Messages

Any solution for Cloudflare users? I thought I read something about custom settings but I don't see anywhere to do that.

So despite a UPS and other measures I've taken to ensure my OPNsense box never loses power abruptly I still end up unplugging a wrong cord or a battery fails or whatever and the Unifi Controller mongodb seems to instantly corrupt. Maybe there is a way of fixing this but restoring from an automated backup has been the only method I have attempted. Anyway, here is the script I wrote that will fix the corrupted database quick.

Code Select Expand

#!/usr/local/bin/bash
service unifi stop
pkg remove -y unifi6
mv /usr/local/share/java/unifi /usr/local/share/java/unifi.bad
pkg install -y unifi6 os-unifi-maxit
cp -pRv /usr/local/share/java/unifi.bad/data/backup /usr/local/share/java/unifi/data/backup
service unifi start
rm -rf /usr/local/share/java/unifi.bad
ipaddr=$(ifconfig em1 | grep 'inet' | awk '$1 == "inet" { print $2 }')         
echo "Now to go https://$ipaddr:8443 and restore your backup."
read -p "Press enter to continue" continue
service unifi start


I place this in a file called /root/unifi-fix.sh then make it executable "chmod +x unifi-fix.sh" and then execute it ./unifi-fix.sh

Unfortunately, this still hasn't really had the effect I was looking for. Traffic for my domain is still showing up as a threat but rather "Undecidedly Safe" rather than  Firstly Seen. It does show it's whitelisted when I'm looking at TLS Live Explorer but I still have my original problem where I will most likely not see a threat because I'm so overloaded with false positives from my own domain. I'm hoping this will be improved upon over time.

I asked proposed this question to their support (who got back with me within minutes) and gave me this solution..

add whitelist (Policy - Web Controls - Auto Whitelist) Check that box at the bottom and this will submit it to their team to review for recategorization.

OR

Use https://www.sunnyvalley.io/site-classification/

I had done the first method but had not checked the box since my domain isn't really for public consumption but this is what needs to happen in order for it not to show up.

Also worth noting that specific hostnames can be specified as well since I have several different types of services running off our domain.

Scaling options seem to depend a lot upon how many clients you have. With 8GB of memory, you max out at 100 devices, or at least what they recommend. That being said, I use it on a 1000/30 connection using a Dell Optiplex 3020 SFF, i5-4570, 8GB, 256GB SSD and Intel Quad NIC. CPU usage is minimal but memory usage usually sits around 70% (easily doubled memory usage after installing Sensei). About to upgrade to an i7-4770 and 16GB of RAM in the same box just because it's available to me. I think the number of devices/memory usage table is in the documentation somewhere, if not it talks about it during the setup wizard.

Hi,

example.com covers *.example.com.

I unable to get this to work. Even entering the FQDN it still shows up as a Firstly Seen Site.

Ok, this worked. I filtered on the destination host names.

my domain is iznmort.com

Seems like it would be a good option to be able to add in the settings your own domain and treat it special.

I have several subdomain it keeps identifying despite entering the parent domain. Is there a way to do multiple or wildcards?

Wireguard!! That's what was causing it, a month or so ago I was in the middle of setting up a connection to a remote server, got side tracked and never came back to finish it up. Also, have yet to successfully setup a connection like that so I'm sure there were incorrect parameters.

None-the-less you got me pointed in the right direction, thank you, thank you!

I'm unable to get OPNsense to check for updates because DNS is failing.

/etc/resolv.conf has an incorrect nameserver (10.13.13.1) that I cannot ping and also says it's generated by resolvconf

I can modify my DNS settings through System->Settings->General but when I reboot it reverts back to the incorrect configuration.

Also running, Unifi controller through 3rd party repo, wondering if this isn't the cause?

+1, thanks!