Messages

1

24.1 Legacy Series / Zscaler popup: "Internet security is enabled" after upgrade to 24.1.2._1

« on: February 26, 2024, 02:59:32 pm »

I am running Suricata on my WAN interface. My work laptop has Zscaler installed.

Since upgrading to 24.1.2_1, and Suricata 7 running in IPS mode with hyperscan, I do get these popups on my laptop from Zscaler, roughly every minute or so:

"Internet security is enabled"

The laptop still seems to have good connectivity, video calls work fine.

I am using the same ruleset I used in Suricata 6.
Does anyone know which ruleset I need to massage to prevent those messages?

I do not see anything in the Suricata/opnsense logs about that, besides this message at startup:

"[100320] <Error> -- failed to obtain number of NUMA nodes in the system"

When I switch to IDS mode, the messages in Zscaler no longer appear.

2

23.1 Legacy Series / Re: "arp: packet with unknown hardware format"

« on: February 11, 2024, 06:55:20 pm »

Did you ever figure out what was causing this log entry? I am seeing the same on my firewall.

3

21.7 Legacy Series / After internet outage, WAN IP address is showing "dhcp"

« on: March 12, 2022, 12:33:09 am »

I have had an internet outage. OPNsense (21.7. was happily continuing to work, but in the interface section I saw that the WAN IP address was simply showing 'dhcp' instead of my external IP.

Eventually, the internet came back. My cable modem was back online, but OPNsense continued to show 'dhcp'. I waited for probably 30min.

So here's my question:

Will OPNsense ever try to renew the WAN ip address itself, or can this only be fixed with a reboot? Which obviously is less than optimal. If I am not home, no one else will be able to bounce the box gracefully and the family would yell at me, until I get home.
I was able to get a new WAN IP address by pressing the "reload" button in the interfaces, overview section.

4

21.7 Legacy Series / Re: ntopng enterprise exits with signal 6

« on: November 15, 2021, 12:20:37 pm »

Yes. But it is the enterprise version; not the one that comes bundled with OPNsense.

It has happened with several different older versions, as well.

5

21.7 Legacy Series / ntopng enterprise exits with signal 6

« on: November 14, 2021, 04:18:06 pm »

I'm running the enterprise version of ntopng (v.5.0.211110 in community mode), currently on OPNsense 21.7.5-amd64.

I have noticed this in the past as well: After usually several days of ntopng running perfectly fine, it suddenly is stopped. When I check the logs, I see something like this:

2021-11-13T09:00:11   kernel   pid 19135 (ntopng), jid 0, uid 288: exited on signal 6

Oddly, it seems to happen at 8am, 9am, etc., always on the top of the hour.

I can restart it fine, but after a few days it stops again. I understand signal 6 is something that a process signals itself after it detects something fishy, before it gets booted by the OS?!

Could it be related to my running OPNsense on top of Proxmox, with passed through NICS (ig0, ig1)? It works fine, otherwise.

Thanks a bunch!

6

21.7 Legacy Series / Re: Configuring NUT

« on: October 16, 2021, 02:14:56 pm »

I believe your main issue is the "backend" setup for the software that actually monitors the UPS.

On your RBPi3 you need to install the NUT package (apt install nut) and configure it as the master.

Create a user that is listening to network requests. THIS is the user name you then need to use in the opnsense config.

Also, make sure you have connectivity between opnsense and the RBPi3, and the Pi's nut app is listening on the right address(es).

 I think I used this: https://davidrreed.home.blog/2019/12/01/how-to-add-a-proxmox-host-as-a-nut-slave/ and  https://diyblindguy.com/howto-configure-ups-on-proxmox/ He refers to proxmox and CyberUPS, but the principle is the same.

That's all I remember about this, and yes, I struggled a little setting it up, as well. Good luck.

7

21.7 Legacy Series / 21.7.3_1 - higher system load after upgrade caused by Suricata

« on: September 25, 2021, 05:15:16 am »

After upgrading and rebooting I see my OPNsense virtual install under Proxmox with a higher system load. It's now consistently above 1.0; before the upgrade it was usually around 0.6-ish. IIRC, a load of 1.something isn't crazy high for a 4 core system?

I also notice Suricata (WAN) uses around 17%-20% sustained CPU load. The box has now been running for several hours, and CPU usage has not gone down.

I run Sensei on LAN and the enterprise version of ntopng.

Anyone else seeing higher CPU/system load caused by Suricata? Any chance a future upgrade will lower it again?

Edit: Attached screenshot for OPNsense load before and after upgrade...