Messages

There is no range. It is just a single number that allows for VPN access into OPNsense from the internet.


Bob.Dig, I'm here asking for help and to learn because I'm not a network engineer. Wincent is asking about an 'in' rule. My concern is that I don't understand why I'm seeing outbound traffic to what I thought were private address spaces from my WAN interface.

I thought it was inbound traffic, but if it's outbound, it's normal. As Bob.Dig said, the firewall defaults to sending all non local packets to the default gateway.

If you don't want to see these, set a rule as lmoore mentioned to intercept them.

:)

I think HAProxy is an option for load balancing.

What is the destination address(WAN address) port range for interface WAN rule?

I drew a network topology diagram, and the general structure is like this (the drawing is a bit ugly)
You cannot view this attachment.

Have you created a new one or some in your schedule(Firewall -> Settings -> Schedules)? if so, open the 'advanced mode' in the upper left corner when you add the new rule.

Em...It looks like a broadcast packet, but it shouldn't come from a public network address. Are there any other rules besides DNS NAT rules?

This should be a default rule. Can you provide more information? Interfaces or directions

Is your WAN interface bound to a public IP address? x.x.x.235?

The firewall only handles the outbound load balancing, for inbound traffic, if PBR is not deployed in your front-end, the firewall will not determine which circuit the inbound packets come from. For example, packets from circuit 1 can be replied to through circuit 1 without any problem, but packets from circuit 2 are also replied to through circuit 1 by default, which may cause not be reachable and time out.

This is not a firewall rule issue, it's a routing issue, The default route gateway of the firewall is only one. If the inbound traffic happens to be on your default circuit, there is no problem. If the inbound traffic is on another circuit, the firewall's outbound packets cannot reach this route. You need a layer 3 switch to run PBR to handle this.

I thank you need a layer 3 switch that supports PBR to be placed between two FritzBoxes and OPNsense devices.

If you are using the default Unbound DNS service, set it here "Services -> Unbound DNS -> Overrides"

Yes, it works!
You need to use UEFI mode, as LEGACY mode does not work.

Is it possible that you have set up another rule without a label to log records?

This command "/usr/local/etc/rc.d/suricata onestop" will check the status of Suricata and delete the stale PID file, you previously used `kill` to shut down Suricata abnormally, a PID file may be left behind.
Now try to shut down or reboot OPNsense directly using the webGUI.