Messages

16

17.1 Legacy Series / Re: collectd network plugin is missing encryption support

« on: May 22, 2017, 02:24:38 pm »

Here's ldd after install:

Code: [Select]

root@blackbox:/usr/ports/net-mgmt/collectd5 # ldd /usr/local/sbin/collectd������ /usr/local/sbin/collectd:
        libm.so.5 => /lib/libm.so.5 (0x3442ba34000)
        libthr.so.3 => /lib/libthr.so.3 (0x3442bc5f000)
        libstatgrab.so.10 => /usr/local/lib/libstatgrab.so.10 (0x3442be87000)
        libdevstat.so.7 => /lib/libdevstat.so.7 (0x3442c099000)
        libltdl.so.7 => /usr/local/lib/libltdl.so.7 (0x3442c29f000)
        libc.so.7 => /lib/libc.so.7 (0x3442af14000)
        libkvm.so.7 => /lib/libkvm.so.7 (0x3442c4a8000)
        libelf.so.2 => /lib/libelf.so.2 (0x3442c6b7000)
You're right, there is no gcrypt support (nor shown in pkg info as well). However, encryption support is working fine. Perhaps there's multiple libraries it can use to support it, but I'm not finding anything obvious. I'd probably lean towards enabling gcrypt just to match what previous builds did.

I have a cron job for a nightly firmware upgrade. It looks like collectd has been replaced by the binary version on me from the repos. I thought I locked the package after install, but perhaps I didn't. Is there anything else to do when installing ports to keep them in place?

17

17.1 Legacy Series / Are backups of "volatile" files required on reboots for non-nano installs?

« on: May 21, 2017, 02:35:43 am »

I have OPNsense installed on a 16GB SSD. I noticed that reboots were taking a long time. It turns out the culprit was the netflow database; gzip'ing was taking 5-10 minutes, blocking a reboot. This commit illustrates the code fairly well. Any reason I can't just comment them out?

18

17.1 Legacy Series / Re: collectd network plugin is missing encryption support

« on: May 18, 2017, 10:45:50 pm »

Turns out that running the build from 16.7 didn't throw any errors, but did send wrong data in the networking plugin. Following https://forum.opnsense.org/index.php?topic=2004 I installed collectd from ports and crypt support is working fine.

19

17.1 Legacy Series / Re: dhclient exits on WAN IP renewal

« on: May 11, 2017, 08:15:34 pm »

It looks like this is still an issue on 17.1.6. Is there an upstream issue I can track?

20

17.1 Legacy Series / [SOLVED] collectd network plugin is missing encryption support

« on: May 10, 2017, 07:40:51 pm »

collectd has been broken for the past week, as the network plugin is no longer linked to libgcrypt and libgpg-error.

Code: [Select]

May 10 13:22:32 blackbox collectd[32863]: network plugin: Option `SecurityLevel' is not allowed here.
May 10 13:22:32 blackbox collectd[32863]: network plugin: Option `Username' is not allowed here.
May 10 13:22:32 blackbox collectd[32863]: network plugin: Option `Password' is not allowed here.
I manually installed collectd 5.7.0 from 16.7 as I couldn't find prior builds for 17.1. That version has:

Code: [Select]

root@blackbox:/tmp # ldd /usr/local/lib/collectd/network.so
/usr/local/lib/collectd/network.so:
libgcrypt.so.20 => /usr/local/lib/libgcrypt.so.20 (0x3482980b000)
libgpg-error.so.0 => /usr/local/lib/libgpg-error.so.0 (0x34829b1d000)
libc.so.7 => /lib/libc.so.7 (0x34828dfa000)
And in the latest 5.7.1 release:

Code: [Select]

root@blackbox:/usr/local/etc # ldd /usr/local/lib/collectd/network.so
/usr/local/lib/collectd/network.so:
libc.so.7 => /lib/libc.so.7 (0x205546c4000)
For now, I've locked the older package, though if there's prior builds actually against 17.1 I can install that would be better. Or, is there a way to simply blacklist the specific release of collectd, so when a new (presumably fixed) version is out it will be upgraded to automatically?

21

17.1 Legacy Series / Starting flowd_aggregate: eval: -repeater_opnsense_bootup_run: not found

« on: April 04, 2017, 08:39:06 pm »

On bootup, I get the following:

Starting flowd_aggregate.
eval: -repeater_opnsense_bootup_run: not found

And, if I manually start flowd_aggregate, I get this in system.log:

Apr  4 14:37:27 blackbox flowd_aggregate.py: flowd aggregate died with message Traceback (most recent call last):   File "/usr/local/opnsense/scripts/netflow/flowd_aggregate.py", line 148, in run     aggregate_flowd(do_vacuum)   File "/usr/local/opnsense/scripts/netflow/flowd_aggregate.py", line 67, in aggregate_flowd     for flow_record in parse_flow(prev_recv):   File "/usr/local/opnsense/scripts/netflow/lib/parse.py", line 92, in parse_flow     for flow in flog: ValueError: Unsupported version

Of course, this left me running out of disk space and my router crashing various processes.

Is there a way to limit the flowd.log file, even if flowd_aggregate isn't running?

22

17.1 Legacy Series / Re: dhclient exits on WAN IP renewal

« on: March 21, 2017, 10:02:48 pm »

Here you go, running the patch linked to above. There's nothing logged in igb1_error_output.

==> igb1_output <==
dhclient: PREINIT
dhclient: Starting delete_old_states()
dhclient: Comparing IPs: Old: XXX.XXX.XXX.XXX New:
dhclient: Removing states from old IP 'XXX.XXX.XXX.XXX' (new IP '')
0 states cleared
killed 0 src nodes from 1 sources and 0 destinations
DHCPREQUEST on igb1 to 255.255.255.255 port 67
DHCPNAK from 192.168.100.1
DHCPDISCOVER on igb1 to 255.255.255.255 port 67 interval 2
DHCPOFFER from 192.168.100.1
DHCPREQUEST on igb1 to 255.255.255.255 port 67
DHCPACK from 192.168.100.1
bound to 192.168.100.10 -- renewal in 30 seconds.
dhclient already running, pid: 92123.
exiting.


# Here's where I clicked renew in the web UI for the interface

dhclient: PREINIT
dhclient: Starting delete_old_states()
dhclient: Comparing IPs: Old: XXX.XXX.XXX.XXX New:
dhclient: Removing states from old IP 'XXX.XXX.XXX.XXX' (new IP '')
0 states cleared
killed 0 src nodes from 1 sources and 0 destinations
DHCPREQUEST on igb1 to 255.255.255.255 port 67
DHCPACK from XXX.XXX.XXX.XXX
bound to XXX.XXX.XXX.XXX -- renewal in 55164 seconds.

23

17.1 Legacy Series / Re: dhclient exits on WAN IP renewal

« on: March 19, 2017, 04:57:21 am »

Turns out I wasn't subscribed to this thread

Anyways, I applied the patch above, rebooted, and it didn't fix things for me. Same logs from dhclient.

Aside, nice utility with the opnsense-patch command. Running the same command again is a nice easy way to revert the patch.

24

17.1 Legacy Series / dhclient exits on WAN IP renewal

« on: March 03, 2017, 02:26:43 am »

I'm running OPNsense 17.1.2 with a cable modem for the WAN, and I've run into issues when the modem does a fresh boot.

I imagine the way the modem (a Thomson DCM476) works is pretty common. On first boot, it issues a private IP, such as 192.168.100.1. That way, you can easily get to the status pages in case there's trouble getting modem sync. Once sync is detected, it passes DHCP through to the ISP. The initial lease has a 30 second expiry.

It's during this second phase that dhclient fails. Here's the logs from /tmp/igb1*:

==> igb1_output <==
dhclient: PREINIT
dhclient: Starting delete_old_states()
dhclient: Comparing IPs: Old: XXX.XXX.XXX.XXX New:
dhclient: Removing states from old IP 'XXX.XXX.XXX.XXX' (new IP '')
0 states cleared
killed 0 src nodes from 1 sources and 0 destinations
DHCPREQUEST on igb1 to 255.255.255.255 port 67
DHCPNAK from 192.168.100.1
DHCPDISCOVER on igb1 to 255.255.255.255 port 67 interval 1
DHCPOFFER from 192.168.100.1
DHCPREQUEST on igb1 to 255.255.255.255 port 67
DHCPACK from 192.168.100.1

==> igb1_router <==
192.168.100.1

==> igb1_output <==
bound to 192.168.100.10 -- renewal in 30 seconds.

==> igb1_router <==
XXX.XXX.XXX.XXX

==> igb1_output <==
dhclient already running, pid: 83190.
exiting.

And in syslog:

opnsense: /usr/local/etc/rc.linkup: The command '/sbin/dhclient -c /var/etc/dhclient_wan.conf igb1 > /tmp/igb1_output 2> /tmp/igb1_error_output' returned exit code '1', the output was ''

The interface ends up marked as completely down.

If I manually renew the IP from the interfaces UI, or just run dhclient, everything works fine. Likewise, if I simply pull the ethernet cable, it renews correctly - it's only when the modem has lost sync and issues a private IP things fail.

Any suggestions?

25

16.7 Legacy Series / Re: How to set up fq_codel for QoS traffic shaping

« on: January 30, 2017, 03:44:24 am »

I was reading up and came across this post showing results over a slower DSL connection, that corresponded pretty closely to my cable connection. Luckily, my ISP redid their packages, and it was very inexpensive to go from a 25/2 to a 30/5 connection. Updated the bandwidth limits, and I'm seeing way fewer drops on the upstream:



Perhaps there's not many using OPNSense on slower connections, but I've rarely seen flent tests with less than 5MBit upstream. Anecdotally, the experience was pretty horrible on fq_codel until I had more bandwidth for it to work with. I wonder if there's some way to alert users when setting the pipe configs if they're allocating less than the scheduler needs to be effective.

26

17.1 Legacy Series / Re: [WORKAROUND] 17.1.b - Can't boot on APU2 with USB3 slot

« on: January 30, 2017, 03:35:35 am »

I found using a USB2 stick worked fine even in the USB3 slot. A good workaround for anyone who doesn't have the right cable to plug into the USB2 header.

27

16.7 Legacy Series / Re: Server setup behind a OPNsense firewall

« on: January 03, 2017, 02:06:48 am »

I just set up a port forward, though there were a few nuances to it.

For managing the IPs and addresses, assign a static IP to the server (I did a static DHCP assignment). Then, if you create an alias for it, you can easily change the IP later without having to update a bunch of firewall rules (love this!).

The destination needs to be set to WAN, and not the server you are forwarding to. It's the Redirect IP / Port rules you use for the server mapping. Also, there are settings for the Admin GUI that control the port it's listening on. You may need to move it if by "site" you mean a literal web server that you're forwarding to.

28

16.7 Legacy Series / How to set up fq_codel for QoS traffic shaping

« on: January 02, 2017, 09:07:25 pm »

I'm trying to get a reasonable QoS setup for my 25/2 cable internet connection. There's great docs for setting up regular QoS rules, but since DSCP support was removed I think I need something more robust for my needs. And, I love the idea of never having to tweak the rules for specific apps

For reference, an unshaped result from flent rrul -p all_scaled -l 60:



I then set up:

• A downstream pipe with a cap of 20600Kbps, a source mask, the FlowQueue-Codel scheduler, Codel enabled,no ECN as I read that's detrimental at under an upstream of 4Mbits.
• An upstream pipe set to 1500Kbps, with a destination mask, and the same queue and Codel settings
• No queues as my understanding from the help text is those are automatic when masks are set.
• Two rules with source and destination networks to associate traffic with each pipe.

Latency is vastly improved, though I'm curious about the spike I'm getting at the very end. What I'm more concerned about are the gaps in the upload graph. I expected with setting the pipes significantly lower than my actual connection I wouldn't see any missing traffic. They're still there even with lower caps on the pipes. I haven't seen any similar results from others, so I'm not sure how to interpret this. Any ideas?

29

17.1 Legacy Series / Re: Unable to boot with USB 3 on APU2

« on: December 30, 2016, 01:37:26 am »

It was pfSense-CE-memstick-serial-2.3.2-RELEASE-amd64.img.gz that was able to boot for me.

30

General Discussion / Serial console character settings

« on: December 24, 2016, 03:11:45 am »

What terminal type / character settings should I use with the serial console? I've tried:

• screen under OS X and Linux
• minicom under OS X and Linux
• The OS X Terminal app and iTerm2
• Serial on OS X
• Putty on Windows

The APU2 BIOS and the regular shell prompt after an install seem OK. I've tried a variety of UTF / ISO character settings, TERM=ansi, vt100, xterm. No matter what, I always get misrepresented characters in the installer menus. Putty + UTF-8 + TERM=xterm seems to be the closest, but still has some mismapped characters.

Thanks!