Messages

From the rules page you have to select either-or. But it does have a combined TCP/UDP type, which also are separate protocols, so it's entirely possible that the same is being done silently for ICMP&6. That would certainly be useful, but for clarity there should be a combined setting instead IMO.

Maybe either-or-any and for all of them you have the choice of ICMP and IPV6-ICMP.

You can find references to "Echo request" (type 8) and "Echo service request" (type 128) in the FreeBSD ICMP(4) and ICMP6(4) man pages ...

Thanks for the links, you are better than DuckDuckGo.

No results found for "Echo service request"

Suggestions:

    Check spelling
    Try related keywords
    Retry search without quotes: Echo service request

ICMP / Echo Request is for IPv4.

In context with opnsense firewall you can combine IPv6 with ICMP (echo request) and IPV6-ICMP (echo service request) - both work. To keep it simple, a single rule for IPv4/v6 (any) with ICMP (echo request) seems to work. So my two questions are:

Is there any reason to set up separate rules for IPv4 and IPv6 echo requests instead of a single rule?
Is there any difference between "Echo service request" and "Echo Request"? [1]

[1] I can't find an ICMP/ICMPv6 type "Echo service request" in any context.

Hello,

there are two options to get Ping for IPv6 to work:

• IPv6 / ICMP / Echo Request
• IPv6 / IPV6-ICMP / Echo service request

What is "Echo service request"? - I got no results searching for that exact phrase.

Thanx for any hint.

I see, thank you!

The second instance of the CPU identification lines starting with "CPU: Intel(R) Celeron(R) J6412 @ 2.00GHz (1996.80-MHz K8-class CPU)" shows that the plugin ran. If there is an update for your CPU model, it was applied.

Patrick, can you please explain, in what way the referenced line indicates the run of the plugin? - I see a similar line in my dmesg output, but the plugin is not installed.

Code Select Expand

---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(vga): resolution 640x480
[1] CPU: Intel(R) Atom(TM) CPU C3558 @ 2.20GHz (2200.21-MHz K8-class CPU)
[1]  Origin="GenuineIntel"  Id=0x506f1  Family=0x6  Model=0x5f  Stepping=1
[1]  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[1]  Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[1]  AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[1]  AMD Features2=0x101<LAHF,Prefetch>
[1]  Structured Extended Features=0x2294e283<FSGSBASE,TSCADJ,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[1]  Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
...

Thanks a lot!

Searched for that as well. The only hint I found [1] is the following:

"Layer 2 visibility covers physical connections: switch ports, VLANs, MAC addresses, and access point associations. Layer 3 visibility covers logical connections: IP addresses, routing paths, subnets, and gateway relationships. A tool that only provides Layer 3 maps cannot tell you which physical switch port a specific device is connected to. A tool that only provides Layer 2 maps cannot help you trace a routing problem."

[1]  https://blog.domotz.com/all/network-visualization-tools/  -  (search page for "Layer 3 Visibility")

Ich denke, Du hast Recht!!!!!

Du kannst der Opnsense eine weitere IP-Adresse geben, und diese für DNS-Anfragen verwenden. ;)

In Unbound (Port 53530) wurde eine Weiterleitung definiert für Telematik auf die Adresse des HSK Konnektors (nicht TunnelIP!!).

Bin nicht sicher ob das dein Problem ist, aber der Konnektor beantwortet grundsätzlich keine (DNS-) Anfragen seines Standard-Gateways.

Hi franco,

thank you for your explanation and I understand the reason for that decision.

One of the problems with disabled integrated authentication is that it downgrades password strength through SSH and for the console.  Console is less risk because you need "physical" access, but the game changes in SSH password authentication which should be avoided.

SSH is limited to ssh-keys, password login is not permitted.

For physical systems in server racks I enable auto console log in so I don't have to deal with this at all. The rack or the server room should provide enough protection.  ;)

My boxes are physical systems but located at customers place, so auto login is obviously no option.

Enforce 2FA for all administrators except root, which keeps password authentication, set an e.g. 40 character password and keep it somewhere safe for emergency access. Like failing time synchronisation.

That would be a nice solution (and root does not need direct remote access gui/ssh).

Additional use case:

Loading a customers configuration in a box without internet connection (no ntp server reachable).

Kind regards,
proctor

Hi,

what is the idea behind removing this feature?

I used the feature to force Web-GUI login via 2fa, SSH via keys, but allow console login and su for root without 2fa (sudo disabled). So root can't login (directly) at Web-GUI or SSH (no 2fa and no key). After update to 25.x i am not able to "su root".

Thanks for some explanation and ideas to get a similar setup again

Hallo derbert,

bin auch über das Problem - und dabei über deinen Beitrag - gestolpert. Zumindest in meinem Fall konnte ich feststellen, warum die automatischen Regeln allein nicht reichen. Diese umfassen nur ausgewählte ICMPv6-Typen. In meinem Fall war zusätzlich eine Regel notwendig, welche ICMPv6 Typ 130 (Multicast listener query) mit Ziel ff02::1 beinhaltet. Wozu das Paket benötigt wird, würde mich auch interessieren (DS-Lite?)...

Beste Grüße

Auja! Wir verlinken hier die schönsten Kommentare vom Heise-Forum! Dafür sollten wir ein eigens Board einrichten! :-D

Heise-Forum?

https://www.heise.de/news/APNIC-Chefwissenschaftler-IPv6-Einfuehrung-wohl-obsolet-9995140.html

https://www.heise.de/meinung/Kommentar-IPv6-obsolet-Ich-glaub-ich-steh-im-Wald-9999396.html

Thanks Patrick, my fault.
I was searching for (permanently) changes to the ssh keys to generate when i stumbled upon this question, so i had a "key-bias" in mind...