through System > Update, never with pkg upgrade.
Cloudflare token with Zone:Read + DNS:Edit on the zone, DNS-Cloudflare method with Token/Account ID/Zone ID, staging first, and a ‘Restart Local Service: haproxy’ action on the certificate so HAProxy reloads the new cert.
Edit the CRL under System > Certificates > Certificate Revocation, set Lifetime 730 and save: it is regenerated with valid dates. On old versions, apply the ‘Fix for CRL expiration lifetime’ patch with System Patches first.
With vtnet, FreeBSD drops packets whose checksum was never computed. Tick Disable hardware checksum offload and reboot the VM even though the GUI does not ask; until then no traffic flows.