Messages

thanks!!

dg mv8000

Version   24.7.3_1   
Architecture   amd64   
Commit   ba0168b69

trying to create a new server certificate. when i click the add (+) button, a popup with "Edit Certificate" is displayed, but i don't see a certificate authority field?

https://docs.opnsense.org/manual/how-tos/self-signed-chain.html does show a certificate authority field.

what am i missing?

thanks

I use a cron job named "Renew DNS for WG on stale connections" under

System -> Settings -> Cron

run every min or so. Works just fine.

thanks much! am not well-versed in opnsense, i thought there was some switch/option/parameter that i have to set. cron it is. thanks again

wireguard "client" connects to wireguard "server".

the server reboots and isp assigned a new ipv6 address, server updates the dynamic dns

the client hangs, still pointing to the "old" address

what options/switch do i need to adjust/set so the client will timeout, requery the dns and reconnect to the server with the "new" address?

thanks

setup:
opnsense wireguard (server)
slackware wireguard road warrior (client)

slackware eth0 is connected to 4g router lan port
slackware 10.10.5.45
4g router 10.10.5.41

wireguard tunnel server 10.9.1.1
wireguard tunnel client 10.9.1.2
wireguard tunnel client wg0

on slackware client:
route table
0.0.0.0     10.10.5.41   ug   eth0
10.9.1.0    0.0.0.0      u    wg0
10.10.5.0   0.0.0.0      u    eth0

slackware rc.ip_forwarding is executable
ufw To Anywhere on eth0           ALLOW FWD   From Anywhere on wg0
ufw DEFAULT_FORWARD_POLICY="ACCEPT"

problem:
from opnsense server, can ping 10.10.5.45 (slackware client)
from slackware client, can ping 10.10.5.41 (4g router)

from opnsense server, cannot ping 10.10.5.41
is this a circular route?
is there something i miss? what is missing?

thanks.

using new instance already, still have some stragglers.

thanks.

i have an old openvpn server that is using server certificate without the server bit set.

yes, the server certificate needs to be changed etc etc

for now, is there a way to override the server bit check?

thanks

the opnsense ipv6 mask was set to /128.

so i changed it to /64 and it's ok now.

thanks for all the mindshare. :)

OPNsense 21.1.5-amd64
FreeBSD 12.1-RELEASE-p16-HBSD
OpenSSL 1.1.1k 25 Mar 2021

setting up opnsense in the cloud, i have both static ipv4 and ipv6 addresses.

interfaces/wan
static ipv4
static ipv6
ipv4 upstream gateway is set to provided ipv4 gateway address
upv6 upstream gateway is set to auto-detect

ping6 udp connect no route to host

system/routes/status
there is no default gateway for ipv6

i tried adding a gateway in system/gateways/single with the provided ipv6 gateway address with checks on upstream gateway and far gateway.

the error message is:
the gateway address does not lie within one of the chosen interface's ipv6 subnets.

what did i miss or did wrong?

thanks