Messages

Issue is 100% Opnsenses WAN port being connected behind another router. It is best to connect opnsense directly to the internet, not other way around. It is best to call your ISP and ask for guidance.

Without being able to connect Opnsense directly to internet, you have to configure routes and NAT etc. on both, opnsense and your router, which is something,average home user doesn't have to do (nor even should).

I would suggest restarting ZA first if you haven't done that after you whitelisted IPs and such.

If that doesn't fix the issue, contact ZA customer support. Dead site issues can't be fixed by yourself (it is caused by low average visitor amounts), so you have to contact ZA if that is the case.

Now certificate issue is easy to fix if you are using Let's encrypt. Instead of running acme client on opnsense, change the public DNS records on the registrar (or whichever hosts them) and run Acme client on the server, where website is hosted on (Let's encrypt tool on opnsense can issue certificates only to domains, which are hosted on servers using same public IP as opnsense is. Let's encrypt uses acme and without manual input, acme client needs to be ran from server or any device using same Public IP. It checks the public DNS records, not local ones)

You need paid subscription (like home which is 10€ a month) for it.

If you have paid subscription, then here are steps I could find.

• Go to Settings -> DNS Enrichment.Toggle on Perform real-time DNS reverse queries for local IP addresses. Under DNS Enrichment for Reports, add the IP address of your local DNS server. Save your changes and restart the Zenarmor engine from the dashboard
• Go to Services -> Unbound DNS -> Overrides in your OPNsense UI.Add Host Overrides for your client devices to map their names to their static IP addresses.
• Go to Services -> Unbound DNS -> Overrides in your OPNsense UI.Add Host Overrides for your client devices to map their names to their static IP addresses.
• Ensure you haven't accidentally masked your IP addresses. In the Zenconsole, check your Privacy Settings and make sure Anonymize local IP address is toggled OFF.
• If you are still seeing IPs or MAC addresses, you may need to clear your reporting database/cache to force a fresh look-up using the new DNS settings.

If that fails, then contact zenarmor support for further guidance.

Anyway, since you didn't mention wether you are using free version or not, I assume you are using free version and that's why it doesn't work

The CSV export/import tool should fully preserve things literally as they are. There's always a chance things get broken because one thing or other, so it is good practice to check and make sure, rather than just expect it to work.

Import tool should work just fine, but it is still good idea to backup and make sure. In short, better safe than sorry

Also if you feel more comfortable with old rule interface thing, you can stick with it and leave the new interface thing untouched (the old interface section still works just fine, new one is there for people to try out)

No. You create same rule on LAN network (source is Lan network and destination are aliases you created, rest are the same).

https://docs.opnsense.org/manual/how-tos/drop.html

Sounds like your Unbound can't verify certificate (yes, you need a certificate)

Make sure you have typed correct certificate name (in DNS over TLS settings, edit cloudflare dns record and you should see "verify CN" field), you can find correct record using dig command on linux or nslookup on windows (just type dig/nslookup IP_ADDRESS and you should see the certificate name as a result. Correct one for 1.1.1.1 is "one.one.one.one" without quatation marks, but not sure about other IPs)

This is easy to miss since on WebUI, verify CN isn't visible anywhere else, other than creation or edit window.

You can access override rules of Unbound in Services ---> Unbound ---> Overrides

In the overrides window, select + icon under "hosts" which is at the top above aliases

You shouldn't have to open any ports for Zenarmor to work.

Whole idea of Zenarmor is NOT to open any ports you don't need to, just so you could access internet easier.

If Zenarmor doesn't work on your firewall, it means you can't access internet at all, or you have blocked all traffic through https and http ports to servers, Zenarmor downloads its updates from and uploads database files for remote management thingy (Yes, Zenarmor only needs unrestricted access to it's update servers and server, which contains it's Database for remote management). Other than updates and database related things, Zenarmor doesn't need internet access at all to function (that is if you are using default options, but most features which require internet access, are available for you, only if you have paid version)

If you are able to access certain websites, which should be blocked by Zenarmor, all is as it should be (or not. thing is, Zenarmor or any plugin really, won't be able to block everything 100% certainty without manual input. Especially if you use free version).

You won't be able to block access to websites with 100% certainty just based on domain names or IPs alone. You need to use custom blacklists (especially if you use free version of Zenarmor).

Paid version is bit more effective with this, because it unlocks features which give you more effective tools to block things. You still need to put manual input to things though (which is why many think free version is just as good, which is true, for those who are familiar with manually setting everything).

No you don't usually have to restart unbound when you add stuff to whiltelists. If your machine is unable to access domains you whitelist, you need to flush dns records on that machine (on windows, you do that by opening command prompt and type command "ipconfig /flushdns" without quatation marks).

Cron tasks (like almost everything) are logged and you can view them from logs (there is no status page for it, you have to either check the logs under general logs or unbound logs, or read the correct log file on console. You can use filters and search using keywords.)

If by overriding blacklists as in allowing you to access websites containing adult material while blocking your kids gaining access to those websites, I would recommed using Zenarmor. I don't know if Unbound can do that, but BIND can, BIND is just bit more complicated to setup than unbound is and I wouldn't use it on Opnsense, if I didn't have to host local DNS zone.

First If you have some custom built PC running Opnsense, make sure the network interface supports IEEE 802.1Q (yes, for vlan to work, network interface your opnsense has must support it. Most mainstream consumer market interfaces like cheap realtek NICs don't have that, it is one of few things you have to pay bit more extra. Intel l350 series 1 gigabit NICs aren't that expensive and for 10Gb ethernet, x550 series is solid choice)


Secondly reboot your opnsense if you havent done so, after you finished setting things up and tried if it works. Rebooting is sometimes required for changes to take affect (this should be first thing you should try. I have had my share of similar vlans not working situations, and rebooting fixed the issue on vast minority of cases, but still something worth trying)

If that doesn't work, next make sure the switch port which is connected to opnsense is set to tagged mode for VLAN 10, secondly assign the port your computer is connected to as member or ACCESS mode to vlan 10 (opnsense uses 802.1Q tagged vlan, you have to set port(s) you connect to opnsense and other possible switches to trunk or tagged mode for VLAN 10 and ports you plan to connect your client devices to access mode or member mode for vlan 10 (I am familiar with Cisco terminology, tagged and untagged is something they don't use on hardware I have).

Your LAN belongs to different IP range, which is why you can't ping from LAN to VLAN10 and it is possible, it's a routing issue. to test this, run a traceroute on machine connected to vlan10, on linux system open terminal, and type "traceroute 10.28.74.1" and "traceroute google.com". If both fail, it's obvious routing issue,  easiest way to fix it, is to set LAN and VLAN10 to same private range, in your case, 10.28.74.1/22 for LAN and 10.28.75.1/22 for VLAN10

If that's the case, placing both networks to same private range should fix the issue (since opnsense creates route for LAN automatically by default).

Your switch supports IEEE 802.1Q so there shouldn't be issues there.

To summirize.

Make sure your opnsenses NIC supports IEE 802.1Q (802.1Q for short)

Make sure you have rebooted the system.

Make sure your switch have correct port(s) set as Tagged for VLAN 10 and correct port(s) assigned as member ports of VLAN 10 (I would assume untagged, but might be wrong).

Make sure routing is correct (you are able to traceroute to your VLAN gateway)

Zenarmor isn't able to block or control anything that uses encryption (which nowadays most servers, apps and even smart devices use).

Zenarmor is able to block you gaining access to adult content, as long as your computer isn't using VPN combined with encrypted dns, and domain in question is included in Zenarmors database or custom blocklists.

If you want bit more (free) effective, and effortless way to block adult content, check https://nextdns.io/ or https://adguard-dns.io/en/welcome.html

Oh also disable ClamAV, it doesn't work.

Having antivirus installed on firewall is useless, it can only scan traffic, which is unencrypted (without reverse proxies where data is decrypted before they enter your firewall, all data goes through it unfiltered)

Same with Zenarmor, you aren't able to prevent hackers being able to install backdoors or malware on your machines with it, since all they have to do, is use encrypted connection (discord, https, ssh and list goes on.)

Almost every traffic on the internet is encrypted these days, which reminds me: in command prompt, type "nslookup 192.168.1.1" and try going to the domain instead of using IP (by default I think domain opnsense uses is opnsense.local), if that doesn't work and you use google chrome or firefox, try manually typing https://192.168.1.1:443 on microsoft edge (especially if you hardly ever use it). I have sometimes issues connecting to webgui using IP instead of domain names of certain plugins I use but using domain or clearing all browser data fixes things if time doesn't.

Easiest way to do this is to reset default values.

You can try ssh, if that doesn't work, you need gain physical access to device running opnsense (If your opnsense box doesn't have video output, you need to use console cable, in which case you have to check the serial documentation. All official hardware come with console cable, so all you need is putty, know which serial line to use and what serial speed to use which can be found on documentation).

It is best not to use captive portal unless you have AP that has built in encryption (captive portal doesn't encrypt anything other than passwords, even when you don't have access to internet, wifi traffic is moving locally and it is plain insecure and unencrypted wifi connection, anyone connected to same network is able to sniff traffic on it. And Radius uses MD5 hash, which is no where near hard to crack using websites like https://10015.io/tools/md5-encrypt-decrypt)

If you are familiar with whole webgui stuff, then all you need to do, is access console, choose shell option in console, type pfctl -d (which disables the firewall and you have to manually re enable it with pfctl -e) and hope, it's just firewall blocking your access to webgui. If that doesn't work, you have to pretty much start from scratch.

Also instead of manually having to type IPs (and creating loads of rules), you can simply use aliases, just add your host IPs to aliases.

Alias to apply any host belonging to network 192.168.1.0/24, you create alias, set Type to host and type 192.168.1.0/24 on content.

Alias to apply any host within same private network range as 192.168.1.0/24 is, content is 192.16.0.0/16

for individual local IPs, you don't have to type /24 at the end (as long as they use 24 bit subnet which is 255.255.255.0), just local IP suffices.

for public IPs, subnet bit is required (you can google whois IP and search WHOIS records for any public IP there is, it will display the information you need)

If that is too much work or instructions are too complicated to follow, Optionally you can just add new interface, name it management, add "Block all rule to "Management net" and "block all rule to this firewall" for LAN net, "allow all to this firewall" rule for management interface and "allow DNS for LAN" rule and you are done. Then, everytime you need to access opnsense, you have to connect your PC to LAN interface which is lot safer. To prevent hackers etc. gaining access to your firewall, you should block connections from ANY NETWORKS which has ANY devices connected (including your daily use computer. As long as your computer has access to internet AND your router or firewall, hackers are able to exploit that)

Shortly, you should have 2 networks, 1 that has no internet access and can access all local networks or just your firewall, and 1 that has access only to internet and can't access firewall or router.