Messages

System Gateways Gateway.edit no-change .save .apply ... worked 4 me ✅
tnx!

seems like the same issue as in https://forum.opnsense.org/index.php?topic=32350
I just had to redo the +x, as it seems to be broken with every FW-update.

is this a known issue?
can it be fixed?

in /usr/local/etc/rc.d opnarp was the only one with flags -rw-r--r--
changed it to chmod 755 opnarp -rwxr-xr-x
probably this fixed it.

of course alot to see in the console upon boot ;) but nothing specific abt opnarp catched my eye.

maybe connected to this issue: in the GUI at "System: Diagnostics: Services" the "opnarp daemon" is stopped and cannot be started.

After reboot the OPN-Arp service doesnt autostart, though Enabled[X].
I have to manually start it every time after reboot.

Is there a way to fix the functionality of "enable", or a shell way to make it autostart after reboot?

maybe similar to this issue: https://forum.opnsense.org/index.php?topic=31697

just to make sure;
is "allow all to LAN" an auto-generated rule from an option in some menu?
or a default configuration rule I aparently deleted?

[works]

Oh cr..! now this port forwarding rule works:

Code Select Expand

Source Destination NAT
Interface Proto Address Ports Address Ports IP Ports Description
LAN TCP * * This Firewall 3000 (HBCI) 127.0.0.1 3000 (HBCI) access AdGuard web-UI

can't believe I'm the only one with this problem / configuration!
would be worthy ofa tiny mention in the releasenotes!

.works4me ✅

[NAT.Port-Forward]

With NAT.Port-Forward it gets even more interesting:

Code Select Expand


Interface Proto Address Ports Address Ports IP Ports Description
WAN TCP * * WAN address 3000 (HBCI) 192.168.0.1 3000 (HBCI) allow access 2 ADguard    
LAN TCP * * LAN address 3000 (HBCI) 192.168.0.1 3000 (HBCI) allow access 2 ADguard

the 1st one works: I see the ADguard-login from outside.
the 2nd one doesnt work: LAN-devices still see nothing!

[ON]

thank you for the hints! there are new findings:

• the from-LAN-access to OPNsense:3000 is shown as PASSed in the FW.log.live
• the wget ON OPNsense ... GETs a RESPONSE!

Now I thought abt the antilockout rule too (which is a generated one).
Though I cannot create an own LAN-rule for dst-port 3000 ... port-fields are not editable "🛇",
a general LAN-rule "from:LAN-net to:This-Firewall" with "Gateway:default" or alternatively "127.0.0.1" has seemingly no effect.

[soo ... where to dig next?]

yes, it is the one:

Code Select Expand

Version Size Repository Comment
os-adguardhome-maxit (installed) 1.8 34.7MiB mimugmail AdGuardHome

unresponsive is meant in the sense that it doesnt respond, not with http 200 or otherwise:

Code Select Expand

wget http://192.168.0.1:3000
--2023-01-06 23:19:26--  http://192.168.0.1:3000/
Connecting to 192.168.0.1:3000... failed: Connection timed out.
Retrying.

whereas the OPNsense webservice responds fine:

Code Select Expand

wget --no-check-certificate https://192.168.0.1
--2023-01-06 23:29:34--  https://192.168.0.1/
Connecting to 192.168.0.1:443... connected.
WARNING: The certificate of '192.168.0.1' is not trusted.
WARNING: The certificate of '192.168.0.1' doesn't have a known issuer.
The certificate's owner does not match hostname '192.168.0.1'
HTTP request sent, awaiting response... 200 OK
Length: 2646 (2.6K) [text/html]


just to make sure, the DNService of ADguard works:

Code Select Expand

dig 8.8.8.8

; <<>> DiG 9.16.33-Debian <<>> 8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 37620
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;8.8.8.8.                       IN      A

;; AUTHORITY SECTION:
.                       3600    IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2023010601 1800 900 604800 86400

;; Query time: 28 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Fri Jan 06 23:34:10 CET 2023
;; MSG SIZE  rcvd: 111


soo ... where to dig next?

hey community support! anyone (100+:) reading this?! ;)

It happened with one of the recent updates, and I didn't check the problem with AdGuards web UI.
Its DNS functionality works still fine, but the web-interface doesnt respond anymore.

though the port is listening, with the right process:

Code Select Expand

root@OPNsense:~ # sockstat -l -4
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
root     AdGuardHom 82770 19 tcp46  *:3000                *:*


and the AdGuard .log looks fine too:

Code Select Expand

2023/01/03 03:54:39.034836 [info] AdGuard Home is available at the following addresses:
2023/01/03 03:54:39.035174 [info] Go to http://192.168.0.1:3000

anyone else with the same experience?
howto resolve this?
help's appreciated!

works4me since the update to Version 22.7.9 ✓

[route]

I don't understand in which order the various mechanisms, even if they work as I believe, decide to which gateway the packet is routed:

• policy route @Firewall.Rules.LAN?
• are routes dynamically added when an interface goes down?
• Tier# @System.Gateways.Group?
• Priority @System.Gateways.Single?
• Weight @System.Gateways.Single?

and what's the correct settings for a WAN and VPN gateway xactly?

• Upstream Gateway [_|X]?
• Far Gateway [_|X]?

I assume that, if I punch no holes, i.e. allow rules @Firewall.Rules.OpenVPN I'm safe from attacks that originate in the VPN network?