Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Messages - Carl E. Thompson

#1
17.1 Legacy Series / Re: Firewall:Aliases:View
February 02, 2017, 01:57:02 AM
To answer your question: Yes. It should round robin through all of the servers in the alias when you use an alias as a NAT destination. (Disclaimer: That's what I've read but I haven't used that feature myself.)


However I don't think that's the most important use for aliases. Aliases in general help keep your firewall rules maintainable as your rule set grows. I have firewalls that protect hundreds of servers with hundreds of rules that apply to many different groups and individual servers. If I typed the IP address that a rule should apply to into each rule then things become a mess. For example if I did that and one server's IP address changes then I'd have to manually search through hundreds of rules and modify any rules that pertain to that server. This is error-prone and can cause the firewall to be in an inconsistent intermediate state if a rule is missed before clicking Apply.


To avoid this I strongly recommend never type an IP address, hostname or port number directly into any rule. Always take the time to create an alias for these things first and then use the aliases in all of your rules. That way if for example a server's IP changes then all you have to do is change one alias and all of the rules that apply to that server are automatically (and consistently) modified. It makes things more mistake-proof. That's the true power of aliases.


Pro tip: If you have rules that act upon a group of servers then create a group for them (as you have). However, do not type the individual IP addresses directly into the group (as you did). Instead take the time to create individual aliases for each member of the group and put those aliases you created into the group alias. Yep, OPNsense let's you nest aliases like that. That way each server's IP is defined in exactly one alias only and you don't have to change multiple aliases if the IP changes.
#2
17.1 Legacy Series / Policy Routing Broken in 17.1?
February 01, 2017, 09:47:49 PM
Hello,

     I upgraded from 16.7 to 17.1. After upgrading, all of my firewall rules that forced traffic out through a particular gateway stopped working pretty much breaking my entire setup. I have multiple gateways some of which are over OpenVPN links. Different servers on my LAN need to be routed out through different gateways (different path to internet and different outbound NAT). I tried fiddling with it and creating floating rules instead of LAN rules to force the gateway but nothing worked. I ended reinstalling with 16.7 and restoring a config backup.

<rant>
     I love OPNsense and plan to continue to use it for my personal home network described here and in the future switch the work networks I manage from Sophos UTM to OPNsense. But are updates regression tested? In other words how much can I trust that an update will not break my networks? It seems to me that testing that core functionality like policy routing still works is something that could be done by adding a test case that is automatically run for each build. I see from perusing the forum there are other examples of rules that worked before but no longer working on 17.1. I would suggest that certain types of software projects (even open source) cannot afford to have breakage after upgrade because stability and reputation are things that are of paramount importance to the project's success. No one is going to trust their data (or their careers) to OPNsense if it gets a reputation of only working sometimes. To that end I volunteer to help set up a test harness on your test servers if you need people. Thanks!
</rant>