Messages

[checked]

If you would like to first test OPNsense in an isolated virtual environment, this is a basic guide to get you started.

This guide assumes the following:
1. You have downloaded an OPNsense ISO image; for this guide, 18.1.5 was used and tested
2. You have installed VMware Workstation; for this guide, v14 is referenced
3. You already have an active DHCP server in your network (or any working LAN and internet connection basically, adjust your OPNsense WAN interface accordingly)
4. You want to isolate your new OPNsense-controlled test network so that it will not interfere with your current one. For this, we will also use/need another VM as a LAN client of the OPNsense-controlled network
5. You have enough resources on the host machine for VMware to run at least 2 VMs. For the OPNsense machine, please refer to https://wiki.opnsense.org/manual/hardware.html. For your other VM, please refer to your other OS requirements


VMware environment setup:
1. You will need to create an isolated LAN network serving as the OPNsense LAN network. The DHCP server of your virtual LAN network will run on a custom interface, part of this network, making sure your OPNsense LAN clients will automatically receive an IP address
- open VMware and go to Edit -> Virtual Network Editor
- click on Add Network and create a new interface; select "Host-only", making sure "Connect a host virtual network adapter" is checked and "Use local DHCP service..." is unchecked
- for Subnet IP and Subnet mask use something it's not used anywhere in your actual network. If your actual network uses 192.168.100.1/24 for example, you can use 192.168.10.0/255.255.255.0 here
- click OK to add the interface
- select the newly created interface from the list then click on "Rename network" to something easy to identify, like "OPNsense LAN"
2. Create a new virtual machine:
- select Custom configuration
- select the OPNsense ISO you downloaded
- configure at least 2 CPU cores and 4gb RAM for the OPNsense vm
- select "Use bridged networking" for the network type
- the last config window will display a summary of your VM and has a "Customize hardware" button; click on it and add a new network adapter and click "Finish" to add the adapter
3. Uncheck "Power on this VM after creation" and click "Finish" once again
4. Go to VMware -> VM -> Settings:
- make sure your first network adapter is set on "bridged"; select this network adapter and go to "Advanced" and write down the MAC address of this adapter, then click on OK or Cancel (we just need the MAC). This will be the WAN of your OPNsense VM
- go to your second network adapter and instead of "bridged" or whatever is its default, select "custom" and from the drop-down menu select "OPNsense LAN (Host-only)", then go to "Advanced" and write down the MAC address of this adapter as well
- save all settings power up the vm and create your OPNsense VM


Install OPNsense on the VM:
1. Power it up and install OPNsense referring to https://wiki.opnsense.org/manual/install.html
2. After installation, hit any key when prompted to manually assign interfaces and type in the interface corresponding to the MAC address intended for the WAN interface, then for the LAN interface
3. After OPNsense fully boots and prompts for credentials, reboot (option #6 from the console menu)
4. After the reboot, login and select option #12 (Upgrade from console)
5. Reboot once more it will not reboot automatically


Create and/or edit an existing VM serving as a LAN client for your new OPNsense network:
1. If you already have a VM, select it and go to VMware -> VM -> Settings
2. Edit your existing network adapter, select "Custom (specific virtual network)" and from the drop-down menu select "OPNsense LAN (Host-only)"
3. If you have no VM to edit, create one using the OS of your preference, making sure its network adapter has the "OPNsense LAN (Host-only)" network connection selected
4. Power up / create this VM as well


Verify your setup:
1. Make sure you have a working internet connection on your new OPNsense VM and its LAN client (ping, traceroute, web etc.)
2. Make sure you can load the OPNsense WebGUI and log on (by default, its address is http://192.168.1.1/)
3. To access the OPNsense WebGUI from your "real" network (aka your actual LAN network which is the WAN network of the OPNsense VM), you have to allow private/bogon networks on the WAN interface of the OPNsense VM and add rules to allow access to the WebGUI and/or ssh from the WAN interface of OPNsense
4. If everything works, power off your OPNsense VM and create a snapshot; you can always return to it as a basic setup if you break something while testing


Good luck!

Updated to 18.1.5 and applied the patch.
And it works!

Thank you Franco, well done!

Btw, it's "opnsense-patch", right? :)

You probably can (the options are there), with custom rules. Check out "source and destination" here: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Rules

And how to create custom rules here: https://forum.opnsense.org/index.php?topic=7209.0

Please note that I have never tried this, don't actually know if it works.

A lot of things changed sinced then. Maybe you could try the latest 18.1.5?

Indeed, I will update the post soon :)

FreeBSD has a very poor support for WiFi stuff. My advice would be to use APs if possible.

Does this works if you try all your lines separately/individually? Or, better said, all your links work if you try them one by one?

This is mine with the rules enabled (and set to drop): http://www.dslreports.com/speedtest/31261479

I get way better results with HTTP, and if nothing changed, we have the same ISP and link (speed-wise). But this might be normal (?).

Great to hear you got this fixed!
You can just rename the title and prepend [Solved] :)

Yep, 18.1.4 works fine after a reboot. Rebooted 3 times, no issues.
The downgrade was performed in a matter of seconds. At first, i believed it failed because of the speed, but the GUI is showing that I'm on 18.1.4. So i think it worked. Anyway, rebooting no longer breaks internet connectivity on the LAN side, so there's something probably incompatible with my @$&43#_-;!!?: PPPoE link and OPNsense 18.1.5.

I really like the new kernel. Despite the slightly higher CPU usage, it is very snappy and everything is just very fast.

Actually, a lot changed on the stack, judging by the changelog... will take the opportunity to underline (once more) the importance of a stable/better tested (by the community as well) release channel.

No, it's not my case. I think something changed in the network stack (just a hunch).
But thanks anyway.

I do have OpenVPN.
I didn't have gateway monitoring at the beginning. I enabled it later, to see what changes...
But having that disabled didn't work.
I'll try again...

Update: confirming that disabling gateway monitoring doesn't help... same thing

I don't know what's happening after the upgrade on my box.

So, here it goes:

1. Whenever I restart the box, I have no internet connectivity on the LAN clients; pinging from the OPNsense GUI works fine, pinging from the LAN clients (using IP or FQDN) fails
2. To make things work again on the LAN side, I have to either:
- disconnect/connect my PPPoE link (on the WAN)
- or edit the default gateway without any modification, save and apply
3. Right after the reboot, a lot of things are still loading of course, but the GUI is available at one point. When some of the services loaded (as pictured in the attached Screenshot_36.png), internet works on the LAN side. When everything is fully loaded (as pictured in Screenshot_37.png) internet on the LAN side no longer works
4. Sometimes I can't even ssh to the box from the LAN if I don't reconnect the WAN to fix the internet connectivity (something is not binding to some interfaces, I guess)

Errors in the log:
Line 63: Mar 22 19:40:49 gateway kernel: module_register_init: MOD_LOAD (vesa, 0xffffffff810ab110, 0) error 19
Line 97: Mar 22 19:40:49 gateway kernel: pcib0: _OSC returned error 0x10
and a bunch of "Line 268: Mar 22 19:40:54 gateway sshd[48206]: error: Bind to port 22 on ... failed: Can't assign requested address."

I already tried a clean install, which in my case is a pain in the *ss:
1. Install 17.7.5 first, because I get the segmentation fault error with 18.1
2. Upgrade to the latest version
3. Install plugins
4. Restore backup

You could also try to update to OPNsense 18.1.5 having these updates (regarding OpenVPN):

o openvpn: switch status to version 3 to avoid wrong parsing of commas
o openvpn: parse all states to retrieve all relevant connection status info
o ports: openvpn 2.4.5[9]

Works fine for me so far (OpenVPN related stuff). I think i have some IPv6 issues, but unsure if it's because of the update.