Messages

ahh, no?

https://www.fs.com/products/185594.html

And bevor you ask, friend of mine his XGS-PON with that and OPNsense ;)

@tedhugehes I you would at least only slop your own thread, instead of someone elses. *old man yelling at cloud* Back in my days, we called that thread hijacking.

So much noise and wasted energy.
And for what? To realize that it is stupid not to directly input your ISP's fiber into your OPNsense? And that a unnecessary transceiver makes no sense?

Sorry if I am wrong, I just skipped it, not going to read that AI slop.

Same "issue" here.

26.4.1p1_3-amd64

DEC750

I don't code either.
So the best I can do is to review your readme, which describes your architecture.

to avoid unnecessary write cycles on the system SSD.

A backup is like what, 250k? That does not bother any SSD, not even if I do a hourly backup.

Automatic Daily Backups: Configure a specific time for daily backups.

Why should I want that? My config stays the same, sometimes for months. Instead of doing a daily backup, I just do a backup after I change something in the webGUI. Simply by downloading the XML. Doing a backup on any interval, IMHO, does not make sense. But okay, since it is so small and programming anything else is too complicated, you could do it like the Google Drive backup; daily and keep the last 30 or whatever.

Backup Management: List, download, restore, and delete backups from the UI.

Restore? Why? There is proven and working way to restore, why should I risk using your script for that task?

TLDR: It all boils down to: What are you trying to achieve?
After you but some thoughts into that question, you can do some research (or ask in the forum) and relize that the problem you are trying to solve, is already solved. Without the risk of AI slop.

This is btw true for almost all "here is my claude code hobby project" posts that flood /r/selfhosted and /r/homelab.

What can Crowdsec now offer me?

An additional blocklist.
Plus you can detect unwanted behavior and then block that IP. No matter if the attackers scans ports or does something unwanted on 443.
Not sure why you would open UDP, btw.

But yeah, for me crowdsec is just that, a community blocklist where people contribute with their own data.

I've noticed that Crowdsec has never blocked anything that my firewall rules don't block anyway.

Same, but is that even the use case of Crowdsec here? Crowdsec blocked many port scanners for me on OPNsense. Sure, these scanners would not have done much, since the ports blocked. But the same IP is now blocked for other attacks.
Way more active is my Crowdsec on NGINX. This is where all the CVE and wordpress admin/admin stuff happens.

And there's constant pressure to upsell.

Never noticed that, but probably also because for me this is just a fire up and forget. I won't dig into it. Only time I went into it, was a false positive when someone synced 10k new files in Nextcloud.

However, it doesn't seem to be necessary other than as a scare sell to replace Fail2Ban, which I don't use either because I don't need it - because of the afore mentioned firewall rules.

For me, the none existing support for IPv6 from fail2ban made me look into Crowdsec. Blocking a single IPv6 instead of a a /48 makes no sense IMHO. I was too lazy to set it up later on, but I think at least it would be possible.

that you can't use yourself unless you upgrade your account for a ridiculous subscription charge.

AFAIK you can have 3 lists active at the same time. Fine be me.
I don't think it does much. But I also don't think it costs much. And I like the basic idea behind it.

Just trying to gauge whether I should try again to migrate in July / August or later in the year.

There is no rush to migrate. Totally fine to not migrate in 2026. I did it on one site, and personally have a hard time getting warm with the new firewall rules. IMHO it is a downgrade and looks messy, even if you change filters all the time. But to be fair, I have not invested much time into it yet :)

All my servers use SLAAC. The addresses are stable unless I change the MAC address of the server for some reason. I can then point Caddy (or NginX in your case) at these addresses. DHCPv6 is rarely needed.

Interesting, I thought that I had changing IPv6, but that was in the beginning of my journey. So maybe I looked at the privacy extended IPv6 back then. So in theory, I could ditch DHCPv6, and go with SLAAC only you think?

Hmm... I have to think about that, I quiet liked to have 10.10.50.4 and 2000:2000:2000:50::4 for simplicity.

That is a little bit off topic, because my issue is more about OPNsense offerin MAC based reservations, which according to some folks on github is against IPv6 philosophy. And because of that, they have not accounted for certain situations and you run into errors.

Maybe I am misunderstanding you, but IMHO your idea falls flat, because I only need static leases for services. And for that I need a static IPv6.


I can't say to NGINX:
My static /48 prefix is 2000:2000:2000::, my service is in the vlan 30, which has the prefix 2000:2000:2000:30:: so proxy pass to 2000:2000:2000:30:: and somewhere in there is my destination, go find it.

I'm unable to tell.

Me too ;) no seriously, I have this issues with OPNsense, but of course it could also be KEA that is the root issue.

I know a lot of work went into KEA and I truly believe that a lot of bugs were ironed out with the recent release.
Still, KEA is IMHO not polished and production ready.

One example:
1. You have a static IPv4 reservation (based on MAC)
2. You create a IPv6  reservation, based on the same MAC

KEA will now ignore your IPv4 reservation. Yes, it worked before, but now no longer works and instead will get an IPv4 from the DHCPv4 range, while IPv6 will do the reservation correctly.

But James, you should DUID and not MAC for IPv6

Fine, but then it should not use MAC when I click on the "add static lease" button in the lease tab, but DUID instead.
Also, since the newest update, I can no longer see the DUIDs anymore on OPNsense?


So if you think just because ICE is eol that you should switch to KEA, don't! Don't make the same mistake I did.
There is still no need to make the switch. At least not for now.

Updated the script. Hope it works for you, I don't know how I could make it any simpler.
Let me know if I can help you with anything.

./deSEC_DynDNS.sh runs a script called deSEC_DynDNS.sh in the directory you currently are.

Your ls shows that there is no deSEC_DynDNS.sh file in your current directory.

Thank you for the heads up. In newer versions of OPNsense, you have to enable the checkbox "Show community plugins".

Although I have to check if that plugin is even needed anymore. Maybe check it this afternoon.

You have to make a distinction between two different things.

The official OPNsense plugin uses ddclient.net. The catch with ddclient is that there is no official support yet for deSEC.io.


The Github link on the other hand, links to a bash script that I wrote. It was written solely for deSEC.io
How to install it on OPNsense is here: https://github.com/jameskimmel/deSEC_DynDNS#prepare-on-opnsense