Messages

1

16.1 Legacy Series / Issue on WAN filter

« on: July 27, 2016, 10:57:40 pm »

Hi All,

I have the following issue on all 3 opnsense version that I installed: 16.1.20 , 16.1.8 , 16.7-RC2.

Enviroment:
VM with 2 interfaces on VMware Workstation 11.
em0 interface is bridged with eth0 of my PC, connected to my home router.
em1 interface is an isolated one on the VMware

Configuration:
em0 -> WAN -> DHCP Assigned Address -> 192.168.0.116      (GW: 192.168.0.1 <- my home router)
em1 -> LAN -> Static IP -> 10.10.5.1/24 with a DHCP Server with range 10.10.5.200-220

I add the firewall rule on WAN

Protocol: any
Src: any
Dst: any
Action: pass

From my router (192.168.0.1)  I'm unable to ping WAN (192.168.0.116).
From another PC (192.168.0.22) I'm unable to ping WAN (192.168.0.116)
From WAN I'm able to ping my router and other PC in subnet.
I unchecked "block rfc1918" and "block logon network", tried to put a more specific rule for ICMP on WAN and rebooted VM, but nothing changed.
With Pfsense the same configuration in the same enviroment, works as expected, replying to ICMP, so it cannot be the enviroment.
It seems that there's something wrong on the outgoing rules of WAN pf.
Looking tcpdump inside opnsense I'm seeing ICMP request and reply, but it doesn't leave the WAN interface.
Obviously It works when I manually disable pf.
This issue affect every packet sent to the WAN interface, not only icmp.

Here you can find

opnsense /tmp/rules.debug file
http://pastebin.com/eHcCMX7k

pfsense /tmp/rules.debug  file
http://pastebin.com/u4xi1Wvk

and opnsense backup configuration
http://pastebin.com/n2SYKpvb

Is there someone that already find this issue or is there something I'm not doing on the right way?
Thanks in advance.

2

16.1 Legacy Series / [SOLVED] Upgrade repository problem and firewall understanding

« on: July 26, 2016, 11:04:24 am »

Hi All and thanks for the great software.

1)
I installed from scratch "OPNsense-16.1.8".
Then I upgraded it from the Webgui to "OPNsense 16.1.20" and everything seems ok, but when I clicked again on "Click to check for updates" button it return repository error.
I tried to go under System-Settings-General and click save, but it didn't work.
To fix it, I had to manually change /usr/local/etc/pkg/repos/origin.conf "${ABI}/16.7/latest" to "${ABI}/16.1/latest" so maybe there's something wrong on the upgrade package.

2)
Then I have another question. I checked all documentation and forum, but I didn't find the answer.
I need to know how firewall works on OPNsense. Usually I work with input-forward-output schema, but I'm unable to find forward chain on OPNsense, so I don't know how to control forwarded traffic.

3)
I didn't find how to manage ESTABLISHED and RELATED connections, is there some more specific documentation will all these information?

Thanks a lot in advance.
Ludovik.