Messages

1

General Discussion / New install, newbie question: 1 physical interface, shall it be LAN or WAN ?

« on: November 25, 2019, 10:02:44 am »

Dear all,

I'm new to OPNSense and I love it. Yesterday I wanted to try it's OpenVPN functionality and it didn't work, clients connected almost.. then after waiting, dropped out. I think my setup is special so I better tell you the situation.


What I have: classic router setup.
- 1G WAN (ftth), ASUS RT-N56U B1 router with Padavan firmware, doing classic NAT, routing, basic firwalling and OpenVPN
- OpenVPN functionality is limited + when it works, it's slow. My upload is capable of ~300Mbits (real), friend's download at 100Mbits and connection speed between us capped at around 10Mbits or so, while the ASUS router's CPU was heavily maxed out.


What I wanted to experiment with: provide OpenVPN Server functionality with OPNSense and port forwarding in a Virtualbox VM, being on the LAN (via bridge mode in VBox config, no nat).
- OPNSense got an internal LAN ip from my ASUS box
- 1 virtual interface up & running


And here I'm stuck.

How can I configure OPNSense to work with 1 interface, get it's IP from the ASUS router as usual and serve as an OpenVPN endpoint for my friend ? I have an SMB share on the Windows host (same subnet like VM since VM is brigded) and I'd like to make it visible for my friend coming in via OpenVPN. Is 1 interface enough for this trick ? Shall it be WAN or LAN ? Or shall I assign 2 interfaces in the VM config for OPNSense, both bridged mode into my router's LAN (where the VM host itself sits too) then make one WAN, the other LAN, disable NAT in OPNSEnse, disable DHCP, and configure OpenVPN somehow on this weird setup ?

I simply don't understand - yet - what to assign where to make it work.


To put it simple: the OpenVPN endpoint would be my OPNSense instance, sitting on the same LAN like the host itself and other devices. This LAN is the good-old classic basic setup provided by my ASUS Router and my friend reaches the OPNSense VPN concentrator via the ASUS router's public IP & port forwarding.

Maybe I just need a basic overview of the logic, what interface how to assign where... and getting used to the OPNSense terminologies.


On my old Debian it wasn't an issue: 1 interface, eth0 LAN, internal ip, provided by the router (fixed IP via MAC Address &DHCP), port forward set up, friend cames in and woo-hoo, there he is. I didn't have a WAN interface. But apparently in OPNSense it might be needed to provide one .. or not. The logic is missing in my head.

(Maybe I can do it with 1 LAN interface the other way around: I don't need to set up a 10.0.8.0/24 subnet in OpenVPN config so then it can connect my friend with my subnet, not sure).

Huh. 

Anyway... just playing around with OPNSense but I'm going to switch over to this and use my ASUS as a plain WiFi AP, nothing more.

2

Hardware and Performance / HW for 1GB WAN speed, openvpn stongest encryption, IDS/IPS, squid, all of this..

« on: November 25, 2019, 09:42:58 am »

Dear all,

I'm new into OPNSense, just installed it yesterday in a VirtualBox VM to play around with it. And I like it, omg, what a great software. Respect to the whole team and all developers involved in the project.

Now the big question regarding hardware:
- I'd like to buy/build a small appliance to place it next to the Broadband router I got from my ISP

- I managed with them a bridge mode so PPPoE dial-up and everything is done now via an ASUS router

- router CPU is weak when I enable OpenVPN + OpenVPN uses 1 thread only.. a true bottleneck when one of my friends connects to my network.

- WAN is 1Gbit FTTH (1000/300)

- Power consumption is an question so I'd like to balance it out nicely, I don't want to use old appliances & old PCs because they're good but still a waste of heat and energy

- Like for women, size matters here too: I'd like to place it next to my media converter's small box so ITX it the absolute maximum I think.

Are there any good best buys ? I need a good price/performance (who doesn't ?).. shall I jump into those x86 Atom/Celeron bases mini ITX fancy boards or look for some more decent CPU ? (i3, Ryzen3 maybe?)

I'd run tons of things on the system, like openvpn at great speeds, suricata, squid and all other CPU intensive things + NAS function too (not sure if OPNSense has a NAS service, if not, I might consider to run it in a VM on the host and run the NAS&DLNA server part separately in another VM instance).

3

Hardware and Performance / Re: OPNsense 20.1 on RaspberryPI 3

« on: November 25, 2019, 09:27:25 am »

This is interesting for me too, looking for a nice router box with plenty of power to survive QoS-ing, OpenVPN (Gigabit WAN) and all these from hardware. I think the Pi4 would suit my needs.. just got one for a different project (media player with Volumio) but if OPNSense runs on the Pi4 well, it might be powerful enough for my needs.