Messages

Adding this here in case someone else encounters this same problem and arrives here via Google.  Never did figure this out but it stopped on it's own after about an hour.  Some temporary ghost in the machine....

I am seeing errors consistently printed to the system log.  Here's a sample:

Code Select Expand


2021-03-17T09:21:44 api[17144] no matching csrf found for request
2021-03-17T09:21:44 api[43449] no matching csrf found for request
2021-03-17T09:21:39 api[17144] no matching csrf found for request
2021-03-17T09:21:39 api[43449] no matching csrf found for request
2021-03-17T09:21:34 api[17144] no matching csrf found for request
2021-03-17T09:21:34 api[43449] no matching csrf found for request
2021-03-17T09:21:29 api[43449] no matching csrf found for request
2021-03-17T09:21:29 api[17144] no matching csrf found for request
2021-03-17T09:21:24 api[43449] no matching csrf found for request


I don't know how to troubleshoot this and any help would be greatly appreciated.  Here's some information on my setup

Code Select Expand


OPNsense 21.1.3_3-amd64
FreeBSD 12.1-RELEASE-p14-HBSD
OpenSSL 1.1.1j 16 Feb 2021
Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz (4 cores)


I am not positive when these started (b/c I stupidly cleared my log), but I did just make some changes to my wireguard firewall rules.  No idea if that's related.  FWIW, everything seems to be running fine, but these errors are concerning nonetheless. 

Thanks in advance for any help.

Following up here in case anyone else seems to encounter this problem.  It seems to be correlated to the usage of RAM disks for /tmp or /var.  Disabling those settings in Administration > Misc cleared up the problem for me.

Does anyone know why these settings may be causing periodic outages of OPNsense connectivity?

I admit to being a little confused about which interfaces to place intrusion detection on.

Here is my network topology

6 Port Protectli box

• 2 Empty ports (LAN and OPT1) -
  
• Lagg0 (named TRUNK) - 3 ports in LACP LAGG going to Cisco managed port in trunk mode-> 10.0.10.1/24
• VLAN10 - HOME - 10.0.0.1/24
• VLAN20 - GUEST - 10.0.20.1/24
• VLAN30 - SERVERS - 10.0.30.1/24

All traffic is tagged in the switch and passed through the LAGG.

I believe I don't need intrusion detection on the WAN since it's completely locked down using firewall rules. I do want it on my internal network to ensure that nothing is compromised.

In the Intrusion Detection admin page in the interfaces dropdown I see the all the interfaces linked above AND I see em3, em4, em5 which are the physical ports that I have set in the LAGG. 

Should I be setting intrusion detection on the single interface named TRUNK and assume it can see all the traffic from the VLANS? Should it be set to the physical interfaces which comprise the LAGG?  or to the VLANS themselves?

Providing a little more information

There were three changes made the day that I started seeing these errors:

1. upgrade to OPNsense 21.1.1-amd64
2. Move /var and /tmp to a RAM disk via the GUI
3. Blocking all IPv6 on the entire network

Hopefully that information may help someone point me in a direction to start to troubleshoot this

I am experiencing a perplexing, and troubling problem where at seemingly random intervals all devices on my local network lose connection to the router.  I have no idea if WAN connectivity is dropped as well since, during these moments, my internal IPs are dropped.  This started happening ~2 days ago which roughly corresponds to updating to OPNsense 21.1.1.

Topology

Fios -> OPNsense 21.1.1-amd64 running on a 6 port Protectli -> Cisco managed switch

Connections in use

- Lagg0 (three nics using LACP in trunk mode to the switch) -> 10.0.2.0/24
- VLAN10 (HOME) -> 10.0.0.0/24
- VLAN 20 (Guest) -> 10.0.20.0/24
- VLAN 30 (Servers) -> 10.0.30.0/24

When the connection problems occur, I receive an IP from the opnsense in a range I'm not using at all.  192.168.97.15 with a netmask of 255.255.0.0

Unfortunately, I'm really not certain where to start even troubleshooting this issue.

Oddly, seems to have resolved itself.  Rebooted today and the drive mounted.  I changed nothing from the config above.  anyhow, going to mark this as solved due to a ghost in the machine

I can't seem to get my 4Gb USB drive to automount at load. I plan on symlinking `/var/log` and `/tmp` to this drive to save writes to my root SSD. 

Code Select Expand


root@opnsense:/ # gpart show da0
=>     40  7856048  da0  GPT  (3.7G)
       40  7856048    1  freebsd-ufs  (3.7G)


Code Select Expand


root@opnsense:/ # cat /etc/fstab
# Device Mountpoint FStype Options Dump Pass#
/dev/gpt/rootfs / ufs rw,noatime 1 1
/dev/gpt/swapfs none swap sw 0 0
/dev/da0p1 /mnt/usb_drive ufs rw,noatime 2 2


Code Select Expand


root@opnsense:/ # df -a -H
Filesystem         Size    Used   Avail Capacity  Mounted on
/dev/gpt/rootfs    107G    2.3G     96G     2%    /
devfs              1.0k    1.0k      0B   100%    /dev
devfs              1.0k    1.0k      0B   100%    /var/dhcpd/dev
devfs              1.0k    1.0k      0B   100%    /var/unbound/dev


Running `mount -a` successfully mounts the drive.  Any idea why it's not mounting when I restart? 

makes sense.  thanks for helping me out.

hrm. I was afraid it was a problem similar to that.  So, if that is, indeed, the issue am I right in assuming there would be no way to configure the OPNsense router to lift/shift to replace my old one in the same network space while having Internet access while doing the configuration?

thanks for the swift response

I recently purchased gear to upgrade my network and have chosen OPNsense as my firewall/router.  To allow the switch from one router to another, I am working to configure OPNsense as far as I can before switching out my old router for the new one. 

I successfully got OPNsense up and running with a new install with a 192.168.1.1/24 range in the LAN with the WAN being provided via DHCP from my current router.  However, my desired end state network uses 10.1.1.1/24, not 192.168...  So, I reset OPNsense to factory settings and set 10.1.1.1/24 as the LAN static IP.  However, now nothing is working. 

Fios --> ASUS RT-AC86U (10.1.1.1/24 private IP space) --> OPNsense

OPNsense details

• WAN DHCP (has IP of 10.1.1.177 from the Asus' DHCP)
• LAN IPv4 10.1.1.1/24 with DHCP enabled
• allow all firewall rules for LAN/WAN

I successfully get an IP and can access the OPNsense web gui when connected to LAN. However, neither a LAN connected computer nor the OPNsense box itself are able to connect out to the Internet.  Example, Pinging 1.1.1.1 from the OPNsense web gui times out. 

I am assuming that my problem is based on the fact that my legacy network is using the same RFC-1918 private networking space (but I'm not positive) since it worked with OPNsense using 192.168.1.x.

Any help or thoughts getting this up and running would be greatly appreciated.