Messages

also enable mdns repeater

I fixed the bug, by updating line 91

[BAD CODE]

BUG:

Unable to add route when disable routes is checked, however a gateway IP is provided in the config.

ERROR:

Code Select Expand


2023-08-31T14:39:40 Error wireguard /usr/local/opnsense/scripts/Wireguard/wg-service-control.php: The command '/sbin/route -q -n add -'-4' '10.64.0.1' -iface 'wg4'' returned exit code '64', the output was 'route: bad keyword: -4 route: usage: route [-46dnqtv] command [[modifiers] args]'


file in question:

Code Select Expand

/usr/local/opnsense/scripts/Wireguard/wg-service-control.php

Location in file: line 91
BAD CODE

Code Select Expand


mwexecf('/sbin/route -q -n add -%s %s -iface %s', [$ipprefix, $server->gateway, $server->interface]);


FIX

Code Select Expand


mwexecf('/sbin/route -q -n add %s %s -iface %s', [$ipprefix, $server->gateway, $server->interface]);


There seems to be a bug when adding a route in the latest opnsense code.

in /usr/local/opnsense/Wireguard/wg-service-control.php
line 87

Code Select Expand


} elseif (!empty((string)$server->gateway)) {
                /* Only bind the gateway ip to the tunnel */
                $ipprefix = strpos($tunneladdress, ":") === false ? "-4" :  "-6 ";
                mwexecf('/sbin/route -q -n add [b]-%s[/b] %s -iface %s', [$ipprefix, $server->gateway, $server->interface]);
            }

the line mwexecf has a bug in it, causing the ip prefix to have an extra [b]-[/b] in it.
I fixed the bug by changing the line to:
[code]
mwexecf('/sbin/route -q -n add [b]%s[/b] %s -iface %s', [$ipprefix, $server->gateway, $server->interface]);


[/code]
           

UDP broadcast relay

host: 239.255.255.250
port: 1900
source address: 1.1.1.2

Firewall rule is applied on 20_devices net. This is the network containing the sonos speakers.


Action: Pass
Direction: In
Apply: Immediately
Protocol: UDP
From: 20_devices net
To: 20_devices address
Port: 1900

I had the same problem.  Port forwarding rules were failing when I implemented them myself (anti-lockout rules).

This is what I changed to make them work (it's the firewall rules, not the port forward).

Create port forwarding rule (no redirect).  (no tricks)

Create firewall rule, however add the following ->
1. Make the rule as you would.
2. Check allow options
3. Checkmark `SYN` in the `set` column
4. Checkmark `SYN` and `ACL` in the `out of` column.
5. Ensure `Keep State` is checked.

Without those additional elements

PROFIT.  This took me ages to work out.