Messages

1

18.1 Legacy Series / [Feature Request] - Per destination IP accounting and dynamic rules

« on: February 26, 2018, 08:08:37 am »

I have an OPNsense firewall running as a GW into my server farm. I want to have the ability to track traffic on a per LAN host basis and trigger a deny all when total bandwidth in a configured time period hits a configured level.

I have a total BW package with my service of 4 tb per month. I have 4 clients on web servers behind the firewall and I'd like to be able to ensure that no single client can use up the total BW for the month by themselves.

Since OPNsense tracks IPs and, with netflow, BW used per IP. I would think it wouldn't be too hard to have a rule where if host X goes over, say 1TB then the rule defaults to drop? Otherwise allow. Similar to hotelling but for servers hosted in the LAN side.

I would think the config wouldn't be too hard, Add a host, a BW limit and a time (week, month, X) and away it goes? With Netflow the BW used would be sustained across reboots (as opposed to rule counters).

I would be super useful and I've seen multiple requests for a similar feature on quite a few forums. It can be done with nftables and some fiddling. But having it in your edge firewall natively would rock.

Any thoughts?

2

General Discussion / Inconsistent interface behavior between Intrusion detection and firewall

« on: February 26, 2018, 08:01:17 am »

Hi there.

I have an OPNSense firewall set up as a transparent bridging firewall between my external and internal networks.

I set it up as per the instructions in the docs and it works great for firewalling. As the docs suggest all the firewall rules apply on the bridge interface and no filtering is done on  the physical WAN and LAN interfaces (which have no IP).

However, when I turn on Intrusion detection... Under settings, if I only include the Bridge interface, no rules or alerts match. If I add the LAN interface in as well then they trigger on that and if I add the WAN interface in as well they trigger on that.

It's like the firewall itself is filtering on the Bridge interface, but the Intrusion detection module is only triggering on the WAN and LAN interfaces. Is this expected? It seems counter to what the docs suggest about filtering on a firewall in Bridging mode.

3

General Discussion / OpnSense doing dual firewall and VPN access server duties?

« on: February 23, 2018, 01:52:41 pm »

Hi all,

I have an OPNsense firewall on my ESXi server acting as a transparent bridging firewall beween my secure net with all my hosts on it and the external interface. It's working great. Basic layout is

internet <--> VMWARE external int <-> WAN int <-> transparent bridge <-> LAN Int <-> VMWARE secure network switch <-> hosts

I do all my filtering/firewall on the transparent bridge and it works great. I noticed that OPNsense can also be an OpenVPN termination point. Usually to allow remote users to VPN into a local Lan.

But since I have this VM sitting out there just being a firewall. Would it be possible to set up an OpenVPN on the OPNSense box to take OpenVPN connections from, say my mobile, and forward the traffic out the WAN interface to the general internet? Basically hairpin my device traffic through the interface. To act like a VPN for my device to the internet to protect my mobile/ tablet on public WIFI and the like? Or does the OpenVPN server only facilitate connections in through to the LAN?

Is this feasible?

4

17.1 Legacy Series / Are there any plans to add per IP address time period data quotas?

« on: April 06, 2017, 01:26:57 am »

Hi there, I've been looking around for a package outside of linux + IPTABLES quotas that has per IP address quota support. Not Bandwidth throttling or shaping but true quota.

i.e IP address A has the ability to download 300 meg in a 1 week period or 2 gig in 1 month and after that they are completely cut off.

I can't see any easy way to do this in any of the major firewall projects and I've seen quite a few people asking for it across multiple forums.

My particular application is that I have a VMWARE server with a monthly bandwidth limit from my provider, beyond which bandwidth is very expensive. I have sub machines which I have rented to clients but I want to be able to give those clients unlimited speed, but if they get hacked or compromised I don't want them to be able to blow out my bandwidth allocation for the month and dig into expensive bandwidth.

Is there any pan to add such a thing into OPNSense? It would give it a major feature strength over other packages out there.

Kai

5

16.7 Legacy Series / Total Bandwidth quota on an interface

« on: August 04, 2016, 06:36:42 am »

Hi, this might be a stupid question, and it might just be a terminology issue while searching the docs.

I'm trying to set up a total BW quota on in interface in OPNSense. Not sure if this is achievable.

I'm on a very remote rural mobile broadband connection where the provider does not shut you down when you reach your monthly quota, but rather starts charging an exorbitant rate per gig.

I'd like to set a quota on the LAN or WAN interface where all traffic through the host can be (say) 25 gig in one calendar month period, after which it blocks all in and outbound traffic for that WAN.

Is this possible?

6

16.1 Legacy Series / Re: Opnsense box as a client to OpenVPN Access Server (OpenVPN AS) question

« on: June 24, 2016, 09:14:53 am »

I am also (mostly) trying to acheive this. I don't need traffic to fail but I'm aiming to simply route all traffic from LAN clients over an OpenVPN tunnel that goes out the WAN to a VPN provider and then on to the general internet from there.

Does anyone have a tutorial on how to do this? I've seen a few pfsense ones but they don't translate well into OPNSense.

Any suggestions would be most welcome. I'm pretty sure it should be easy. But can't seem to make it work.

Kai