Messages

Agreed!

In fact, hardware independent memory safety has to be a candidate for my Christmas wish list.
I did find this (C++ Smart Pointer Discipline or Zig) but it seems there still a lot of rework is required for use of new Zig libraries, or Smart pointers within C++

We can only hope!

I think the researchers are showing some foresight in trying to define (and hopefully implement) a technical solution before legislation forces them to adopt something less well considered. I wonder if there is an approach which does not have direct hardware dependencies?

Ah, I see...
And there I was getting my hopes up!
Thanks for the clarification, though. Fingers crossed that something like this can make it to the world of x86-64, but if I understand you correctly, any mitigation of this type may require specialised hardware support.

[Capability Model]

Hi Guys,


A silver lining here: I was looking around at memory-safety related mitigations for FreeBSD, and came across this:

Bringing memory safety to BSD

It seems like this chap, Brooks Davis, is going to supply his Capability Model work from CheriBSD to FreeBSD in version 16 of the OS. I imagine opnsense will inherit this memory protection system as well. Seems a lot less work than FreeBSD considering wholesale adoption Rust...   

Found my issue, and my configuration of Caddy is absolved of guilt in the end. A Destination NAT rule was set to "Manual", instead of "Register Rule." Once that was fixed, everything with 26.7 worked for me :o)

Many thanks for your help!

Many thanks! Will try it!

Hi Guys,

I wonder if I might ask for some help?

I run a mail server behind a Caddy reverse proxy which is hosted on a DEC850 device running opnsense 26.1.8_5. Today, I upgraded firmware to opnsense 26.7, and the experience was great, and everything appeared to be working, except the 3rd party plugin for Caddy.

The Outbound NAT configuration carried over perfectly from the upgrade, and from what I could see, so did all of the firewall rules. I've attached the Caddy file for inspection (although it does appear that I'm bullying Caddy, it's the proxying of HTTP and HTTPS ports that stopped working, so my suspicions are aroused. I've watched Poirot, so I've some idea how to pursue a thread, but not the slightest idea how to fix it).

Is there anything easy that you think I might be missing? If so, though lacking professional expertise, I have the vigor of an enthusiast, so I'm ready to try anything I can understand or research.

(I've temporarily rolled back for now, but I'm learning about a work-around whereby I might proxy the HTTPS port via Caddy hosted on Kubernetes on the email server host).

Again, very pleased with the upgrade, but I've just this one sticking point where I think I may have tied myself in knots. Any help appreciated. I'll supply any relevant info. Not to worry if it's too much a pain, since I can always run with my Plan B and upgrade to the latest opnsense anyway.

Thanks again for your time, and great work on the firmware.
 

Wow, that was fast!

Many thanks, working now! :o)

Me too, unfortunately.

I didn't try to register a new API Key license yet, but it sounds like it would not solve the issue.

I don't know how to test if it is an plugin issue, or something else. Any ideas?

Did you change the listening port to 5353 because you want to run DoT locally?

You're absolutely right about QUAD9 suggesting opnsense disable DNSSEC support, I stand corrected. I do wonder that the pihole/opnsense interaction suffers from the same issue?
Personally, I do not use DNS forwarding or pihole for DNS blacklisting, but use Unbound as the recursive resolver and host for the DNS blacklists. Would this not work for your setup as well?

I'm not sure, but from your explanation, it almost seems you are describing an issue with pihole's DNSSEC support, rather than an issue with opnsense. Does DNSSEC work when you forward to (say) QUAD9?

If you have a configuration backup file, you can make a bootable USB from the OPNSense website: Support-->Documentation.
If you don't have a backup, I'm not sure what you can do but re-initialise and configure your system from scratch.
If you can get to the Console, then you might have a shot at restoring from an older snapshot, but from the image you've posted, I'm not certain your box is booting that far?
Sorry I can't assist more, I'm a Newbie at Opnsense. Perhaps some of the Gurus on this forum can assist where my knowledge stops?

Hi Snuffy2,


I'm a Newbie to Opnsense myself. I've recently performed the same operation as yourself (migrating from ISC to KEA) but without the issue you're facing. Two questions for you:

• When on the Settings page of KEA, did you tick all the relevant interfaces that you'd like to serve DHCP for?
• When on the Settings page of KEA, did you tick the Firewalls Rules checkbox?

I'll take another look later, but that's all I've got for now. KEA pretty much set itself up for me when I followed the tutorial, so I can't help too much. Maybe the experts who have been using Opnsense for year will chime in when they've a moment to spare? 

Hope this helps  :)