Messages

@Franco,

Is Strongswan 6 going to be in 25.1?

I do this via MSS and have for years, no issues or concerns using MSS instead of setting MTU on the interface.

updated with your code Patrick and then enabled the option in the client section for my AP's, no more error/warning and devices can still connect correctly.

Thx for the fix/update.

Hopefully @Franco can merge it in the next release

Sorry, I don't know that one with the plugin repo for sure. The repo is used to build the plugins, I doubt you can live patch a running installation with opnsense-patch directly from it.

With "manual" I meant download the diffs and apply them locally. But to make this easier:

Code Select Expand


cp /usr/local/opnsense/service/templates/OPNsense/Freeradius/clients.conf /usr/local/opnsense/service/templates/OPNsense/Freeradius/clients.conf.bak
fetch -o /usr/local/opnsense/service/templates/OPNsense/Freeradius/clients.conf https://raw.githubusercontent.com/punktDeForks/opnsense-plugins/56cc9312f184a60e8b0916cffc1e204f3dd225f3/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/clients.conf
cp /usr/local/opnsense/mvc/app/models/OPNsense/Freeradius/Client.xml /usr/local/opnsense/mvc/app/models/OPNsense/Freeradius/Client.xml.bak
fetch -o /usr/local/opnsense/mvc/app/models/OPNsense/Freeradius/Client.xml https://raw.githubusercontent.com/punktDeForks/opnsense-plugins/56cc9312f184a60e8b0916cffc1e204f3dd225f3/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Client.xml
cp /usr/local/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSClient.xml /usr/local/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSClient.xml.bak
fetch -o /usr/local/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSClient.xml https://raw.githubusercontent.com/punktDeForks/opnsense-plugins/56cc9312f184a60e8b0916cffc1e204f3dd225f3/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSClient.xml


@franco could you help, please? Can one apply this set of patches with opnsense-patch? If yes, how exactly?

https://github.com/punktDeForks/opnsense-plugins/commit/56cc9312f184a60e8b0916cffc1e204f3dd225f3

you need to auth as the mailbox you want to send the message from, see attached pic

Trying to setup Monit to work with sending an email to Outlook.com.  Have everything working but I am getting an error because Outlook does not allow the sending email to be something different then the email address of the account that I am using.  As of right now Monit is saying that the sender's email is coming from monit@routername.domain.  I need to get this changed to address@outlook.com.  Does anyone know if this is possible.  I looked in the configuration but could not find any setting like this.

Thanks

mine just started working on chrome and FF with 24.7.4

Firewall > Settings > Advanced > Firewall Maximum Table Entries, Sure you have enough set here? I always have to update this field larger than default when using the maxmind GEOIP data with aliases.

I dont see "magic" rules except for the Tunnel Settings (legacy) site to sites, for the Connections (non legacy) i dont see the same "magic"  in Automatically generated rules (end of ruleset).

I dont mind the "magic" as it saves me from having to create a rule for each Site to Site I have, granted I could prob make 1 ruleset and apply to an alias and add all the site to site IPs in the alias. Just easier with the magic and im lazy

Plus im in the process of migrating the last few tunnels I have under legacy to the newer connections.

There is no need to add the same rules twice. That said, I'd recommend to set up proper firewall rules manually and untick that "magic" checkbox. Avoid all similar disruption in the future.

@franco,

I see the Automatically generated rules (end of ruleset) after applying both patches and running related commands. Testing now on legacy tunnels.

As for non legacy tunnels we do or do not need to add in WAN rules for inbound IPSEC? I have not added any rules for ESP/ISAKMP/NAT-T and my non-legacy tunnels appear to be working correctly.

We are having similar issues

delete /var/spool/lock or the contents and subdirs of said folder, i forget which one it was and restart service, thats what ive done when getting lock errors and it works.  I updated to 24.7.2 and my APCUPSD is working normally

My radius is still working with this AP, i dont see where to set this option in opnsense. Any ideas?

Error: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!   
Error: Please set "require_message_authenticator = true" for client AP1   
Error: It looks like the client has been updated to protect from the BlastRADIUS attack.   
Error: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!   
Error: Setting "require_message_authenticator = true" for client AP1   
Error: BlastRADIUS check: Received packet with Message-Authenticator.   
Error: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Chrome ver 127.0.6533.100 and latest FF version are strange with the traffic graph for me, on my iphone safari it works fine.

See attached animated gif, its been like this since 24.7 update

ive seen this on windows with openvpn client, there are 2 clients, the OpenVPN Connect is where i had these issues with users, had them use the Community Client https://openvpn.net/community-downloads/ and suffix search was working for me.

@franco

Updated from RC2 and dev kernel to 24.7 Release with no issues/crashes

@franco

updated kernel and rebooted, did the same steps previously done to cause a crash and no crash this time. I'll keep running this kernel for the day unless you want us to try the 24.7.r2_3 kernel.

@danderson @csutcliff and anybody else who would like to help:

# opnsense-update -zkr 24.7.r2_2


Cheers,
Franco