Messages

1

24.7 Production Series / Re: Update to 24.7.2 results in kernel panic

« on: August 28, 2024, 04:23:57 pm »

#metoo

Code: [Select]

set hint.agp.0.disabled=1
set hint.agp.1.disabled=1
set hint.agp.2.disabled=1
set hint.agp.3.disabled=1
boot

can get you running from the loader shell probably (on most setups, agp.0 should be enough).

Worked for me on my test (home) setup but with the added gotcha of having to access it blind, as for some reason the (very small cheap) monitor is blank during the boot menu stage (works before and after). Very careful one-finger typing got me there eventually 

In case of power outage when I'm not available to restore it, is there a way to add these settings to apply every boot?

2

General Discussion / Nextcloud backups when the Nextcloud is inside

« on: October 12, 2021, 09:05:51 am »

Probably obvious to most but for those like me who backed their head on it a bit before the light dawned, if your Nextcloud instance is internal to the firewall you're backing up it won't work unless you add a DNS override for the URL of your Nextcloud. In this case the internal Nextcloud was also behind reverse proxy so the override was URL -> proxy IP, but I'm assuming a direct to NC internal IP would also work where it's a direct port forward.

3

General Discussion / Re: Rotating automatic backups on NextCloud

« on: September 09, 2021, 04:04:44 pm »

You can set automatic retention in Nextcloud using Flow and the Retention app. You create 2 tags, name them anything but for example opnsense-backup and opnsense-backupdelete. Tag your target  folder with the first of the tags. Then in Flow create an automated tagging flow, with:

 When file is changed; File system tag; is tagged with (that tag you tagged the target folder with); tag with (the other tag you created above)

Then add a File retention rule that uses the second tag you created, set your preferred retention time and you're done.

Files that end up in the target folder will automatically be tagged with the second tag and then the retention rule will be applied in due time.

4

19.7 Legacy Series / Re: Tar segfault upgrading to 19.7

« on: December 20, 2019, 11:19:03 am »

Awesome, that fixed it

5

19.7 Legacy Series / Re: Tar segfault upgrading to 19.7

« on: December 19, 2019, 11:09:13 am »

Just spending some time investigating this issue and noting that many (most, all?) of the files on the affected system are date stamped "Jul 13" - is it possible the upgrade completed as such but failed to mark itself as complete?

6

19.7 Legacy Series / Re: Tar segfault upgrading to 19.7

« on: August 17, 2019, 06:07:32 am »

Anybody any ideas how to solve this issue?

7

19.7 Legacy Series / Re: Tar segfault upgrading to 19.7

« on: August 12, 2019, 09:50:33 am »

From the fetch start:

Code: [Select]

Fetching packages-19.7-OpenSSL-amd64.tar: .+ mkdir -p /var/cache/opnsense-update/70569
+ opnsense-fetch -a -T 30 -q -o /var/cache/opnsense-update/70569/packages-19.7-OpenSSL-amd64.tar.sig https://pkg.opnsense.org/FreeBSD:11:amd64/19.1/sets/packages-19.7-OpenSSL-amd64.tar.sig
.+ opnsense-fetch -a -T 30 -q -o /var/cache/opnsense-update/70569/packages-19.7-OpenSSL-amd64.tar https://pkg.opnsense.org/FreeBSD:11:amd64/19.1/sets/packages-19.7-OpenSSL-amd64.tar
...+ [ -n -V ]
+ opnsense-verify -q /var/cache/opnsense-update/70569/packages-19.7-OpenSSL-amd64.tar
+ echo ' done'
 done
+ [ '' '=' -b ]
+ [ '' '=' -k ]
+ [ '' '=' -k ]
+ [ -n '' -a -z -u ]
+ [ -p '=' -P -a -z -u ]
+ [ -p '=' -p -a -n -u ]
+ echo -n 'Extracting packages-19.7-OpenSSL-amd64.tar...'
Extracting packages-19.7-OpenSSL-amd64.tar...+ rm -rf /var/cache/opnsense-update/.sets.pending/packages-19.7
+ mkdir -p /var/cache/opnsense-update/.sets.pending/packages-19.7
+ pkg-static clean -qya
Segmentation fault (core dumped)

Running pkg-static manually, with no switches/commands also returns a segfault. This may be related to the health check returning the error

Code: [Select]

/usr/local/lib/libpkg.so.4: version LIBPKG_1.4 required by /usr/local/sbin/pkg not defined?

8

19.7 Legacy Series / [Solved] Tar segfault upgrading to 19.7

« on: July 24, 2019, 12:08:19 pm »

Hi

Trying to upgrade to 19.7 from 19.1.10_1. Having unlocked the upgrade I get web UI output of

Code: [Select]

***GOT REQUEST TO UPGRADE***
Fetching packages-19.7-OpenSSL-amd64.tar: ... done
Extracting packages-19.7-OpenSSL-amd64.tar...***DONE***

and CLI output of:

Code: [Select]

Proceed with this action? [19.7/y/N]: 19.7

Fetching packages-19.7-OpenSSL-amd64.tar: ... done
Extracting packages-19.7-OpenSSL-amd64.tar...Segmentation fault (core dumped)

*** OPNsense.ourpack.eu: OPNsense 19.1.10_1 (amd64/OpenSSL) ***


Locating the downloaded file and manually running tar -xf successfully extracts the contents.

Any ideas?

9

19.1 Legacy Series / Re: Tuning ipsec for fastest (re)negotiation

« on: June 11, 2019, 01:23:33 pm »

Ok, I may have resolved this one. A combination of using Disable Reauth on the phase 1 and limiting the encryption options on the phase 2s to a single option has reduced renegotiation times to the point that monitoring services are no longer (normally) triggered. Still get the occasional blip but that's much better than all tunnels every X hours!

10

19.1 Legacy Series / [SOLVED] Tuning ipsec for fastest (re)negotiation

« on: June 08, 2019, 06:13:33 pm »

We've got a setup with several offices, with VPNs between each site (fixed IPs, dedicated FTTP) which are used among other things for monitoring kit on each site from a central server. We're noticing that when the VPN lifetime expires the tunnel drops and then there's an odd delay before it re-establishes. For most purposes it wouldn't be an issue but the disconnect is long enough to make the monitoring send a bunch of alerts - and can disrupt inter-site backups.

Lifetimes are set at 28800 seconds for phase 1 and 2 at each end.

Are there any settings we could tweak to cause the renegotiation to take less time?

11

19.1 Legacy Series / Re: Papercut: VIP VHID gateway/password seen as firewall user/password

« on: June 02, 2019, 01:11:44 pm »

That option works better when you don't administrate a lot of firewalls. Unique password per install is a lot of passwords to remember.

12

19.1 Legacy Series / Re: Port Forwarding Not Working All of the Time

« on: May 31, 2019, 06:34:26 am »

As in the fix on the firewall we are having a similar issue on is switch gateway in WAN interface settings to auto, then back to manual. Though of course this might be a completely different issue to yours!

13

19.1 Legacy Series / Re: Papercut: VIP VHID gateway/password seen as firewall user/password

« on: May 31, 2019, 06:32:35 am »

You have a password manager that differentiates between the password on a page v. a password on a site? I don't think mine can do that.

For interest, why would you need to store the VHID password at all - if it's available in plain text in the UI, like the IPSEC PSK, can't you just cut and paste between the firewalls?

14

19.1 Legacy Series / Papercut: VIP VHID gateway/password seen as firewall user/password

« on: May 30, 2019, 09:29:14 am »

When creating or editing a Virtual IP (Firewall -> Virtual IP -> Settings) the Gateway and Virtual IP Password boxes are seen as the firewall user/password boxes respectively, and the password manager (via FF66 and earlier) auto-completes them. Could this be changed so that doesn't happen?

Should the VHID password even be treated as something that needs hiding? I'm guessing that if it's not called/defined as "password" that it won't be seen as one.

15

19.1 Legacy Series / Re: Possible Routing Bug?

« on: May 30, 2019, 08:51:16 am »

No further detail yet (not sure where to look) but we're seeing this issue flip-flop depending on changes made.

Scenario:
central office firewall with multiple internal subnets and public IPs. Single gateway (ISP "true" fibre router).

adding a new rule (LAN/SSN certainly, not observed with WAN rules - but it's not an everytime thing) and routing in one direction stops; changing the WAN gateway to auto and then back to manual gets everything back working.