Messages

1

General Discussion / Using OPNSense router with SFR FTTH (Box 7)

« on: December 12, 2023, 05:10:07 pm »

I've just have SFR FTTP installed (France) and I've been supplied with a pretty nasty "Box 7" (Appears to be an Altice GR140CG) where the fibre connection goes straight into it and it provide wifi and routing etc.

I'd like to use an OPNSense router instead and I've had a poke around the admin UI and there's nothing in there regarding a "bridge mode". (some screenshots attached)

I've read a few forum posts on the SFR community site saying to use a DMZ. Does this approach suffer from the double-NAT problem? Can anyone point me to some guidance on how to configure this? Is there a better way?

Any guidance appreciated

2

23.1 Legacy Series / Re: Very slow DNS for updates, plugin listing, remote calls from the OPNSense box

« on: July 20, 2023, 08:52:19 pm »

Apologies, I was a away from this router for a bit.

I had a poke around the adguard home settings for a bit but I couldn't find anything that seemed to control whether it was binding to localhost or not.

I tried your other suggestion of checking the "Do not use the local DNS service as a nameserver for this system" box and it's solved the issue! So many thanks!

I'm not too bothered with not using adguard home for the router DNS; it's mostly to make web browsing more bearable.

Thanks again for the help. I think we can call this question answered.

Update:

Upon investigating further, I found that Adguard Home was indeed only listening on the LAN interface. It seems like it's not possible to change this via the web interface but I was able to make it listen on all interfaces by editing the config file in `/usr/local/AdGuardHome/AdGuardHome.yaml` and restarting the service.

3

23.1 Legacy Series / Re: Very slow DNS for updates, plugin listing, remote calls from the OPNSense box

« on: July 13, 2023, 04:03:35 pm »

Are you running dual stack?  How is your IPv6 configured?

Yes, I am running dual stack. WAN is set to DHCPv6 for ipv6. ISP is Starlink. Here is the ipv6 settings for WAN, which I got from following a guide somewhere:

What happens if you do a query but put 127.0.0.1 in the Server field?

it times out and I get an error: "Error: error sending query: Could not send or receive, because of network error"

However, if I use 1.1.1.1 or 8.8.8.8 it works immediately

4

23.1 Legacy Series / Re: Very slow DNS for updates, plugin listing, remote calls from the OPNSense box

« on: July 13, 2023, 11:03:20 am »

Thanks for the reply. DNS lookup worked with the following result:



Even though it says ~28ms query time, it took about 20-30 seconds from clicking the button to the results appearing.

Re Unbound, it's empty for DNS over TLS and Query forwarding; but I'm not using Unbound afaik ("enable" is unchecked in the Unbound settings).

For DNS under DHCP, on the LAN interface I have the router IP set as the DNS server, as I'm running Adguard Home as my DNS server on the same box. Devices on the LAN don't seem to have any trouble with DNS lookups or slowness - it's just with the OPNSense box itself, e.g. if I ssh into it and perform a ping to some external domain.

This is the Adguard Home settings in the OPNSense admin:

5

23.1 Legacy Series / Re: Very slow DNS for updates, plugin listing, remote calls from the OPNSense box

« on: July 12, 2023, 06:43:32 pm »

Re-igniting this. Sorry, I was away for a few weeks.

This is what the settings page looks like re DNS:


pic host site

I haven't set any extra firewall rules; I'm using the default ones set by OPNSense. Here're my floating rules:


pic host site

What kind of test could I run from the diagnositics pages?

6

23.1 Legacy Series / Re: Very slow DNS for updates, plugin listing, remote calls from the OPNSense box

« on: June 20, 2023, 04:20:17 pm »

I haven't configured the OPNSense DNS so I guess it's using ISP DNS. I've left the "DNS Servers" section blank under System->Settings->General.

7

23.1 Legacy Series / Very slow DNS for updates, plugin listing, remote calls from the OPNSense box

« on: June 20, 2023, 11:02:06 am »

Router info:

Code: [Select]

*** myrouter.localdomain: OPNsense 23.1.9 ***

 LAN (igc1)      -> v4: 192.168.1.1/24
                    v6/t6: 2a0d:3344:12b:c900:62be:b4ff:****:****/64
 Starlink (igc0) -> v4/DHCP4: 100.82.***.***/10
                    v6/DHCP6: fe80::62be:b4ff:****:****%igc0/64


My setup is pretty simple; a single WAN interface (Starlink) and a single LAN interface. I'm also running Adguard home as the DNS for the LAN DHCP server.

Clients on the LAN can access the internet fine and DNS seems fast. ipv6 seems to also work.

However I noticed that when visiting System->Firmware->Status it would be very slow to show any information (up to ~5mins) or would fail to show anything at all. The same applies to the plugins & packages tabs.

It seemed like a DNS issue so I ssh'd into the OPNSense box and tried pinging some hosts. I noticed there was a significant delay after running `ping` and any output appearing:

Code: [Select]

root@myrouter:~ # ping google.com
# delay of ~20-30 seconds
PING google.com (142.250.200.14): 56 data bytes
64 bytes from 142.250.200.14: icmp_seq=0 ttl=119 time=43.432 ms
64 bytes from 142.250.200.14: icmp_seq=1 ttl=119 time=58.192 ms

If I ping the IP address directly the output is instant:

Code: [Select]

root@myrouter:~ # ping 142.250.200.14
PING 142.250.200.14 (142.250.200.14): 56 data bytes
64 bytes from 142.250.200.14: icmp_seq=0 ttl=119 time=48.951 ms

It seems like OPNSense itself is having trouble resolving DNS. It seems to work eventually but making anything that involves resolving a domain very slow. As mentioned this does not seem to affect clients on the LAN where Adguard Home is being using for DNS; just calls from the OPNSense box itself.

Any advice on how to diagnose and fix the issue?