Messages

User SSH keys will be part of the config.xml if you added them through the UI.

Ah, yeah found that out as I went ahead and did my reinstall. I also found it helpful to copy everything that I thought I might need besides the config.xml onto the opnsense usb stick so it would be there after I installed from it :).

Things I found:

• Using adguard as my primary DNS made this more difficult as the system could not install the adguard package (or any other additional packages/plugins) without DNS. I had to add 8.8.8.8 as my DNS until I got my plugin install finished.
• SSL certs (I use acme with letsencrypt) were saved in the config.xml, but were not saved out into the filesystem for something like adguard to use until I forced acme to renew the cert.
• I use bash on the user that I ssh into my opnsense box with, so I could not ssh in until I either changed that user to /bin/sh or installed bash.

Other than that, things went pretty smoothly and I'm now on zfs - something new to learn about :).

To go to 25.1, I think I'm going to do a reinstall and give myself a chance to switch to zfs, too. My question is if there is a checklist for doing a reinstall for things to consider besides just having your saved config.xml

Here's what I can think of (having not done it yet):

• SSL certs. It looks like these may be in the config.xml, but will the system place them in the filesystem where they need to go?
• user SSH keys
• Adguard Home config. And any other "3rd party" tool like this.

Anything else?

Yes! The disabling VLAN hardware filtering is what I was missing. I had it set to default. Thank you.

I'm running 21.7.1

I've been using suricata for a couple years. Originally, I had no VLANs and ran a pretty flat network. I recently redid my network and added an AP that supports VLANs. It it connected to its own interface on my router PC, my wired switch connects to another interface. I am running several VLANs on the WLAN. I realized yesterday that I never enabled suricata on the network port (igb) that the AP is on, so I did that yesterday.  Everything on a Wifi VLAN broke.
Details I have since found:

• Things are only broken if IPS is enabled
• Things are still broken even with no rules with IPS enabled
• clients are not able to get a DHCP address assigned.

As I was writing this I realize that it looks like dhcpd is trying to assign clients on the VLANs an address for the physical subnet for that port and then the client can't use that IP because it is for the wrong network.

Is there some settings I need to tweak somewhere?

I noticed the same thing and chalked it up to things being a bit weird during the upgrade process.

I'm running 21.1.6 on bare metal, single wan interface.

I had an issue last week where I was experiencing what seemed like service brownouts for many websites/services. I couldn't complete a login to gmail. I stopped being able to see all of my photos in google photos and couldn't upload new ones. I checked google's status page, all green. After looking around my opnsense box, I noticed that the firewall was blocking a ton of stuff heading out to the internet with the default deny rule. All of this was working fine the previous day, but for some reason opnsense decided that certain IPs should be blocked by the default deny rule. I wasn't sure if there was some cache I could choose to clear or service I could restart, so I rebooted and everything went back to normal.

This happened right before I was leaving on a trip for a few days so I just wanted ti back to working. The filter logs seem to have rolled over so I can't post a log og exactly what happened.  Today I will set up sending logs to a server on my network :)

Has anyone else experienced the firewall starting to block things with the default deny rule when it should not?

any better on 21.1.1?