Messages

Hello,

I've the following situation:

* two firewalls
* in total one incoming wireguard VPN endpoint that is bound to carp
* one outgoing wireguard VPN *per* device that should always be up, if the machine is running

The problem is that with HA sync, by default all wireguard VPNs are up on the primary machine:

- fw1: incoming, outgoing1, outgoing2
- fw2: -

I then thought, ok I can try to have ONE carp address on fw2 that is the MASTER by default instead of fw1. However, it seems that the HA-Sync always modifies the advskew so that the secondary firewall is slower. Even setting it to 254 on the master only sets it to 254 on the backup.

Then I thought maybe I can create a binding to an IP alias on each machine, however wireguard does not support that.

In the end, what I want to have is:

- fw1: outgoing1
- fw2: outgoing2
- active/master/primary fw: incoming

How do I achieve this with opnsense?

The firewall rule interface drop down menu allows to select the different physical interfaces, "IPSec", but does not allow to match on a wireguard interface.

From the shell I can see that there is a wg1 interface, so in theory opnsense could match on it.

My use case: I want to whitelist access to specific ports from the connected VPN (road warrior) clients to other devices opnsense is connected to.

That matches with my observation, but I fail to understand what causes that problem on opnsense, because in the end it's just a GUI + FreeBSD - or am I mistaken?

Hello,

when adding the full routing table to an DEC4040, the system needs ca. 5 minutes to just display the content of netstat -nr. A lot of network related operations such as fetch time out sometime as well.

root@router1:~ # date; netstat -nr|wc -l; date
Thu Oct  6 09:28:26 CEST 2022
1041529
Thu Oct  6 09:33:18 CEST 2022
root@router1:~ #


Is there any tuning that needs to be done for the system to support the full routing table?

Best regards,

Nico