Messages

1

23.1 Legacy Series / Re: Asynchronous IPv6 routing problem

« on: March 20, 2023, 08:15:06 pm »

zan, you are a genius!

On the inbound rule on my WG interface I set reply-to to my WG gateway and everything works now!

Thank you so much!

2

23.1 Legacy Series / Re: Asynchronous IPv6 routing problem

« on: March 19, 2023, 04:08:37 pm »

If the traffic originates from my local network, the traffic matches the correct firewall rule that has the IPv6 tunnel gateway set and followup traffic gets correctly routed back to its original source.

My wan pppoe connection does not even have an IPv6 link local address. Still if e.g. i ping one of my hosts from an external site, the icmp echo request arrives at my local VM, but the icmp echo reply gets sent out via OpnSense's pppoe0 interface (which is v4 only).

> would your scenario not be similar to a multi-WAN-setup when you define your Vultr-link as WAN? Or WAN-failover for IPv6?

I don't know. If one link is v4 only and the other is v6 only, do I need to configure a multi wan setup? My testnetwork is IPv6 only.

3

23.1 Legacy Series / Re: Asynchronous IPv6 routing problem

« on: March 19, 2023, 02:30:02 pm »

I don't have IPv6 connectivity so I am announcing my own subnet via BGP and the Vultr VM and use its connection so my local networks can have IPv6 internet.

I know I can set different gateway priorities, but shouldn't the firewall know that this is answer/followup traffic and use the gateway it originated from? It works perfectly if the traffic originates from my local network. Whats the difference when it originates from outside?

4

23.1 Legacy Series / [SOLVED] Asynchronous IPv6 routing problem

« on: March 17, 2023, 09:09:35 am »

Hi,

I have the following setup:

• Vultr VM with IPv4 + IPv6 connectivity announcing my IPv6 prefix via BGP and a Wireguard tunnel to my on-premise
• OpnSense, where I have IPv6-only VLAN interface "TEST" which contains a single
• debian Test VM, with a static IPv6 address.

What works:

• debian VM has Internet connectivity, can ping everywhere, do downloads via http, etc., all good
• debian VM can do ping6 and traceroute6 to any destination

What does not work:

• Inbound traffic to the debian VM (traffic initiated from wan, tested with ping6, traceroute6 and HTTP

I did a tcpdump on the Vultr VM and saw the traffic gets sent into the tunnel.
I did a tcpdump on the OpnSense and saw the traffic arriving from the tunnel and leaving the VLAN interface.
I did a tcpdump on the debian VM and saw the traffic arriving from the OpnSense.
I did a tcpdump on the OpnSense and saw the answer arriving on the VLAN interface.

Now the problem: The answer packages do not appear on the tcpdump for the Wireguard tunnel on the OpnSense, but instead i see them on my pppoe0 wan interface.

Why is this happening and how do I achive that answer traffic gets sent back to the interface it originated from?

5

23.1 Legacy Series / Re: Problem with floating rule "let out anything from firewall host itself"

« on: March 10, 2023, 12:27:25 pm »

Ah - i was confused because I had not turned on logging on the rule so I did not see it in live log.
Most firewalls I worked with have a kind of "Internet V4/V6" address object that automatically matches anything but the local networks.

I just stumbled upon another problem:
I have an additional Wireguard tunnel to Route48.org (IPv6 Tunnelbroker) which I used prior to getting native IPv6 WAN access.

So I still have another VLAN20 using a /64 range from the assigned /48.
I just realized that now that I have native v6 WAN connectivity, it seems that the firewall tries to send traffic out of the native WAN interface, instead through the tunnel interface.

The VLAN20 interface has the same single custom rule as the LAN interface stated above, but with the addition, that I set the gateway to the tunnel interface gateway.

When I try to ping google.com [2a00:1450:400d:802::200e], live log shows 2 entries for this destination:
IN VLAN20 matching my custom rule
OUT WAN let out anything from the firewall host itself

Whilst I would expect it to use the tunnel gateway and therefore the tunnel interface for outbound

6

23.1 Legacy Series / Problem with floating rule "let out anything from firewall host itself"

« on: March 10, 2023, 10:25:50 am »

Hi guys,

I am relatively new to OPNsense but have experience with Sophos and SonicWALL.

At the moment I have the following setup:
VDSL PPPoE with 1 static v4 Address and a static /60 v6 allocation

• LAN: 10.10.10.0/24, :1::1/64 address from provider allocated /60
• WAN: Static IPv4 /32, Static IPv6 :0::1/64 from provider allocated /60
• VLAN10: :a::1/64 from provider allocated /60

In my VLAN10 Netzwork there is a single debian VM with static IP :a::2/64.

There are no custom floating rules other than the default ones.
There is only one custom rule on the LAN interface: IP4+IP6 from * to !RFC1918 Networks allow
There is no rule on the VLAN10 interface

With this configuration in place, I expected that when I want to SSH from a LAN IPv6 client to the VLAN10 debian VM on it's IPv6 address, it would be blocked by default. But it is allowed.

Live log shows that it is allowed because of the auto-generated floating rule named "let out anything from the firewall itself".

Shouldn't the default in that case be that this traffic would be blocked? I would have expected that I need a rule on the LAN interface allowing TCP 22 to VLAN10 net or the specific IP