Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Messages - perhelion

#1
After I upgraded from 18.7.x to 19.1.x, OPNsense would crash. These were traditional crashes with automatic restarts. The hardware is an Intel Atom based Supermicro A1SAi-2750F motherboard booting from an SSD. The crashes would occur less than a few minutes after startup. I guessed that something was corrupted in the OS installation, and decided to reinstall. I did not investigate further.

I decided to install a fresh new copy of 19.1. I had a config backup ready to go.

The first issue I had was attempting to add the OPNsense installer (AMD64 ISO) to Yumi. The OPNSense installer would start booting, but eventually would lose access to the installer media. Installation would not finish. To resolve this, I used Rufus to put the IMG installer image directly on a flash drive.

In the meantime, I deleted the partitions on the SSD using Gparted Live.

I booted from the flash drive. The next problem I encountered was not being able to get the installer to find and use the config backup. I had copied the config backup to a flash drive that had FreeDOS installed. There was a prompt in the command line to enter a character string for the drive. I tried to do that but failed. I was only guessing as to what it would be as it didn't list anything. I attmpted to boot with the second USB drive already plugged in, but it didn't resolve the issue.

Next, I got into the automated installer (text-based full-screen). Again i tried to add the config. I attempted to point it at the correct device. It took some time to search for it, but it failed. It said it failed. I exited out of the dialog to continue with the installation using the default config. At some point it said it succeeded in restoring the config, unless I misread it. In any case, the installer used the default config.

I couldn't find documentation on how to restore from backup during the install process.

After installing with the default configuration, I couldn't get static IP assignment to work.

The network had just one DHCP server: the OPNsense firewall.

I ended up adding another DHCP server to the network. I used the DHCP server component from a local Windows server. In OPNsense, I set the IP assignments to be automatic. I also allowed HTTP redirection of the web interface. This resulted in me finally able to get to the web interface. From there, I was easily able to restore the config file from backup. It restarted and came up with the previously-saved configuration.

Post-mortem

What I did right was have a config backup before attempting to upgrade OPNsense. It would have been smart to backup after every config change.

What I should have done is have the second DHCP server on the network from the beginning. If you haven't set up two DHCP servers on the same network, you just need to make sure that all DHCP config info is the same, all static leases are the same, and the two DHCP servers offer different IP ranges.

I wish OPNsense had a better method, or a more easily accessible documented method, for restoring a config during installation.

My intent in posting this is to share the experience in case it benefits anyone.

Thank you for OPNsense. It is a great firewall.
#2
18.7 Legacy Series / "Viscosity Bundle"
September 09, 2018, 03:32:16 AM
In setting up a road warrior VPN, I ran into some trouble. The solution hinged on the meaning of "Viscosity bundle." Even if you already have Viscosity installed, you specifically want the "Viscosity Bundle" from client export.

I was trying to set up the SSL Road Warrior VPN from the documentation at https://docs.opnsense.org/manual/how-tos/sslvpn_client.html?highlight=openvpn

The big problem I had was that Viscosity needs the "Viscosity bundle" from client export. The regular OpenVPN file export will probably not work.

Despite the word "bundle," this bundle does NOT include the Viscosity installer. It is the config and certs bundled so that Viscosity can import it.
#3
Following the documentation does not allow traffic from the remote client to LAN.

https://docs.opnsense.org/manual/how-tos/sslvpn_client.html

Using the OpenVPN wizard does create a working connection.
#4
Tried it again and again with 17.7. Could not make it work at all. Finally just ran OpenVPN wizard. That worked.