Messages

Update:
I've today tested a different setup with another system (Raspberry) and again the policy-based Tunnel.
The same happens here, as soon as I send a package from a certain size, the tunnel itself stays up, but no data is sent through it. Even after changing the Interface MTU size to a very low number (1000), nothing changes in the specific behavior. The problem might be caused by the Mobile-Internet provider.
When I (without active VPN tunnel) lower the MTU on the interface, the "gap" still applies: For example, when Interface MTU is set to 1500, I am able send pings up to 1472. Proceeding lowering the MTU to 1472, I am able to send pings up to 1444:
ping 8.8.8.8 -M do -s 1445
PING 8.8.8.8 (8.8.8.8) 1445(1473) bytes of data.
ping: local error: message too long, mtu=1472
Anyone knows how I can fix this issue to get my VPN tunnel stable?

Another Update:
Seems to be an OPNsense Issue... I've "extended" my setup:
Site A, Modem <-> OPNsense 24.7.10_2-amd64 on FreeBSD 14.1-RELEASE-p6 (virtualized System) with a static public IP
Site B, SIM-Card Router and non-static, non-public (incoming) IP / behind NAT
<-> OPNsense 24.7.10_2-amd64 on FreeBSD 14.1-RELEASE-p6 (Zima-Board)
<-> additionally a Raspberry Pi with a policy-based IPsec Client

I am "able" to send large pings from my Raspberry, which tells me, that they are too large and can't be fragmented (but the tunnel keeps working properly)
If I send it from my Site-A OPNsense, the tunnel gets destroyed as well. So whenever the sending goes over the OPNsense's, it destroyes the tunnel.
I've even added esp_Frag and Fragmentation = yes via a custom config without any effect... normalizations didn't have any effect at all........

so any help regarding this OPNsense issue would be great :(

Last Update:
As noone was able to help and I'd wasted too much time on this issue, I switched to WireGuard S2S VPN Tunnel... which is a pitty as my clients use IPsec... but nevertheless, WireGuard works flawless

Dears,
I have a question (and Issues -.-) with Route-Based IPsec setup.
First of all, I assume, that the Manual (https://docs.opnsense.org/manual/how-tos/ipsec-s2s-conn-route.html) is wrong at the Routes part: there it is stated, that on Site A the network address 10.0.2.0 (which additionally might be a typo as 10.2.0.0 was used) should be set... but 10.2.0.0 is the address of Site A and if one does... this kills the system (I tried in a third shot, as I am unable to get my VPN tunnel working)

For my issue (if anyone is willing to help): I've followed the instructions to 100% with one exception: my site B has no static public IP address... the rest has been kept as stated... (but I also have working policy-based Tunnels on Site A)

So as soon as I provide a Gateway, Site B tries to retransmit: "retransmit 1 of request with message ID 0" and Site A unregisters "05[CFG] vici client 2 unregistered for: list-conn" and finally disconnects... :((

A policy-based Tunnel has been created before as well, but I couldn't figure out how to fix the MTU issue... as soon as a package with a certain size hit the tunnel, the tunnel kept "connected", but no traffic flew through anymore... (tried all the normalization stuff :/)
therefore I tried to give the route-based tunnel a try... without luck as well -.-

Setup:
Site A, OPNsense 24.7.10_2-amd64 on FreeBSD 14.1-RELEASE-p6 (virtualized System) with a static public IP
Site B, OPNsense 24.7.10_2-amd64 on FreeBSD 14.1-RELEASE-p6 (Zima-Board) with a SIM-Card Router and non-static, non-public (incoming) IP / behind NAT

as stated... configured 1:1 like stated in the manual except the static IP parts

any help is highly appreciated!

Dears,

I am on the current stable versions:
OPNsense 24.1_1-amd64
FreeBSD 13.2-RELEASE-p9
OpenSSL 3.0.13

I don't know exactly since when, but currently the OCSP must stable function doesn't work anymore and the settings have changed... anyone faced this issue already?

Hallo liebe Community,

ich versuche, HAProxy für meine zwei Mail-Server einzurichten, was aber daran scheitert, dass die Servernicht die Sender-IP, sondern die FW-IP als "Sender" erhält (was zu Problemen mit DMARC / SPF führt).
Transparent-Mode funktioniert nicht...
Über die GUI lässt es sich meines Wissens nicht aktivieren und der Transparent-Mode funktioniert ebenfalls nicht (Dienst läuft nicht mehr... ich habe aber noch andere HTTP "Services" über HAProxy am laufen).

Weiss jemand, wie dies bewerkstelligt werden kann?

Besten Dank und liebe Grüsse

Mathias

Hallo,

Hast du das Problem lösen können? Und wenn ja, wie?  :-[

Nevermind, sorry für die Umstände, die Lösung ist ja eig. bedenklich einfach:
im entsprechenden Backend die Advanced Options aktivieren und unter "Option pass-through" die vier Zeilen einfügen:

acl existing-x-forwarded-host req.hdr(X-Forwarded-Host) -m found
acl existing-x-forwarded-proto req.hdr(X-Forwarded-Proto) -m found
http-request add-header X-Forwarded-Host %[req.hdr(Host)] unless existing-x-forwarded-host
http-request add-header X-Forwarded-Proto https unless existing-x-forwarded-proto

Sorry für jede verschwendete Minute!

Hallo Zusammen,

Vielleicht kann mir hier jemand helfen, da ich einfach nicht mehr weiterkomme:
Ich habe die OPNsense FW schon eine Weile mit einem Wildcard Zertifikat von LetsEncrypt und einem HAproxy in Betrieb.
Mein aktuellstes Projekt ist OnlyOffice hinter dem HAproxy zugunsten der SSL Verschlüsselung zu betreiben.

Der Server läuft lokal auf Port 80 und funktioniert dort inkl. den Doc-Editoren auch problemlos.

Wenn ich aber die Adresse über den HAproxy öffne, funktioniert zwar die grundsätzliche OnlyOffice Seite noch, jedoch die Doc-Editoren nicht mehr.

Die Einträge von Threads 16595, 19122 & 10343 haben mir leider auch nicht weitergeholfen... von OnlyOffice gibt es unter https://helpcenter.onlyoffice.com/installation/docs-community-proxy.aspx eine Verlinkung zur "zu tätigenden HAproxy Konfiguration" https://github.com/ONLYOFFICE/document-server-proxy/blob/master/haproxy/proxy-https-to-http.cfg jedoch weiss ich nicht, wie ich die Einstellungen in der OPNsense GUI vornehmen kann (wenn überhaupt?)!

Ich gehe davon aus, dass hier das Problem begraben liegt:
  acl existing-x-forwarded-host req.hdr(X-Forwarded-Host) -m found
  acl existing-x-forwarded-proto req.hdr(X-Forwarded-Proto) -m found
  http-request add-header X-Forwarded-Host %[req.hdr(Host)] unless existing-x-forwarded-host
  http-request add-header X-Forwarded-Proto https unless existing-x-forwarded-proto

Für eure Hilfe bin ich sehr dankbar!

Salü pmhausen,

Vielen Dank für deine Rückmeldung! Meinst du den States Dump? Dieser ergibt folgendes (für mich leider wenig Aufschlussreiches):
all   tcp   <intIP>:1723 (<extIP>:1723) <- <ClientIP>:6557   ESTABLISHED:FIN_WAIT_2   
all   gre   <intIP>:0 (<extIP>):) <- <ClientIP>:0   MULTIPLE:MULTIPLE   
all   tcp   <ClientIP>:6557 -> <intIP>:1723   FIN_WAIT_2:ESTABLISHED   
all   gre   <ClientIP>:0 -> <intIP>:0   MULTIPLE:MULTIPLE   
all   gre   <extIP>:0 -> <ClientIP>:0   SINGLE:NO_TRAFFIC   

Zumindest aus meiner Sicht sieht eig. alles ... gut aus?

Und sorry für die späte Antwort, ich habe vergessen die Notifications zu aktivieren :(!

Besten Dank und liebe Grüsse

Mathias

Hallo Zusammen,

Ich betreibe noch einen alten Windoof PPTP Server. Von extern kann ich auf den Port 1723 zugreifen und die GRE Weiterleitung ist ebenfalls eingerichtet (lief bislang mehr oder weniger problemlos so)
Mir wurde aber kürzlich eine neue statische IP zugewiesen und im gleichen Atemzug habe ich ein Update auf v21.1 durchgeführt... seither bekomme ich den VPN Tunnel nicht mehr online...

Jemand eine Idee?

Herzlichen Dank und liebe Grüsse

Wuschy

Dears,

Since Update to v21, my MS RAS Server isn't reachable anymore... did some packet tracings and it seems, that no GRE packages are beeing forwarded anymore... any issues about this?

btw. I found this Bug Report:
https://forum.opnsense.org/index.php?topic=6192.0

Most confusing, at my home (with an Internet-IP address), the port-forward using "Rule NAT" works like a charm?!

Hi Gauss23

Thanks for your reply! Attached you can find the screenshot.
waiting for your feedback :)

Thanks and best regards

Wuschy

Finally found the solution, but don't know exactly why:
Filter rule association has to be set to "pass" instead of "Rule NAT" ... anyone knows why, or whats the difference?

Noone? No Idea? ... btw. it works with pfsense (interestingly not the ping so far, but I got an RDP connection working...)

Dear all,

I face the following issue:
I've a Microserver on which I want to have a "locked down" Virtualization environment / Appliance (ESXi, OPNsense & three Windows VMs). On our LAN, we have IPs 172.22.104.xxx with VLAN tags.
So the OPNsense's WAN interface is within our LAN (currently gets a DHCP IP) and the OPNsense's LAN interface is in 192.168.1.xxx range.

I have no problem to ping from within the Appliance to our company's LAN (172.22.104.xxx). But I totaly stuck on connecting or even pinging from the company's LAN to the Appliance.
I've created a pass rule for ICMP on the WAN interface, disabled the blockings for private and bogon networks: no ping response.
When I disable the firewall / paket filtering, I get the responses...

I've also created a port forward for RDP on to a VM without any success (which makes sense when I'm even unable to ping that thing).

Under Diagnostics - pfTop, I can see the incoming connection:
pfTop: Up State 1-31/31, View: default, Order: age
PR        DIR SRC                                           DEST                                                   STATE                AGE       EXP     PKTS    BYTES     
tcp       In  172.22.104.xxx:55675                          192.168.1.103:3389                                 CLOSED:SYN_SENT     00:00:08  00:00:29        4      192   
tcp       Out 172.22.104.xxx:55675                          192.168.1.103:3389                               SYN_SENT:CLOSED       00:00:08  00:00:29        4      192

Under Log Files - Live View I can't find anything at all...

Any ideas?

Thanks for any help!!