OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Profile of buga »
  • Show Posts »
  • Messages
  • Profile Info
    • Summary
    • Show Stats
    • Show Posts...
      • Messages
      • Topics
      • Attachments

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

  • Messages
  • Topics
  • Attachments

Messages - buga

Pages: [1]
1
24.7 Production Series / Lost client ip6 connect after PC reboot
« on: November 05, 2024, 09:25:31 am »
How to set right proxmox ip6 gateway for linux bridge opnsense fe80::be24:11ff:fe8e:c11c

Client
ping -6 fe80::be24:11ff:fe8e:c11c
no reach

opnsense restart (in PROXMOX VM)
ping -6 fe80::be24:11ff:fe8e:c11c
 fe80::be24:11ff:fe8e:c11c: time<1ms
 fe80::be24:11ff:fe8e:c11c: time<1ms

Client reboot
ping -6 fe80::be24:11ff:fe8e:c11c


i have two interfaces

gif0: flags=1008051<UP,POINTOPOINT,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1280
......
        inet6 fe80::be24:11ff:fe8e:c11c%gif0 prefixlen 64 scopeid 0x9
      
      
vtnet0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu ......
        inet6 fe80::be24:11ff:fe8e:c11c%vtnet0 prefixlen 64 scopeid 0x1      
no reach

That is, I need to reboot both the computer and the router so that IP6 works. Why is this and how can I fix it?


2
24.7 Production Series / How add custom options on VPN: OpenVPN: Instances Client
« on: November 03, 2024, 09:02:50 pm »
i see custom options field only in

    VPN: OpenVPN: Clients [legacy]

but i can use only VPN: OpenVPN: Instances

need add  current --script-security

3
24.7 Production Series / Cant connect OpenVPN server TLS Error: tls-crypt unwrapping failed from OpnSens
« on: November 02, 2024, 05:47:00 am »
Client legasy

Trust (auth&cert)



111.311.115.122 SEVER IP
222.239.212.126 CLIENT IP OpnSene (is client)


CLIENT CONFIG generated by script https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
Code: [Select]
client
proto udp
explicit-exit-notify
remote 111.311.115.122 49973
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_ve4XMxxxxxnkhHWL1 name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>
-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxx
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxx
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
xxxxxxxxxxxxx
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
xxxxxxxxxxxxx
-----END OpenVPN Static key V1-----
</tls-crypt>



SERVER CONFIG

Code: [Select]
port 49973
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 94.140.14.14"
push "dhcp-option DNS 94.140.15.15"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_ve4XMxxxxxnkhHWL1.crt
key server_ve4XMxxxxxnkhHWL1.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3




SERVER VERSION
Code: [Select]
# openvpn --version
OpenVPN 2.4.12 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 27 2024
library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
CLIENT VERSION
Code: [Select]
openvpn --version
OpenVPN 2.6.12 amd64-portbld-freebsd14.1 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO]
library versions: OpenSSL 3.0.15 3 Sep 2024, LZO 2.10
DCO version: FreeBSD 14.1-RELEASE-p5 stable/24.7-n267855-304cf693716 SMP
Originally developed by James Yonan
Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>
CLIENT LOG
Code: [Select]
2024-11-02T00:03:56 Notice openvpn_client1 UDPv4 link remote: [AF_INET]111.311.115.122:49973
2024-11-02T00:03:56 Notice openvpn_client1 UDPv4 link local: (not bound)
2024-11-02T00:03:56 Notice openvpn_client1 TCP/UDP: Preserving recently used remote address: [AF_INET]111.311.115.122:49973
2024-11-02T00:03:56 Warning openvpn_client1 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-11-02T00:03:56 Notice openvpn_client1 DCO version: FreeBSD 14.1-RELEASE-p5 stable/24.7-n267855-304cf693716 SMP
2024-11-02T00:03:56 Notice openvpn_client1 library versions: OpenSSL 3.0.15 3 Sep 2024, LZO 2.10
2024-11-02T00:03:56 Notice openvpn_client1 OpenVPN 2.6.12 amd64-portbld-freebsd14.1 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO]
CLIENT INTERFACE
Code: [Select]
ovpnc1: flags=8010<POINTOPOINT,MULTICAST> metric 0 mtu 1500
        options=80000<LINKSTATE>
        groups: tun openvpn
        nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
SERVER ERR LOG

Code: [Select]
tls-crypt unwrap error: packet authentication failed
TLS Error: tls-crypt unwrapping failed from [AF_INET]222.239.212.126:60982
tls-crypt unwrap error: packet authentication failed
TLS Error: tls-crypt unwrapping failed from [AF_INET]222.239.212.126:60982
tls-crypt unwrap error: packet authentication failed
TLS Error: tls-crypt unwrapping failed from [AF_INET]222.239.212.126:60982

4
24.7 Production Series / Correct security setting for Firewall with IPv6 Tunnel Broker
« on: October 30, 2024, 07:43:07 am »
Now i hawe this rules: i think is wrong

5
24.7 Production Series / How to add with autoupdate Abuse ip DB toFirewall: Aliases?
« on: October 29, 2024, 07:01:23 pm »
https://github.com/borestad/blocklist-abuseipdb

I can do upload url from raw one time.

DB memo:
#4 Recommended usage is the maximum 30 days or less to avoid false positives.

6
24.7 Production Series / Re: How edit or delete sshlockout firewall rules?
« on: October 29, 2024, 03:01:25 pm »
Posted by: Seimus
yes indeed, the rules remain in the list but they become inoperative if the checkbox is checked.
ty

Posted by: chemlud
openAIM

7
24.7 Production Series / How edit or delete sshlockout firewall rules?
« on: October 29, 2024, 02:46:23 pm »
have public ip4 ip6 addres and 22,3000 openen to internet.

want change Source * to LANnet, and set IP4 ONLY

Automatically generated rules
Code: [Select]
IPv4+6 TCP <sshlockout> * (self) 22 (SSH) * * * sshlockout
IPv4+6 TCP <sshlockout> * (self) 3000 (MMS/UDP) * * * sshlockout

Pages: [1]
OPNsense is an OSS project © Deciso B.V. 2015 - 2024 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy     | XHTML | RSS | WAP2