Messages

Thank you very much!
My problems have been solved with the help of your description.

;)

Sorry for the stupid question, but how exactly did you do that?

Hello,

Sorry, but I'm not Hackerman and I need some advice.
A few days ago I startet update procedure, but the system is unable to finish the update. It hangs somehow by "Fetching base-22.7.3-amd64.txz". What should I do? Any suggestions?

Thanks in advance
Sphyrna

Code Select Expand

***GOT REQUEST TO UPDATE***
Currently running OPNsense 22.7_4 (amd64/OpenSSL) at Thu Sep  8 11:09:00 CEST 2022
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (39 candidates): .......... done
Processing candidates (39 candidates): .......... done
The following 39 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
ca_root_nss: 3.80 -> 3.81
curl: 7.84.0 -> 7.85.0
ldns: 1.8.1 -> 1.8.3
libiconv: 1.16 -> 1.17
liblz4: 1.9.3,1 -> 1.9.4,1
libnet: 1.1.6_5,1 -> 1.2,1
libxml2: 2.9.13_2 -> 2.10.2
lighttpd: 1.4.65 -> 1.4.66
nettle: 3.8 -> 3.8.1
nspr: 4.34 -> 4.34.1
nss: 3.80 -> 3.82
opnsense: 22.7_4 -> 22.7.4
opnsense-lang: 22.7 -> 22.7.3
opnsense-update: 22.7 -> 22.7.3
php80: 8.0.20 -> 8.0.22
php80-ctype: 8.0.20 -> 8.0.22
php80-curl: 8.0.20 -> 8.0.22
php80-dom: 8.0.20 -> 8.0.22
php80-filter: 8.0.20 -> 8.0.22
php80-gettext: 8.0.20 -> 8.0.22
php80-ldap: 8.0.20 -> 8.0.22
php80-mbstring: 8.0.20 -> 8.0.22
php80-pdo: 8.0.20 -> 8.0.22
php80-phalcon: 5.0.0.r2 -> 5.0.0.r4
php80-phpseclib: 2.0.37 -> 3.0.14
php80-session: 8.0.20 -> 8.0.22
php80-simplexml: 8.0.20 -> 8.0.22
php80-sockets: 8.0.20 -> 8.0.22
php80-sqlite3: 8.0.20 -> 8.0.22
php80-xml: 8.0.20 -> 8.0.22
php80-zlib: 8.0.20 -> 8.0.22
py39-charset-normalizer: 2.1.0 -> 2.1.1
py39-pytz: 2021.3,1 -> 2022.2.1,1
py39-urllib3: 1.26.10,1 -> 1.26.12,1
rrdtool: 1.7.2_6 -> 1.8.0_1
sqlite3: 3.39.0,1 -> 3.39.2,1
syslog-ng: 3.37.1 -> 3.38.1
unbound: 1.16.1 -> 1.16.2

Installed packages to be REINSTALLED:
suricata-6.0.6 (needed shared library changed)

Number of packages to be upgraded: 38
Number of packages to be reinstalled: 1

The operation will free 1 MiB.
26 MiB to be downloaded.
[1/39] Fetching unbound-1.16.2.pkg: .......... done
[2/39] Fetching syslog-ng-3.38.1.pkg: .......... done
[3/39] Fetching suricata-6.0.6.pkg: .......... done
[4/39] Fetching sqlite3-3.39.2,1.pkg: .......... done
[5/39] Fetching rrdtool-1.8.0_1.pkg: .......... done
[6/39] Fetching py39-urllib3-1.26.12,1.pkg: .......... done
[7/39] Fetching py39-pytz-2022.2.1,1.pkg: .......... done
[8/39] Fetching py39-charset-normalizer-2.1.1.pkg: ........ done
[9/39] Fetching php80-zlib-8.0.22.pkg: ... done
[10/39] Fetching php80-xml-8.0.22.pkg: ... done
[11/39] Fetching php80-sqlite3-8.0.22.pkg: ... done
[12/39] Fetching php80-sockets-8.0.22.pkg: ..... done
[13/39] Fetching php80-simplexml-8.0.22.pkg: ... done
[14/39] Fetching php80-session-8.0.22.pkg: ..... done
[15/39] Fetching php80-phpseclib-3.0.14.pkg: .......... done
[16/39] Fetching php80-phalcon-5.0.0.r4.pkg: .......... done
[17/39] Fetching php80-pdo-8.0.22.pkg: ...... done
[18/39] Fetching php80-mbstring-8.0.22.pkg: .......... done
[19/39] Fetching php80-ldap-8.0.22.pkg: .... done
[20/39] Fetching php80-gettext-8.0.22.pkg: . done
[21/39] Fetching php80-filter-8.0.22.pkg: ... done
[22/39] Fetching php80-dom-8.0.22.pkg: ....... done
[23/39] Fetching php80-curl-8.0.22.pkg: ..... done
[24/39] Fetching php80-ctype-8.0.22.pkg: . done
[25/39] Fetching php80-8.0.22.pkg: .......... done
[26/39] Fetching opnsense-update-22.7.3.pkg: ..... done
[27/39] Fetching opnsense-lang-22.7.3.pkg: .......... done
[28/39] Fetching opnsense-22.7.4.pkg: .......... done
[29/39] Fetching nss-3.82.pkg: .......... done
[30/39] Fetching nspr-4.34.1.pkg: .......... done
[31/39] Fetching nettle-3.8.1.pkg: .......... done
[32/39] Fetching lighttpd-1.4.66.pkg: .......... done
[33/39] Fetching libxml2-2.10.2.pkg: .......... done
[34/39] Fetching libnet-1.2,1.pkg: .......... done
[35/39] Fetching liblz4-1.9.4,1.pkg: .......... done
[36/39] Fetching libiconv-1.17.pkg: .......... done
[37/39] Fetching ldns-1.8.3.pkg: .......... done
[38/39] Fetching curl-7.85.0.pkg: .......... done
[39/39] Fetching ca_root_nss-3.81.pkg: .......... done
Checking integrity... done (0 conflicting)
[1/39] Upgrading libxml2 from 2.9.13_2 to 2.10.2...
[1/39] Extracting libxml2-2.10.2: .......... done
[2/39] Upgrading sqlite3 from 3.39.0,1 to 3.39.2,1...
[2/39] Extracting sqlite3-3.39.2,1: .......... done
[3/39] Upgrading py39-pytz from 2021.3,1 to 2022.2.1,1...
[3/39] Extracting py39-pytz-2022.2.1,1: .......... done
[4/39] Upgrading php80 from 8.0.20 to 8.0.22...
[4/39] Extracting php80-8.0.22: .......... done
[5/39] Upgrading nspr from 4.34 to 4.34.1...
[5/39] Extracting nspr-4.34.1: .......... done
[6/39] Upgrading libiconv from 1.16 to 1.17...
[6/39] Extracting libiconv-1.17: .......... done
[7/39] Upgrading ca_root_nss from 3.80 to 3.81...
[7/39] Extracting ca_root_nss-3.81: ...... done
[8/39] Upgrading py39-urllib3 from 1.26.10,1 to 1.26.12,1...
[8/39] Extracting py39-urllib3-1.26.12,1: .......... done
[9/39] Upgrading py39-charset-normalizer from 2.1.0 to 2.1.1...
[9/39] Extracting py39-charset-normalizer-2.1.1: .......... done
[10/39] Upgrading php80-session from 8.0.20 to 8.0.22...
[10/39] Extracting php80-session-8.0.22: .......... done
[11/39] Upgrading php80-pdo from 8.0.20 to 8.0.22...
[11/39] Extracting php80-pdo-8.0.22: .......... done
[12/39] Upgrading php80-mbstring from 8.0.20 to 8.0.22...
[12/39] Extracting php80-mbstring-8.0.22: .......... done
[13/39] Upgrading nss from 3.80 to 3.82...
[13/39] Extracting nss-3.82: .......... done
[14/39] Upgrading nettle from 3.8 to 3.8.1...
[14/39] Extracting nettle-3.8.1: .......... done
[15/39] Upgrading libnet from 1.1.6_5,1 to 1.2,1...
[15/39] Extracting libnet-1.2,1: .......... done
[16/39] Upgrading liblz4 from 1.9.3,1 to 1.9.4,1...
[16/39] Extracting liblz4-1.9.4,1: .......... done
[17/39] Upgrading ldns from 1.8.1 to 1.8.3...
[17/39] Extracting ldns-1.8.3: .......... done
[18/39] Upgrading curl from 7.84.0 to 7.85.0...
[18/39] Extracting curl-7.85.0: .......... done
[19/39] Upgrading unbound from 1.16.1 to 1.16.2...
===> Creating groups.
Using existing group 'unbound'.
===> Creating users
Using existing user 'unbound'.
[19/39] Extracting unbound-1.16.2: .......... done
[20/39] Upgrading syslog-ng from 3.37.1 to 3.38.1...
[20/39] Extracting syslog-ng-3.38.1: .......... done
[21/39] Reinstalling suricata-6.0.6...
[21/39] Extracting suricata-6.0.6: .......... done
[22/39] Upgrading rrdtool from 1.7.2_6 to 1.8.0_1...
[22/39] Extracting rrdtool-1.8.0_1: .......... done
[23/39] Upgrading php80-zlib from 8.0.20 to 8.0.22...
[23/39] Extracting php80-zlib-8.0.22: ........ done
[24/39] Upgrading php80-xml from 8.0.20 to 8.0.22...
[24/39] Extracting php80-xml-8.0.22: ......... done
[25/39] Upgrading php80-sqlite3 from 8.0.20 to 8.0.22...
[25/39] Extracting php80-sqlite3-8.0.22: ......... done
[26/39] Upgrading php80-sockets from 8.0.20 to 8.0.22...
[26/39] Extracting php80-sockets-8.0.22: .......... done
[27/39] Upgrading php80-simplexml from 8.0.20 to 8.0.22...
[27/39] Extracting php80-simplexml-8.0.22: ......... done
[28/39] Upgrading php80-phpseclib from 2.0.37 to 3.0.14...
[28/39] Extracting php80-phpseclib-3.0.14: ......... done
[29/39] Upgrading php80-phalcon from 5.0.0.r2 to 5.0.0.r4...
[29/39] Extracting php80-phalcon-5.0.0.r4: ........ done
[30/39] Upgrading php80-ldap from 8.0.20 to 8.0.22...
[30/39] Extracting php80-ldap-8.0.22: ........ done
[31/39] Upgrading php80-gettext from 8.0.20 to 8.0.22...
[31/39] Extracting php80-gettext-8.0.22: ........ done
[32/39] Upgrading php80-filter from 8.0.20 to 8.0.22...
[32/39] Extracting php80-filter-8.0.22: ......... done
[33/39] Upgrading php80-dom from 8.0.20 to 8.0.22...
[33/39] Extracting php80-dom-8.0.22: .......... done
[34/39] Upgrading php80-curl from 8.0.20 to 8.0.22...
[34/39] Extracting php80-curl-8.0.22: .......... done
[35/39] Upgrading php80-ctype from 8.0.20 to 8.0.22...
[35/39] Extracting php80-ctype-8.0.22: ........ done
[36/39] Upgrading opnsense-update from 22.7 to 22.7.3...
[36/39] Extracting opnsense-update-22.7.3: .......... done
[37/39] Upgrading opnsense-lang from 22.7 to 22.7.3...
[37/39] Extracting opnsense-lang-22.7.3: .......... done
[38/39] Upgrading lighttpd from 1.4.65 to 1.4.66...
===> Creating groups.
Using existing group 'www'.
===> Creating users
Using existing user 'www'.
[38/39] Extracting lighttpd-1.4.66: .......... done
[39/39] Upgrading opnsense from 22.7_4 to 22.7.4...
[39/39] Extracting opnsense-22.7.4: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh'
Writing firmware setting...done.
Writing trust files...done.
Configuring login behaviour...done.
Configuring system logging...done.
=====
Message from py39-urllib3-1.26.12,1:

--
Since version 1.25 HTTPS connections are now verified by default which is done
via "cert_reqs = 'CERT_REQUIRED'".  While certificate verification can be
disabled via "cert_reqs = 'CERT_NONE'", it's highly recommended to leave it on.

Various consumers of net/py-urllib3 already have implemented routines that
either explicitly enable or disable HTTPS certificate verification (e.g. via
configuration settings, CLI arguments, etc.).

Yet it may happen that there are still some consumers which don't explicitly
enable/disable certificate verification for HTTPS connections which could then
lead to errors (as is often the case with self-signed certificates).

In case of an error one should try first to temporarily disable certificate
verification of the problematic urllib3 consumer to see if that approach will
remedy the issue.
You may need to manually remove /usr/local/etc/syslog-ng.conf if it is no longer needed.
You may need to manually remove /usr/local/etc/suricata/classification.config if it is no longer needed.
You may need to manually remove /usr/local/etc/suricata/reference.config if it is no longer needed.
You may need to manually remove /usr/local/etc/suricata/suricata.yaml if it is no longer needed.
=====
Message from opnsense-22.7.4:

--
Yes, I'm back in black
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
/var/cache/pkg/unbound-1.16.2~0baf494313.pkg
/var/cache/pkg/syslog-ng-3.38.1.pkg
/var/cache/pkg/unbound-1.16.2.pkg
/var/cache/pkg/syslog-ng-3.38.1~60086c019c.pkg
/var/cache/pkg/suricata-6.0.6~fd4f28b3a8.pkg
/var/cache/pkg/sqlite3-3.39.2,1.pkg
/var/cache/pkg/suricata-6.0.6.pkg
/var/cache/pkg/sqlite3-3.39.2,1~06900fee68.pkg
/var/cache/pkg/rrdtool-1.8.0_1~0dc6734766.pkg
/var/cache/pkg/rrdtool-1.8.0_1.pkg
/var/cache/pkg/py39-urllib3-1.26.12,1~71c72817dc.pkg
/var/cache/pkg/py39-urllib3-1.26.12,1.pkg
/var/cache/pkg/py39-pytz-2022.2.1,1~3b209c1113.pkg
/var/cache/pkg/php80-xml-8.0.22~d980dfcc16.pkg
/var/cache/pkg/py39-pytz-2022.2.1,1.pkg
/var/cache/pkg/py39-charset-normalizer-2.1.1~1f8a57b1eb.pkg
/var/cache/pkg/php80-zlib-8.0.22~2699c0407a.pkg
/var/cache/pkg/py39-charset-normalizer-2.1.1.pkg
/var/cache/pkg/php80-zlib-8.0.22.pkg
/var/cache/pkg/php80-sqlite3-8.0.22.pkg
/var/cache/pkg/php80-xml-8.0.22.pkg
/var/cache/pkg/php80-sqlite3-8.0.22~fd25130728.pkg
/var/cache/pkg/php80-sockets-8.0.22~4f8b115d02.pkg
/var/cache/pkg/php80-sockets-8.0.22.pkg
/var/cache/pkg/php80-simplexml-8.0.22~8132e90d4c.pkg
/var/cache/pkg/php80-pdo-8.0.22~bb8287a79e.pkg
/var/cache/pkg/php80-simplexml-8.0.22.pkg
/var/cache/pkg/php80-session-8.0.22~023f52737b.pkg
/var/cache/pkg/php80-session-8.0.22.pkg
/var/cache/pkg/php80-phpseclib-3.0.14~2d073726dc.pkg
/var/cache/pkg/php80-phpseclib-3.0.14.pkg
/var/cache/pkg/php80-phalcon-5.0.0.r4~c8dc4f3d73.pkg
/var/cache/pkg/php80-phalcon-5.0.0.r4.pkg
/var/cache/pkg/php80-mbstring-8.0.22.pkg
/var/cache/pkg/php80-pdo-8.0.22.pkg
/var/cache/pkg/php80-mbstring-8.0.22~4e8254d3e7.pkg
/var/cache/pkg/php80-ldap-8.0.22~330d87c4f2.pkg
/var/cache/pkg/php80-8.0.22.pkg
/var/cache/pkg/php80-gettext-8.0.22.pkg
/var/cache/pkg/php80-ldap-8.0.22.pkg
/var/cache/pkg/php80-gettext-8.0.22~8355821b51.pkg
/var/cache/pkg/php80-filter-8.0.22~e53de737a7.pkg
/var/cache/pkg/php80-8.0.22~b850716a2e.pkg
/var/cache/pkg/php80-filter-8.0.22.pkg
/var/cache/pkg/php80-dom-8.0.22~5089170f32.pkg
/var/cache/pkg/php80-dom-8.0.22.pkg
/var/cache/pkg/php80-curl-8.0.22~db29e51c7b.pkg
/var/cache/pkg/php80-curl-8.0.22.pkg
/var/cache/pkg/php80-ctype-8.0.22~d3d9d09472.pkg
/var/cache/pkg/php80-ctype-8.0.22.pkg
/var/cache/pkg/opnsense-update-22.7.3~7b3860334e.pkg
/var/cache/pkg/opnsense-update-22.7.3.pkg
/var/cache/pkg/opnsense-lang-22.7.3~a8f80b4e86.pkg
/var/cache/pkg/opnsense-22.7.4~e0db2bc6cd.pkg
/var/cache/pkg/opnsense-lang-22.7.3.pkg
/var/cache/pkg/nss-3.82~738963432a.pkg
/var/cache/pkg/opnsense-22.7.4.pkg
/var/cache/pkg/nss-3.82.pkg
/var/cache/pkg/nspr-4.34.1~30bbcdcefd.pkg
/var/cache/pkg/nspr-4.34.1.pkg
/var/cache/pkg/nettle-3.8.1~a9ee0d8e9a.pkg
/var/cache/pkg/nettle-3.8.1.pkg
/var/cache/pkg/lighttpd-1.4.66~f6f0e9f14b.pkg
/var/cache/pkg/lighttpd-1.4.66.pkg
/var/cache/pkg/libxml2-2.10.2~bb2cb29460.pkg
/var/cache/pkg/libnet-1.2,1~ae05435076.pkg
/var/cache/pkg/libxml2-2.10.2.pkg
/var/cache/pkg/libnet-1.2,1.pkg
/var/cache/pkg/liblz4-1.9.4,1~187eb4b4a0.pkg
/var/cache/pkg/liblz4-1.9.4,1.pkg
/var/cache/pkg/libiconv-1.17~e445ecf41e.pkg
/var/cache/pkg/libiconv-1.17.pkg
/var/cache/pkg/ldns-1.8.3~44ea0db849.pkg
/var/cache/pkg/ldns-1.8.3.pkg
/var/cache/pkg/curl-7.85.0~2631b2ae98.pkg
/var/cache/pkg/curl-7.85.0.pkg
/var/cache/pkg/ca_root_nss-3.81~d5c8a03b2d.pkg
/var/cache/pkg/ca_root_nss-3.81.pkg
The cleanup will free 26 MiB
Deleting files: .......... done
All done
Nothing to do.
Starting web GUI...done.
Generating RRD graphs...done.
Fetching base-22.7.3-amd64.txz: ..................................

There are many more signs of "....." at the end

Hallo liebe Leute,

nachdem ich viel über OPNsense und die damit verbundenen Möglichkeiten gelesen habe, versuche ich gerade unser WG-LAN zu pimpen und habe dazu die bisherige FritzBox durch eine OPNsense ersetzt.
Leider ist die Lernkurve für mich sehr flach. Ich bin schon glücklich, die Telefonie zum Laufen gebracht zu haben....

Folgende Ziele möchte ich aus augenblicklicher Sicht noch erreichen:
a) Trennung des LANs in VLANs mit einem managed-Netgear-Switch (Netgear GS324T S350 – 24-Port)
b) Ausfilterung von Werbung mittels Unbound
c) Einrichtung von LetsEncrypt-Zertifikaten, so dass die Management-Oberfläche ohne Warnungen ansprechbar ist
d) Einrichtung eines VPN-Servers für entfernten Zugriff auf unser privates LAN
e) Einrichtung von Parsec, so dass ich in gefühlter Echtzeit per VNC auf meine VMs komme

Leider habe ich Schwierigkeiten für mich nachvollziehbare Tutorials zu finden.



Zunächst möchte ich Ziel a) erreichen. Folgende Ausgangssituation:

Ist:


      WAN / Internet
            :
            : Deutsche Glasfaser
            :
      .-------+-------.
      |  Gateway   |  NT (Network Terminator)
      '-------+-------'
                |
        WAN | geNATtete IPv4 und IPv6 (Präfix 56)
                |
      .-------+----------.   
      |  OPNsense   |  OPNsense 21.1.8_1-amd64 (Mini-PC: 2 NICs, 8GB RAM, 256GB SSD, Intel Core i5-5257U)
      '-------+----------'   
                |
        LAN | 192.168.2.1/24
                |
      .-------+---------.
      | LAN-Switch  |  Netgear GS324T S350 – 24-Port
      '-------+----------'
                |
    ...-------+--------... (Clients/Servers)


Clients/Servers:
2x Windows Laptop
Windows Desktop
Ubuntu Desktop
Aquariencomputer (GHL ProfiLux)
Dosiergerät (GHL Doser 2.0)
Raspi mit LibreElec
Unraid-Server mit vielen VMs (MacOS, Windows, Linuxe)
Drucker über LAN
Synology-NAS (DS 2415+)
Fritzbox 7390 für WLAN und SIP-Telefonie
2x Freifunk Router





Ziel:


      WAN / Internet
            :
            : Deutsche Glasfaser
            :
      .-------+-------.
      |  Gateway   |  NT (Network Terminator)
      '-------+-------'   
                |
        WAN | geNATtete IPv4 und IPv6 (Präfix 56)
                |
      .-------+---------.
      |  OPNsense  |  OPNsense 21.1.8_1-amd64 (Mini-PC: 2 NICs, 8GB RAM, 256GB SSD, Intel Core i5-5257U)
      '-------+---------'   
                |
        LAN | 192.168.2.1/24
                |
      .-------+------.
      | LAN-Switch |  Netgear GS324T S350 – 24-Port
      '-------+------'
                |
    ...-------+------------------+------------------+------------------+------------------+-----...
                |                       |                      |                       |                       |
                |                       |                      |                       |                       |
                |                       |                      |                       |                       |
      .-------+-----.      .-------+-----.      .------+------.      .-----+------.      .------+-----.
      |  VLAN1   |      |VLAN100 |      |VLAN200 |      |VLAN300 |     |VLAN400 | 
      '-------+-----'       '-------+-----'      '------+------'       '-----+-------'     '------+------'

                               privat               Tel./WLAN       Freifunk-Router     Management
                                                       (Fritzbox 7390)                             OPNsense
                         
                         
Ich bin in einigen Punkten noch sehr unsicher. Bevor ich nun anfange zu basteln, habe ich ein paar Fragen, die ich bitte zu beantworten:

Ist mein Ziel so sinnvoll und erreichbar?
Wie würdet ihr die Trennung in VLANs umsetzen?
Ist es ratsam DHCP für die VLANs in dem Switch zu erledigen oder besser in der OPNsense?
Wie bekomme ich die VLANs des Switches an die OPNsense angebunden?
Wie kann ich sicherstellen, dass ich mich bei der Einrichtung des VLAN400 (Management OPNsense) nicht selbst ausschließe und die OPNsense erreichbar bleibt, bzw. wie kann ich VLAN400 sicher an einen ausgewählten PC in VLAN100 exklusiv durchreichen?
Wie bekomme ich es hin, dass ausgewählte Geräte im VLAN200 auch ins VLAN100 kommen?
Kann mir jemand vielleicht noch einmal mit einfachen Worten den Unterschied zwischen "untagged" und "tagged" am Switch erklären?

Vielleicht gibt es ja schon schöne Tutorials zu meinen Fragen und ich finde sie einfach nicht? Hier wäre ich um Hinweise dankbar!


Soweit zunächst...

Besten Dank und viele Grüße

Sphyrna