Messages

[interface LAN/WAN]

So the Floating rule should be:

Source: Any
Destination: (alias) Blocklist

This would be any (source) network on my LAN blocking traffic to that IP address. I thought by selecting interface LAN/WAN would block this IP going in and out with any protocol.

I just want to make sure no traffic in or out is going to or coming from the IP in the alias. Is there more I need to add to this rule for that?

[UPDATED THIS POST TO SHOW THE CORRECT ANSWER]

UPDATED THIS POST TO SHOW THE CORRECT ANSWER
OPNsense 24.7.12_2-amd64

Set up an alias: Firewall-> Alias
Named it: blocklist
** Type: Host(s)
Content: 34.107.243.93 (single IP example)

Created Firewall Floating Rule: Firewall-> Rules-> Floating
Action: Block
Apply the action immediatly on match: checked
Interface: LAN & WAN
Direction: any
TCP/IP Version: IPv4
Protocol: any
Source: any
Destination: (alias) blocklist

PLACES TO CHECK

If not blocking, Try: Firewall-> Diagnostic-> States-> Actions-> Reset state table

Firewall-> Diagnostics-> Aliases-> (alias name) blocklist
Should show the IP address to be blocked

** ALIAS TYPES

Host(s): This type allows you to define individual IP addresses or subnets (CIDR blocks).
Usage: It's useful when you want to create an alias that contains a list of specific IP addresses
Example: 192.168.1.100, 10.0.0.0/24, 203.0.113.0/32.

URL (IPs): This type allows you to specify a URL that contains a list of IP addresses (the URL will return a plain list of IPs, typically in a text format).
Usage: It's useful for dynamically pulling a list of IP addresses from a URL (such as a publicly available threat intelligence feed).
Example: You could enter a URL that points to an IP blocklist file, and OPNsense will download and parse that list to use it in the alias.
Example URL: https://lists.blocklist.de/lists/all.txt

URL Table (IPs): This type allows you to define an alias based on a list of IP addresses that is fetched from a URL, similar to the URL (IPs) type. However, in this case, OPNsense treats the list as a "table" and will update the list periodically (according to the refresh interval you specify) and maintain it in memory for use in firewall rules.

This fixed the issue. Thank you.

I keep getting "Error 200" when trying to view the Zenarmor logs or Live Sessions in the GUI. I cant see the logs at all. Also the database will not start, even after reboot. I tried to reinstall the zenarmor packages. That didnt help.

Is there a way to upload custom Suricata rulesets using the GUI? At one point we use to be able to do this but it doesn't look like its availaible any longer. Here was an old way:

Step 1: Navigate to the Suricata Settings

    - In the OPNsense dashboard, go to Services > Intrusion Detection.
    - Click on the "Signatures" tab.

Step 2: Add Custom Suricata Rules

    - Scroll down to the "Local Rules" section.

Here, you can add custom rules directly into the Suricata rule configuration:
You can paste the contents of your custom rules into the box.
Alternatively, you can specify a custom rule file location (more advanced).

I have this same problem. It immediatly pops up with a new schedule creation. When clicking Cancel, it take you out of the schedule tab.

[Firewall -> Nat -> Port Forward]

TO get your Plex server Fully accessible outside your network

Firewall -> Nat -> Port Forward
From this page click + (add)
No RDR: unchecked
Interface: WAN
TCP/IP Version: IPv4
Protocol: TCP
Source: Any
Source Port Range: any/any
Destination: WAN Address
Destination port range: (other) 32400/32400
Redirect target IP: Plex server internal IP
Redirect target port: (other) 32400
Pool Options: Default
Description: Plex Media Server
NAT Reflection: Enable
Filter Rule Association: Pass

Services-> Unbound DNS-> Advanced-> Private Domains-> plex.direct

Firewall-> Settings -> Advanced
Reflection for port forwards: checked
Reflection for 1:1: checked
Automatic outbound NAT for Reflection: checked
Firewall Optimization: normal

[Dell DP/N: 0MX846]

Every time I follow these instructions to bridge my LAN & WIFI card I get this error:

Bridging a wireless interface is only possible in hostap mode.

How do I bridge Lan & Wifi?

Trying this: https://forum.opnsense.org/index.php?topic=5066.0
and this: https://www.cyberciti.biz/faq/howto-configure-wireless-bridge-access-point-in-pfsense/

Wifi card is a Dell DP/N: 0MX846.
https://www.pchub.com/uph/laptop/279-79033-1500/Dell-Common-Item-Dell-Wireless-LAN-Card.html

Also tried a Realtek RTL81878 MOW 11b/g and got the same error.

I'm using Suricata IPS. It keeps blocking a single specific IP address with a rule. I would like to keep the rule in place just not block the single IP. What is the correct way to whitelist the IP address so it is not blocked with the Suricata IPS rule?

[Services]

Go to:  Services>Intrusion Detection>Administration>Rules

Browse past page 6 of rules, for the example.
Then click a box to enable any rule (furthest box on the right of rule).
This bring you back to page 1 automatically.

This is very annoying while browsing each page and trying to enable individual rules. You have to remember which page you are on to go back and continue where you left off. Enabling a rule should keep you on the same page you enabled the rule from.

I have tried several WiFi cards And they all had issues. Instead of using the internal cards I flashed an old Linksys router with DDWRT firmware and used that as an access point. Since then I do not have wireless issues.

If you have a WiFi card installed in your Opnsense box please let us know what brand and model it is and its limitations you have encountered. Thanks!

Can you describe how to set that up? Not as simple as installing a package  :-\

[SURICATA Applayer Detect protocol only one direction]

I get a lot of these alerts:
SURICATA Applayer Detect protocol only one direction

Looking HERE it explains this:
Protocol detection only succeeded in one direction. For FTP and SMTP this is expected.
So if you have been using these protocols from your network then you will see these alerts.

What is some of the best ways to view the Firewall & Suricata logs?
Any good plugins for this? Which one do you use? What are the benefits of your choice?

Thanks.