Messages

1

23.7 Legacy Series / Re: Mullvad WG Tunnels Loop Detected

« on: January 22, 2024, 06:12:03 am »

Hi,

I wonder what caused this.

Update on my issues, I am on AT&T fiber and had their gateway in passthrough mode to my opnsense box. I've recently implemented a bypass via a ONT on a SFP stick to be able to completely cut their gateway out of the mix. Monit has not triggered once to restart my WG interfaces in the week since doing so. So, it seems possible that if you're in a similar situation that might be the cause.

2

23.7 Legacy Series / Re: Mullvad WG Tunnels Loop Detected

« on: November 17, 2023, 03:53:06 am »

Want to report back that for the past 5 days I haven't noticed any interruptions, and monit logs show the restarts. So thank you again!

3

23.7 Legacy Series / Re: Mullvad WG Tunnels Loop Detected

« on: November 11, 2023, 07:07:53 pm »

You are a lifesaver xsfpo! I was focusing on the gateways, not thinking about the interfaces themselves. Gonna apply this and hopefully not get this anymore.

4

23.7 Legacy Series / Re: Mullvad WG Tunnels Loop Detected

« on: November 07, 2023, 03:43:50 am »

So I completely reinstalled opnsense and things are more stable in comparison, but I still get regular (maybe once a day) issues with "loop detected". I have discovered that taking the wg gateways in the group down and bringing them back up seems to consistently resolve the issue.

Is there a way to use monit to automatically bring the gateways down and up?

5

23.7 Legacy Series / Re: Mullvad WG Tunnels Loop Detected

« on: September 15, 2023, 06:00:56 pm »

Is there something else I could provide to give more insight into this that someone might have an idea for a more specific area to look?

6

23.7 Legacy Series / Re: Mullvad WG Tunnels Loop Detected

« on: September 13, 2023, 03:32:15 pm »

I'll also add that I have 3 VLANs; general population, IoT, and a DMZ. I have put them with my LAN in a Firewall Group that has a few rules to apply to all the them.

They are all using my wg gateway group as the gateway for general internet access.

I'm unsure what extra I could provide that would help, so if anything else would be useful to troubleshooting this please let me know and I'll share.

7

23.7 Legacy Series / Mullvad WG Tunnels Loop Detected

« on: September 13, 2023, 03:09:08 pm »

I have 4 tunnels set up to mullvad with routes disabled, a gateway group set up, and used in firewall rules. For the past few months I've been getting consistent packet loss only on some of the tunnels. It used to only happen about once a day for about an hour, but now it's almost constant.

When all 4 tunnels are connected, logs in System > Log Files > General show

Code: [Select]

Notice kernel <5>wg1: loop detected If I bring down wg1, the loop changes to wg3, if I also bring down wg3, the remaining 2 tunnels are fine.

I have set up all 4 tunnels with the same methodology, so I don't think it's something in the wireguard settings. I've attached screenshots of them just in case I'm missing something.

I am more inclined to think it's a firewall rule somewhere, but neither wg1 or wg3 are in rules by themselves. I use the WG gateway group in my rules. How can I figure out what the exact cause of this loop is?

8

Virtual private networks / Re: Tunnel to Mullvad suddenly won't connect

« on: January 23, 2023, 08:35:04 pm »

I noticed that a small update was available, one of which was the wireguard-kmod to 0.0.20220615_1. Took that then rebooted and now things are connected. Guess that answers that.

9

Virtual private networks / Re: Tunnel to Mullvad suddenly won't connect

« on: January 23, 2023, 06:21:24 pm »

Actually, I think these lines from System: Log Files: General might hint at it.

Code: [Select]

/usr/local/etc/rc.routing_configure: The command '/sbin/route add -'inet' '10.66.XX.XX' -interface 'wg2'' returned exit code '65', the output was 'route: interface 'wg2' does not exist'
/usr/local/etc/rc.routing_configure: The command '/sbin/route add -'inet' default '10.66.XX.XX'' returned exit code '1', the output was 'route: writing to routing socket: Network is unreachable add net default: gateway 10.66.XX.XX fib 0: Network is unreachable'

The sole interface I'm leaving enabled is wg4 though, so I'm not sure why that message is popping up.

10

Virtual private networks / Tunnel to Mullvad suddenly won't connect

« on: January 23, 2023, 06:12:47 pm »

Hello,

Sometime last night my 3 tunnels to Mullvad all died for reasons I can't figure out and now they refuse to connect. They had been working fine for months prior to this.

I've rebooted, disabled all but 1 tunnel, and have tried using a different server than before. My subscription is still active. Which logs can I look at that might give me an idea of what's going wrong?

11

21.7 Legacy Series / DNS Fails w/ DNSCrypt

« on: October 09, 2021, 01:12:34 am »

I'm trying to get DoH working and am missing something. When I disable "DNS Query Forwarding" in Unbound, I get SERVFAILs back with "BOGUS (refused upstream)" for the queries.

Pihole Query Log:


My set up is Pihole -> Unbound -> DNSCrypt with mullvad & nextdns servers

I have the following in /usr/local/etc/unbound.opnsense.d/dnsCrypt-forward.conf:

Code: [Select]

server:
do-not-query-localhost: no

forward-zone:
name: "."
forward-addr: 127.0.0.1@5353
forward-addr: ::1@5353
Content of /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml:

Code: [Select]

server_names = ['mullvad-doh','mullvad-adblock-doh','nextdns']

listen_addresses = ['127.0.0.1:5353','[::1]:5353']

max_clients = 250

ipv4_servers = true

ipv6_servers = true

dnscrypt_servers = true

doh_servers = true

require_dnssec = true

require_nolog = true

require_nofilter = false

force_tcp = false


timeout = 2500
keepalive = 30

log_level = 2
log_file = '/var/log/dnscrypt-proxy/dnscrypt-proxy.log'
use_syslog = false

cert_refresh_delay = 240

dnscrypt_ephemeral_keys = false

tls_disable_session_tickets = false

fallback_resolver = '193.138.218.74:53'

ignore_system_dns = false

netprobe_timeout = 30
log_files_max_size = 10
log_files_max_age = 7
log_files_max_backups = 1

block_ipv6 = false

forwarding_rules = 'forwarding-rules.txt'
cloaking_rules = 'cloaking-rules.txt'

cache = true
cache_size = 2048
cache_min_ttl = 600
cache_max_ttl = 86400
cache_neg_min_ttl = 60
cache_neg_max_ttl = 600

[query_log]
file = '/var/log/dnscrypt-proxy/query.log'
format = 'tsv'

[nx_log]
file = '/var/log/dnscrypt-proxy/nx.log'
format = 'tsv'

[whitelist]
whitelist_file = 'whitelist.txt'
log_file = '/var/log/dnscrypt-proxy/whitelisted.log'
log_format = 'tsv'


[sources]
[sources.'public-resolvers']
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md']
cache_file = 'public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 72
prefix = ''

[static]

Contents of /var/unbound/unbound.conf:

Code: [Select]

##########################
# Unbound Configuration
##########################

##
# Server configuration
##
server:
chroot: /var/unbound
username: unbound
directory: /var/unbound
pidfile: /var/run/unbound.pid
root-hints: /var/unbound/root.hints
use-syslog: yes
port: 53
verbosity: 3
extended-statistics: yes
log-queries: yes
hide-identity: no
hide-version: no
harden-referral-path: no
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
so-reuseport: yes
module-config: "validator iterator"
cache-max-ttl: 86400
cache-min-ttl: 0
harden-dnssec-stripped: no
serve-expired: no
outgoing-num-tcp: 10
incoming-num-tcp: 10
num-queries-per-thread: 4096
outgoing-range: 8192
infra-host-ttl: 900
infra-cache-numhosts: 10000
unwanted-reply-threshold: 0
jostle-timeout: 200
msg-cache-size: 20m
rrset-cache-size: 40m
num-threads: 4
msg-cache-slabs: 8
rrset-cache-slabs: 8
infra-cache-slabs: 8
key-cache-slabs: 8

qname-minimisation: yes
qname-minimisation-strict: yes

auto-trust-anchor-file: /var/unbound/root.key

prefetch: yes
prefetch-key: no

# Interface IP(s) to bind to
interface: 0.0.0.0
interface: ::
interface-automatic: yes



# DNS Rebinding



# Access lists
include: /var/unbound/access_lists.conf

# Static host entries
include: /var/unbound/host_entries.conf

# DHCP leases (if configured)
include: /var/unbound/dhcpleases.conf

# Domain overrides
include: /var/unbound/domainoverrides.conf

# Custom includes
include: /var/unbound/etc/*.conf

# Forwarding
forward-zone:
name: "."
forward-addr: 193.138.218.74
forward-addr: 10.0.8.1
forward-addr: 9.9.9.9


remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-port: 953
server-key-file: /var/unbound/unbound_server.key
server-cert-file: /var/unbound/unbound_server.pem
control-key-file: /var/unbound/unbound_control.key
control-cert-file: /var/unbound/unbound_control.pem

I'm unsure what else to provide for insight. Any help would be greatly appreciated.

12

Documentation and Translation / Re: AdGuard Home setup guide

« on: August 08, 2021, 06:53:47 am »

How does one get a self signed certificate going for Adguard Home? Doing it mostly to learn, and thought it would be fun to have DoH/T enabled for my home network.

I have a CA & intermediate CA created and I created a certificate for adguard, but when I paste the cert & key into the fields I get "Certificate chain is invalid" for the certificate and "Your certificate does not verify: x509: certificate specifies an incompatible key usage" for the private key.

13

Virtual private networks / Re: Wireguard performance expectations?

« on: March 22, 2021, 12:47:35 am »

Alright cool, we'll see when I get the RAM & SSD in for the box! Looking forward to trying OPNSense out.

14

Virtual private networks / Re: Wireguard performance expectations?

« on: March 20, 2021, 11:28:06 pm »

Which CPU type? Xeon gives Gigabit line rate

I'll be using The Protectli FW4B with the 4 core Intel J3160.

15

Virtual private networks / Wireguard performance expectations?

« on: March 20, 2021, 01:55:26 am »

Hello!

I am thinking about replacing pfSense with OPNSense (pf is going no matter what, regardless) and am curious about how much of a performance hit I'd expect to see with the WG userspace app.

On pfSense's (flawed) kernel implementation, with a Gigabit internet connection, I was getting in the range of 700Mbps down from Mullvad on a protectli device with a dual core intel CPU.

Roughly how much of a performance penalty would I expect from the OPNSense app?