Messages

I run a public WLAN with a Captive Portal. Is this done with php, and therefor in danger. Or does that work without?

I would say yes, it is in danger, but luckily the attacker would need to be close to the AP to exploit it, it's not vulnerable to bots on the internet trying all public IPs.

There was another topic where the DEC850 seemed to be the better choice indeed :)

Yes, unfortunately at 1650 EUR (current price) and 45W typical power usage, this puts it out of reach for me as a home user. My M920q setup was under 400EUR including the X710 card and typically uses <20W. Not really comparable, an ancient mini PC with a hole cut into it and a fan over the hole, but it's silent and it gets the job done.

Maybe they didn't anticipate 10G internet to be so readily available when they designed the DEC750.

I don't see that anyone has recommended this, and it may not be feasible but....you could plug a machine directly in to you ISP's endpoint and do a speed test from there. And then plug directly in to your OPNSense fw and check from there.

You might not have full bandwidth on the public side of your fw.  It may not even be an OPNSense issue.

It's definitely not an ISP issue, i get full speed with different machine, same opnsense config and sfp+ modules. CPU on DEC 750 is too slow for 10G, unless there are some config options that we've missed.

I'm curious to know if you ever end up getting better performance out of the DEC750. Here is my thread about the same topic.

https://forum.opnsense.org/index.php?topic=50846.0

And the only way I managed to max out my internet connection:

https://forum.opnsense.org/index.php?topic=50846.msg268263#msg268263

Not sure if this is the right place to report UI bugs - apologies if it's not the right place or if it's already been fixed in newer versions.

In opnsense business 26.4.2, when adding a new network in the igmp-proxy interface, you can't change the CIDR. The dropdown lets you choose a new value but always goes back to 24 regardless what you select. You have to leave it at the default 24, save changes, then you can update it and save changes again.

Not sure if this is a general bug that appears in other areas, of it's specific to the igmp-proxy.

I managed to get it to work. Somehow, I think the IGMP traffic into my LAN interface was being handled by another firewall rule, before my explicit IGMP rule, which didn't have "Allow options" enabled.

I don't know why this only started happening after the update. At least I learned something in the last couple of days, that a possible cause of tcpdump seeing IGMP traffic and igmp-proxy not could be forgetting to add allowopts on the firewall rule.

[em0]

I had some more time to debug a bit, or at least to gather some more information.

LAN interface em0 is Intel I219-LM
WAN interface is vlan01 with parent ixl0 Intel X710

tcpdump -nvi em0 igmp shows messages like this when changing channels:

Code Select Expand

192.168.2.20 > 224.0.0.106: igmp v2 report 224.0.0.106
192.168.2.30 > 239.186.68.2: igmp v2 report 239.186.68.2
192.168.2.30 > 239.255.255.250: igmp v2 report 239.255.255.250
192.168.2.1 > 224.0.0.1: igmp query v2
192.168.2.30 > 239.255.255.250: igmp v2 report 239.255.255.250
192.168.2.30 > 224.0.0.251: igmp v2 report 224.0.0.251
192.168.2.30 > 239.186.68.2: igmp v2 report 239.186.68.2
192.168.2.30 > 224.0.0.2: igmp leave 239.186.68.2
192.168.2.30 > 239.186.68.202: igmp v2 report 239.186.68.202
192.168.2.1 > 224.0.0.1: igmp query v2
192.168.2.20 > 224.0.0.106: igmp v2 report 224.0.0.106
192.168.2.30 > 224.0.0.2: igmp leave 239.186.68.202
192.168.2.30 > 239.186.64.4: igmp v2 report 239.186.64.4
192.168.2.30 > 239.255.255.250: igmp v2 report 239.255.255.250
192.168.2.30 > 239.186.64.4: igmp v2 report 239.186.64.4

tcpdump -nvi vlan01 igmp has no output

igmpproxy -ndv /usr/local/etc/igmpproxy.conf shows this when starting, then nothing more:

Code Select Expand

adding VIF, Ix 0 Fl 0x0 IP 0x0102a8c0 em0, Threshold: 1, Ratelimit: 0
adding VIF, Ix 1 Fl 0x0 IP 0x787d0290 vlan01, Threshold: 1, Ratelimit: 0
Joining group 224.0.0.2 on interface em0
Joining group 224.0.0.22 on interface em0


As the title says, I upgraded OPNSense Business to 26.4.2 and my IPTV stopped working. I'm not sure if it's an issue with igmp-proxy or something completely unrelated.

The only message relating to igmpproxy in the logs is:
Warning igmpproxy select() failure; Errno(4): Interrupted system call

This message only started appearing after the upgrade.

Any help would be appreciated.

my Only disappointment with Opnsense is when buying a new appliance the business license starts from the day of your purchase:

I did not realize this on my 2nd appliance and will be losing 3-4 months of the latest license.

  when I setup the new appliance, I used my previous business licensing thinking I could then use the full new license when it expired. when it did expire and I put in the new key it showed I had 9 months remaining..

I then read the email from the appliance purchase and it said it started day of purchase.  live and learn

I would email sales explaining this, they are usually very helpful. Maybe they can offer a discount on a renewal for this lost period or something similar, it's worth a try.

when I tried a few months ago, it didn't. It started to boot, then crashed before the user prompt on the console.

An intel core i5 also has a way higher TDP.

About the UDP vlan fragmentation issue, on a DEC device you can solve that in Interfaces: Settings by enabling vlan hardware filtering.

I'll need to test again, but I'm pretty sure I tried with VLAN HW Filtering both on and off. My SIP phone doesn't receive any response from the registration requests. I'm not 100% sure it's the checksum problem, but I am leaning towards that theory. Unfortunately I didn't spend enough time trying to figure out how to calculate checksums myself to see if they're correct.

Regarding TDP - yes, this CPU can use a lot more power. I got it up to 40W by running iperf3 directly from the firewall, but otherwise it idles at 18W, which I can live with. Maybe there is room for optimization, I haven't done anything yet.

I don't know which device I'll end up using as my main device, I don't need the extra speed from this i5 CPU. It was more of an exercise to see if I can build a cheap 10G firewall. I also wanted to experiment with VyOS now that I have spare hardware.

just a quick update - I decided to try some different hardware. I loaded my config into the following machine:

M920q, Intel i5-8500T, Intel X710-DA2, 16GB RAM

The performance increased dramatically.

iperf3 single stream went from 2Gbps to 4.6Gbps
iperf3 multi-stream went from 5Gbps to 9.2Gbps

CPU load peaks at 50% then drops during the tests.

It also seems to have solved an issue with invalid checksums for fragmented UDP packets on non-default VLAN.

It's not as compact and elegant as my DEC750, and I cut a hole in the top for a fan, but it seems much more powerful.

Not to be too far off topic, I can't even get gigabit fiber to my house, and cable is not reliable because they haven't upgraded their plant in 20 years.

And then the question of a static IP... Generally no or lots of money.

I need to remember not to take fiber for granted. I'm not even with the best fiber provider in Switzerland, like @patient0, but it's cheap, fast, very reliable, and lets you bring your own hardware (as long as it's on their list of approved hardware). I don't have static IPv4 but I'm using godns to update a DNS record from one of my domains, which is good enough for me.

@ou1 - have you come across these?

https://medium.com/@truvis.thornton/opnsense-firewall-configuration-performance-tuning-for-multi-gigabit-internet-and-better-speeds-in-cfc80c49c544
https://calomel.org/freebsd_network_tuning.html

One of the standout tunables is "kern.ipc.maxsockbuf".  On my system (2.5GbE interfaces, 1Gbps ISP) the default 4MB size seems to be OK (the mbuf denied/delayed counters are at zero) but maybe yours needs more if you can spare the memory?

Thanks for the links.

I haven't see that specific guide, but I see that I already have almost all of those settings. My kern.ipc.maxsockbuf was already at 16MB and my deny/delay counts are also at 0/0/0. I've tried setting some more of the options from this guide but it didn't seem to make any difference. I'm maxing out at around 6.2Gbps. If I enable Netflow, it drops to under 5.

I think given I have VLAN tagging on both LAN and WAN interfaces, 15W fan-less box, the performance is already really good.

I've come across this blog post, which also confirms that the DEC750 wouldn't be capable of reaching 10Gbps in my use case

https://blog.shade.sh/index.php/archive/2116

I've turned on hyperthreading in BIOS and applied these settings which allow all 8 cores to process interrupts as described in the post. This got my internet iperf3 performance up to 6.2Gbps, speedtest.net to 5Gbps, which is a small improvement, but I guess this is as fast as it will get.