Messages

16

19.1 Legacy Series / Re: Port Forwarding Not Working All of the Time

« on: May 30, 2019, 08:33:23 am »

Ours was a bug in the firewall related to whether or not the gateway for WAN is set to auto or not. We only have one gateway, but either way it is set can cause issues either incoming or outgoing.

17

19.1 Legacy Series / Re: Possible Routing Bug?

« on: May 27, 2019, 12:10:49 pm »

Interface : WAN set Upstream Gateway to auto-detect

This fixes the issue for us, but means it is a bug. Or at least I can't think of a reason why telling a router which gateway to use would cause it not to route (sometimes) when it's the only gateway available.

18

19.1 Legacy Series / Re: Port Forwarding Not Working All of the Time

« on: May 27, 2019, 09:17:00 am »

Can you see if the initial port forward is received on target? We're seeing something similar here where the initial packet is received by the target but the ack never makes it back to the source.

19

19.1 Legacy Series / Re: LAN default deny rule - when there's an allow rule

« on: April 30, 2019, 04:38:33 pm »

A quick somewhst delayed note to say thanks and the adding of the specific gateway resolved the issue.

20

18.7 Legacy Series / Re: Automatic outbound NAT rule does not working

« on: March 12, 2019, 07:39:46 pm »

I can confirm this issue exists in 19.1.x; specifically if you follow the guidance on interfaces page regarding gateway selection for WAN, automatic outbound NAT rules are not created, but manual ones work; if you select the default (only) gateway automatic outbound NAT rules work as expected.

The firewall on which this was diagnosed worked in a n initial test bench situation; the only difference will have been WAN changed to manual from DHCP (and gateway added) and additional LAN/SSN network interfaces added (but not yet in use).

21

19.1 Legacy Series / Re: LAN default deny rule - when there's an allow rule

« on: February 21, 2019, 07:18:02 pm »

<250 mile drive later...>

A factory reset sounds like an option, except I'll lose connection to the device which is the other end of a long drive (not left the site unconnected, using a spare IP for its WAN connection). What's the next best option?

22

19.1 Legacy Series / Re: LAN default deny rule - when there's an allow rule

« on: February 21, 2019, 11:35:00 am »

Additional info: if I modify the LAN "allow any" rule to be TCP only, the DNS queries are not allowed, and resume if I set it to TCP/UDP; so the issue must be in some sort of internal routing rule - traffic *to* the firewall on LAN interface is being managed by the "allow any" rule as expected, just traffic through that is being denied.

23

19.1 Legacy Series / Re: LAN default deny rule - when there's an allow rule

« on: February 21, 2019, 10:45:56 am »

Thanks for your response

DNS is being provided via the Unbound service and that works fine -oddly, as during testing the specific DNS rule was disabled, so presumably it's the allow all rule that is allowing DNS queries to the firewall; suggests that issue is with traffic through the firewall from LAN devices.

Outbound NAT is set to Automatic.

None of the LAN rules set a gateway; there's 2 gateways configured, one to route to an internal separate subnet and the default one to the ISP router. The only active LAN rules right now are IPv4 and IPv6 allow to any (as well as the built-in anti-lockout and of course Deny All!)

24

19.1 Legacy Series / LAN default deny rule - when there's an allow rule

« on: February 21, 2019, 08:23:33 am »

Scratching my head over this one. Newly installed firewall, after rules added to restrict outgoing LAN traffic to a few ports, denies everything outgoing on the default deny rule - and continues to do so when an allow all rule is added back in at the top. The only LAN rule that is "working as expected" is the anti-lockout rule. Rules added to the WAN interface work as expected.

What circumstances could result in this scenario? All input welcome!

25

19.1 Legacy Series / Re: DHCP in Layer 3 networks

« on: February 17, 2019, 09:56:48 am »

Most organisation can't function without the firewall (even non-Internet using organisations can have LOB servers in their own firewall segment), but that's an aside - would a UI patch that allowed advanced config of DHCP be accepted, or would it be better as a plugin?

26

19.1 Legacy Series / Re: DHCP in Layer 3 networks

« on: February 14, 2019, 04:15:48 pm »

More robust than the firewall, without which >90% of the services a modern organisation is dependent on to function are not available?

27

19.1 Legacy Series / DHCP in Layer 3 networks

« on: February 14, 2019, 02:04:05 pm »

I realise a variant of this topic has come up before, but is there a reason that the DHCP server is limited to providing addresses in the interface subnet? It's reasonably common practice in networks to have per subnet VLANs and then use "IP helper" configurations to relay DHCP requests to a central service - often a firewall outside of Windows AD setups.

If this is something that OPNsense will never provide in the UI, will a manual edit of the DHCP conf survive reboots/upgrades?

All input welcome.