Messages

any solutions yet to that problem? I would like to get a transparent squid web-proxy running in combination with multi-wan-load-balancing.

+1

stumbling over the same problem today.

Reading https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/serve-stale.html unbound can be configured how to handle stale data.

Loooking at my OPNsense -> Unbound DNS -> Advanced -> Serve Expired Responses is NOT enabled

Should I also configure "Maximum TTL for RRSets and messages" ??

OPNsense 23.10.2 / Unbound 1.19.0

are there any logs on the OPNsense where I can analyze if there are some problems with teh CARP protocol ??

I don't fully understand that squid issue,

The issue is that squid tries to access the website using IPv6 even when the WAN connection is IPv4 only:

Code Select Expand



ERROR
The requested URL could not be retrieved

The following error was encountered while trying to retrieve the URL: https://www.heise.de/*

    Connection to 2a02:2e0:3fe:1001:7777:772e:2:85 failed.

The system returned: (65) No route to host

The remote host or network may be down. Please try the request again.

Your cache administrator is administrator@xxxxx.xx.

Generated Mon, 04 Mar 2024 17:02:32 GMT by fw01.intern.xxxxx.xx (squid/6.5)

When looking at "Top Talkers" I assume it should be sorted by some param, but I cant find any sorting of the data?
When clicking the column heads I cant see any effect on ordering the data.

Additional there is a drop down field, which defaults to 10 seconds, I assume this is the refresh rate?
But you can only select from 500 ms to 10 seconds:
500 ms for reading a table with two dozens rows and eight columns??

Best regards
Klaus

Filtering on IGMP and/or ICMP either is not working at all (they always seems to end up somewhere else in list of rules...) or Live View just shows odd filters.

I am seeing the same behaviour here on:
OPNsense 23.10.1_2-amd64
FreeBSD 13.2-RELEASE-p7
OpenSSL 1.1.1w

[-]

*it accepts both 192.168.1.200-209 and 192.168.1.200-192.168.1.209 for adding an alias, but rules will only work with the later.

So ist he first notation a valid one??
So it would be nice if there is some helptext in the gui which describes valid notations.

So OpenVPN is running again.

Steps I have taken:
- create new SSL VP CA
- create new SSLVPN Server Certificate
- change VPN->OpenVPN->Servers. Peer Certificate Authority and Server Certificate
- create new User Certificates (System->Access->Users) using as Certificate Authority the new CA
- export new Client config: VPN->OpenVPN->ClientExport

ooh, my certificate also expired today. The docs at https://docs.opnsense.org/manual/how-tos/sslvpn_client.html told me to create a SSL VPN CA with only a lifetime of 365 days.
Shouldn't the CA be valid for a longer time ??
As the CA expired we have to replace all Client certificates ??

I will be trying to create new certificates and will report back

So I solved the problem by creating different OpenVPN Servers with different ports and subnets.

coming back to this old thread https://forum.opnsense.org/index.php?topic=3483.0
I am having now the same problem:
We have OpenVPN set up for different users: normal users, administrators, external users
How I can I create firewall rules, that e.g. external users are not allowed to access our mail server.

I have found https://openvpn.net/community-resources/configuring-client-specific-rules-and-access-policies/ but I don't understand how to configure this with the current OPNSense GUI.

Any Hints/Links where I should look after?

Cheers
Klaus

It's documented here:
https://docs.opnsense.org/development/backend/templates.html#target-overwrites

I have read this docs now three times and still don't understand how this will help me to add additional configuration lines to squid.conf

If someone has used the templates to change squid.conf and share his knowledge I would be happy to create a Pull Request (PR) for the docs.

@franco : Or is there any other site / wiki where we can share/find such HowTo's  ??

Hint #1 found in https://forum.opnsense.org/index.php?topic=5892.msg24457#msg24457

Please have a look at:
https://forum.opnsense.org/index.php?topic=27409.msg133073#msg133073

i inserted the following lines

Sorry to ask, but WHERE did you insert these lines?

The docs at https://docs.opnsense.org/releases/BE_22.10.html?highlight=migration
advise to

Please make sure to read the migration notes before upgrading.

not only once but twice.

But sadly there is no link to these "migration notes".
Where can I find the "migration notes" ??

Thx Klaus