Messages

@Patrick: You probably misunderstood, @IPinfo is not with IP66...

There are tools to extract CSV or JSON data from MMDB files, which seem to be the only ones that IP66 offers, unlike Maxmind and IPinfo.

However, I was unable to extract all data, including ASN with those, and I got errors all over the place during import to OpnSense, so I wrote my own: https://github.com/meyergru/opnsense-ip66

Later, I found the main problem is that for IPinfo-style .gz files, you need to send a Content-Disposition HTTP header - if you fail to do that, the file will get misinterpreted as a ZIP file in Maxmind format (with multiple files contained in it).

Nice, thanks!
I've just downloaded it and will try it in a bit.
Note that some of your lines that are longer than 84 characters have been split onto a new line, which makes my version of python barf.
Once i've removed the linefeeds on 6 of the lines, it runs.

Interesting. Their database seems to be bigger at 17 MByte than Maxmind's GeoIP Lite at 11 MByte.

I just emailed them if they could provide a compressed CSV version like Maxmind.

That being said, if you need more accurate data than Maxmind's, which is also free, you can use ipinfo.io, like explained here.

I did think about mailing them, but I thought I should at least try and figure out some of it myself!
Thanks, I'll check it out!

Hi everyone,
I just learnt of this service: https://ip66.dev/ which purports to be a drop-in replacement for the MaxMind service.
I downloaded the mmdb, and using mmdbinspect against it works fine.
There exists a github project to convert .mmdb files into .csv files, but I have no idea if this would be compatible.
Does anyone know the format of the CSV files that OPNsense will accept for the GeoIP function?
I assume it also has to be compressed? I have seen both .zip and .gz extensions mentioned in URLs.

Thanks!

Never mind, there's a new section under Services called NetData, and you have to enable it :)

Hi everyone, maybe similar to this thread: https://forum.opnsense.org/index.php?topic=43478.msg216296#msg216296
I have upgraded opnsense to 24.7.9 from various previous versions, and never used netdata.

I installed it tonight, and got the following output:

Code Select Expand

Quick start for local-only use:

1. sysrc netdata_enable="YES"
2. service netdata start
3. Go to http://localhost:19999/
4. <Optional> Connect to Netdata Cloud using the netdata-claim.sh script:
   https://learn.netdata.cloud/docs/agent/claim#claiming-script
Checking integrity... done (0 conflicting)
Nothing to do.
***DONE***


And assume I need to do those commands, which I did.
there is now a line in /etc/rc.conf, saying

Code Select Expand

netdata_enable="YES"
(there was nothing in that file before), but when I try and start the service, i get the following:

Code Select Expand


root@OPNsense:/var/log/system # service netdata start
Cannot 'start' netdata. Set netdata_enable to YES in /etc/rc.conf or use 'onestart' instead of 'start'.

Any ideas what I need to do?
Thanks!

I just tried to upgrade from 24.1.10_8 to 24.7 and had a bit of a problem.
I started the upgrade via SSH and left it to reboot.
After a while it didn't come back, so I went to have a look locally, and it had rebooted and got to the boot screen.
It had an error saying "can't boot kernel".
Typing "boot" of course yielded the same error.

I pressed CTRL+ALT+DEL and got back to the main boot screen, and on the kernel option (6 i think), there was an option of another kernel.
I booted using that instead of "default", and it tried to carry on with the upgrade.
Because of a version conflict, it said the upgrade aborted.
It completed booting fine and I was back at version 24.1 again.

I tried an upgrade from the console again, and this time it was successful, although there were a lot of errors as it was shutting down, but they were scrolling too fast to see and I was too slow to try and record it.

Towards the end of the process, there was an error showing that md5sum could not be used with a "-q" option whatever that was supposed to do.

Everything is now back, and I am on version 24.7.1.
I've not checked everything yet, but the most of my config seems ok.
The whole process took just over an hour, and thought I would write this down in case it helps anyone.

Phew  ;D

It was FAT32.
It was the partition table that was wrong.
The documentation doesn't mention anything about that.

I had to rebuild my firewall as an upgrade broke it and it wouldn't boot (no idea how).
The restore process was straightforward, although getting the file from a USB stick failed.

After I restored the xml file using the web gui after installation, there was nothing obvious to say that there was anything wrong.
However, looking at the plugins page, there were loads of plugins highlighted in red (which must have meant that they were not part of the standard build and were missing).

It would be good to mention in the docs (plus a warning in the GUI?)  that this should be checked once a restore has been permformed, as well as rebooting opnsense once all the modules have been installed, as my config had not been applied.

Thanks!

I had exactly the same issue with the "dvd" version of the 23.7 .ISO last night.
Unfortunately due to time pressure (i'd broken the firewall some how by applying the latest updates!) I gave up and imported the .xml file via the web gui after opnsense had installed

Could someone mention this problem in the docs as it's not obvious, and in windows, there is no easy way of telling if a USB stick is MBR or GPT?

So now, I'm giving static IPv6 addresses to devices on my DMZ, and that is working fine, but I'm having trouble getting DHCP6 (or equivalent) working for clients on the internal LAN side.
I have a /56 I want to use from the /48 my ISP has given me, and I have configured DHCP6 in opnSense on the internal interface.
My client (Ubuntu, set to "Automatic" for IPv6) is sending out requests (from an fe80 address to ff02::1:2), but there's nothing coming back.
What am I doing wrong?

Hi Maurice,

Thank you for the reply and explanation.
"Use IPv4 connectivity" did the trick, that got me my WAN allocation and then I could start splitting up the range for my other interfaces!

Hi everyone,
I have been trying for a while to configure opnsense for IPv6 with my new ISP, but I'm not getting very far.

When I was with an ISP that give me static addresses for both IPv4 and v6, i got it working without a problem.
However, my new ISP has given me a static IPv4 range (which I have to NAT.. ugh) and for IPv6 they say:

The details for your connection are:
IPv6 Prefix: xxx:xxx:xxx:527C::/64
IPv6 Delegated: xxx:xxx:527C::/48

You should just need to set the router to use DHCPv6 and enable router advertisements on the LAN side.

Maybe I should also mention that I have a PPPoE interface which logs me in and this is where the IPV4 WAN address is assigned.

What settings do I need to configure for DHCPv6?
I've tried doing a PCAP on the WAN interface for IPv6 traffic and I'm seeing nothing, so I guess opnsense is not even trying to request addresses :(
Where do I enable RAs for the internal interface? The only think I can see is DHCPv6 relays, but I can't select an interface because none of my interfaces have IPv6 addresses yet.

Thank you.
I found it at "<control_port_password>" in the config.xml you mentioned.
Is there a way of adding other commands into torrc?
I want to use nyx, and to get the connection information, and for that to work, I need to add

Code Select Expand

DisableDebuggerAttachment 0 to the torrc file. How can I do this without it being overwritten each time tor starts?

Thanks,

At https://docs.opnsense.org/manual/how-tos/tor.html, it says "... This Port requires a password, which will not be disclosed to the GUI but can be queried via the API." with no further explanation.
How do I find this out?
I can't set one myself as the file /usr/local/etc/tor/torrc gets overwritten every time it restarts :(

Hello all,
I am running OPNsense 21.7.5 on a Dell server with 4 NICs.
At the moment 1 port is configured for WAN access, which is configured with PPPoE to a fibre line that requires a VLAN tag.
Another port is connected to my internal LAN using internal IP addresses. NAT is working and everything works fine when accessing the internet from the LAN.

I have been given a /29 to use for my internet-facing stuff, and I want to run all this off a switch plugged into another NIC on the server.
My PPPoE connection is set to get an IP address via PPPoE, (which it does - the first IP from my /29 range).
How do I use the rest via a third NIC that I will plug into a different switch as a DMZ?
I have tried creating a bridge interface using the WAN port and this 3rd NIC, but nothing on that 3rd port is receiving any packets. Also, I can't ping the WAN IP (default gateway) from another computer connected to the switch on the 3rd NIC that also has a static IP in the same public range.

Should I be using a bridge as I have tried (and somehow my config is wrong), or should I be doing something else?

With other ISPs I have used in the past, the WAN port has a different IP/range to the local subnet (which makes more sense when using separate interfaces for WAN and DMZ).

Thanks!

Chris