Messages

I installed a new OPNsense 23.7.8 install about two weeks ago. It was working with a DHCP WAN in a private network and tested well. I packed it up and drove a little over 100 miles to our remote site and installed it. I could ping 8.8.8.8 from the WAN, but not from the two LAN ports I setup and had working previously. After messing with it for a couple of hours I figured I screwed it up by not "creating" it as a proper static WAN firewall from the outset.

So I pulled out my config notes and made a copy of the config and then reset the firewall back to factory defaults. I then set it up from my notes and had the exact same problem. I spent another 2 hours troubleshooting the firewall settings looking for the smoking gun that would point to why the firewall wouldn't pass traffic from either LAN out to the WAN, although the live view log said it did. Finally, I had to work around the new firewall and leave for the day, but setup a remote connection to it through our existing WAN.

Fast forward two weeks and hundreds of tickets later, I was able to resume my quest to make the new firewall work. I started by taking a backup of the non-working config. Then using my setup notes I stepped through the Wizard and the individual interfaces. All looked well, but the system wouldn't forward from the LAN to the WAN, although the log says it does.

So, I hit the forums and found a couple of notes where others have had the same issue after upgrades.

Here are the links to the two posts that brought me to the following conclusion.
https://forum.opnsense.org/index.php?topic=36688.msg179833#msg179833
https://forum.opnsense.org/index.php?topic=36688.msg179900#msg179900

To get it to "work" in my install, I did the following steps. In the background on a command prompt I had continuous ping running to 8.8.8.8 from the client out to one of the LAN ports.:

• Go to System --> Gateways --> Single
• Edit WAN gateway
• Verify "Upstream Gateway" was checked. It was. ping didn't work
• Uncheck "Upstream Gateway". Save. Apply. ping didn't work
• Check "Upstream Gateway". Save. Apply. ping didn't work
• Reboot. When it came back up the ping "magically" started working.
• Write this up to help the next guy and hopefully tag the guy that knows how to fix this for future releases.

I say "magically", because this is computer science not alchemy. So, there is a real reason for this. First, I verified the Interfaces --> Diagnostics --> ping worked from each interface to 8.8.8.8 and of course it did. So I went back to the config and pulled up the original config I started with yesterday and used notepad ++ to compare it to my working config. The difference is there is no filter rule section  in the non-working config for states. Why? I don't know. I feel it should have been created when the default rule was created.

Code Select Expand

      <type>pass</type>
      <interface>lan</interface>
      <ipprotocol>inet</ipprotocol>
      <statetype>keep state</statetype>
      <direction>in</direction>

If you are missing this section in your non-working config please see the steps above. Apparently, something didn't trigger correctly in the config setup script.

If you are in charge of maintaining the script that controls this function please review the settings and if there is a way to trigger this without the gyrations of manipulating the already checked "Upstream Gateway" box then lets link to the documentation.

Now I can drive another 200 miles round trip to complete my install that should already be working.

Thanks,
JC

Two Questions:

Can the above be added to a detection script to avoid the boot problems in the future? What would you need to help with this?

Can the ichsmb0 interrupt loop be detected and "disabled" automagically?

ok, that was three questions...

Recently, I was attempting to use OPNsense on a reconditioned Netgate SG-4860-1U. I ran into a few snags and it took some messing about but I was able to modify the loader.conf.local file enough to get it to boot and avoid the ichsmb0 interrupt loop noise.

Much of the following came from Here:
https://forum.opnsense.org/index.php?topic=6998.msg31097#msg31097

1. Create a USB-stick with OPNsense serial (amd64)
   https://docs.opnsense.org/manual/install.html#installation-media
   
   Use the nano version and image an SSD with it. Install it in the SG-4860-1U in the big open space.
   
2. Mount this USB stick on any other running FreeBSD device and navigate into /boot on USB-stick
   I used the existing pfsense 23.05.1-RELEASE install and did the following.
   a. Press F12 at boottime, choose to boot the pfsense install with the new SSD flashed with OPNsense nano connected.
   b. press 8 to open a shell
   c. get list of devices
      # camcontrol devlist
   d. mine showed the ssd was at /dev/ada0 so mount that.
      # mount /dev/ada0 /mnt
      # cd /mnt/boot
   
3. Edit or create (if not there) a file "loader.conf.local" and put the following lines in it:
   a. if the above commands completed without error then edit/create
     # vi loader.conf.local
   b. using vi add the following lines:

hint.ichsmb.0.disabled=1
hint.uart.0.flags=0x0
hint.uart.1.flags=0x10
comconsole_speed="115200"
comconsole_port="0x2F8"
console="comconsole"
kern.cam.boot_delay="10000"


3. Save file and unmount USB stick
   a. save file with vi:
    :x
   b. change directory and unmount
    # cd /
    # unmount /mnt
    # halt
   
4. Reboot and press F12 but this time select the SSD and voila...

NOTE:
"ichsmb0: interrupt loop, status=0x60" can be fixed by adding "hint.ichsmb.0.disabled=1" to loader.conf.local