Messages

Alright, I've found the line where this route gets created: https://github.com/opnsense/core/blob/86996d7bf74d7eadcd0879d8edb5aa3d7f807b32/src/sbin/dhclient-script.ext#L274
This line adds this route with the wrong gateway (the MAC address of the specified interface of the OPNsense box). Probably the gateway should be specified explicitly?

The only thing that wonders me is that this file wasn't touched for about 2 years. And it was working with version 17.1.11 ???


best regards,
Andreas

What are gateway rules? Firewall rules where the gateway field is something other than default? I don't have any of these.

I already checked if the firewall is the issue, but there are no blocked requests, requests to destination port 53 go through by the "@63 pass out log all flags S/SA keep state allow-opts label "let out anything from firewall host itself" rule.

Some update: During night the route reappeared and I had to delete it again.


best regards,
Andreas

Hi Franco,

no, I don't have Intrusion Detection enabled.
Is there any other service which could create this route? imho the problem has to do something with this route, because without the route everything works (i.e. the ISPs DNS server get routed by the default gateway, which is the ISP box).


best regards,
Andreas

Hi,

since the upgrade from 17.1.11 to 17.7 I cannot resolve external hostnames anymore.

My network:
Internet <--> ISP box (in routing mode, DHCP server enabled) <--> OPNsense box (retrieves DNS server IPs per DHCP from the ISP box) <--> Clients

After some troubleshooting I found out that the OPNsense box is unable to ping my ISPs DNS servers.

There are two weird entries in the routing table of my OPNsense box:

Code Select Expand

Destination        Gateway            Flags     Netif Expire
195.34.133.21      00:0d:b9:XX:XX:XX  UHS        igb1
212.186.211.21     00:0d:b9:XX:XX:XX  UHS        igb1
The IPs are the two DNS servers from my ISP, and the gateway is the MAC address of the igb1 interface of my OPNsense box.
Shouldn't the gateway point to the IP/MAC of the ISP Box?

There are also two weird ARP entries:

Code Select Expand

? (195.34.133.21) at (incomplete) on igb1 expired [ethernet]
? (212.186.211.21) at (incomplete) on igb1 expired [ethernet]
The ISPs DNS server is obviously not in my local network, why does the OPNsense box have an ARP entry for it?

When I delete the two routes for the ISPs DNS servers manually, I can ping the DNS servers from the OPNsense box again and everything works. But this route gets recreated on each boot.
Has anybody a tip what's the issue here?


Thanks,
Andreas