Messages

Ntopng scans for vulnerabilities in your network including SSH on port 22 ...

Are you using ssh for anything?

PPPoE läuft teilweise nur auf einem Core und mit der aktuellen Implementierung (mpd5) ist es schwierig, mehr als 1 G/s zu erreichen. Ist aber eigentlich ein Provider-Problem. PPPoE gehört weg. Braucht kein Mensch.

@Zapad weshalb sollte die OPNsense nicht mit wire speed zwischen den VLANs routen? 2,5 G/s ist nun wirklich keine Kunst. 1 G/s schafft sogar ein APU4D4. Es ist nur PPPoE, was problematisch ist.

1. Does anybody know how to fix the boot loader problem - that seems simplest but the various things I tried didn't seem to work.

That's quite simple, actually. You need to copy the current boot loader to your drive. You did not provide the details of your pool topology, so I am assuming you are running the OPNsense default install on a single drive. Correct?

Anyway you need a system with a current boot loader up and running. If you can afford the downtime, just boot your system with a FreeBSD 14.2 image from USB.

Then check with

gpart show

what your partition layout looks like. Mine is this:

Code Select Expand

root@opnsense:~ # gpart show
=>       40  500118112  nda0  GPT  (238G)
         40     532480     1  efi  (260M)
     532520       1024     2  freebsd-boot  (512K)
     533544        984        - free -  (492K)
     534528   16777216     3  freebsd-swap  (8.0G)
   17311744  482805760     4  freebsd-zfs  (230G)
  500117504        648        - free -  (324K)

So we have an EFI partition and a legacy boot partition and since we do not know how your system boots we will update both of them. Replace the device names as fits your system. I assume you have a shell in a current FreeBSD 14.2 system, checked your partition layout and know which partition contains what. E.g. EFI is partition 1 and legacy is partition 2 - adjust if necessary. Same for the device ("nda0" in my case).

Code Select Expand

# update legacy boot code
gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 2 nda0
# update EFI boot code
mount -t msdosfs /dev/nda0p1 /mnt
mkdir -p /mnt/efi/boot /mnt/efi/freebsd
cp /boot/loader.efi /mnt/efi/boot/bootx64.efi
cp /boot/loader.efi /mnt/efi/freebsd/loader.efi
umount /mnt

HTH,
Patrick

OK, hash policy needs to match, LACP slow or fast interval needs to match. You probably need to explicitly set these on the OPNsense side.

Most common is L2+L3 hash.

What kind of switch is at the other end and are the ports properly configured for LACP?

Best put this as a feature request on github, please.

The source port is not 53 but any.

I wasn't aware of that. We have Unifi gear in two office locations with the controller placed in our data centre, so routed connection. I have been using option 43 ever since we started to use Unifi.

So I could add a host override for "unifi." in Unbound ...

Anyway Kea in OPNsense needs a procedure to introduce selected custom options we agree on. I'll give it a try.

This means, KEA + Unbound with static leases could work for businesses if they want a different DHCP server + DNS server combination. (As it exists right now)

It does for me at home and will do @work once we get the unifi option 43 issue solved. I am indeed quite satisfied with Kea, needs only minor improvements.

Kind regards,
Patrick

Vielleicht hilft dir ja, was ich hier geskriptet habe:

https://github.com/punktDe/vagrant-opnsense

Es gibt bis jetzt keine automatische Übernahme. Einige User hier habe Skripte gepostet, die z.B. bei der Übernahme statischer Leases helfen.

Z.B. der liebe @meyergru:

https://github.com/meyergru/iscdhcp_to_kea

Sorry, I have one isolated system that is still on version 22.1 "for reasons" and in the e.g. Firewall > Rules > LAN view the menu with the "Automatically generated rules" is just right there in the upper right corner.

That has been there for as long as I have been using OPNsense.

Da die OPNsense das Passwort im Klartext braucht, ist das nicht wirklich verschlüsselt sondern nur verschleiert.

Code Select Expand

base64 -d
<-- hier per Copy & Paste den String aus der Config einfügen und ENTER
Ctrl-D

Beispiel:

Code Select Expand

$ base64 -d
Z2VoZWltCg==
geheim

Gruß
Patrick