Messages

Do you use MACVLAN for your Docker Network ?

If not : You should! :)

I don't no, but the fix was pretty easy, I just had to add another PBR rule for the Docker network bridge and now everything works as it should.

Once again, thanks a bunch for the great help, now that the basic setup is done, I can get into the fun stuff and the main reason I chose to run OPNSense.

Sounds like A-Symmetric Routing issues and the "Default DENY / State violation Rule" is always right in my experience :)

It seems like it's time to apply Policy Base Routing on your Server then :)

Thank you so much, this was the problem, and as I already had a bit of PBR in place it was quick to add a few rules more.

I have tested with a SSH connection that timed out previously, and now works as it should. (Prior I could tcpdump return traffic on the wrong interface, and after the PBR, the traffic was only visible on the correct one)

This has unearthed a new problem, unfortunately, because the issue is still present, but only on services published through Docker.

So, this is probably because there is some form of masquerading or other package mangling happening after routing has happened, leading to the traffic still being sent out the wrong interface.

From your subject I figured you were talking about "Bind states to interface". Personally I'd dig into why normal "State Type: keep state" does not work for you. It suggests a client/server TCP issue, packet loss, and/or partial bypass of the firewall. Packet loss at least should be obvious - it kills performance. I can't think of a practical security exploit for sloppy state offhand, but that doesn't say much.

Sorry for not getting back, I finalized my setup yesterday evening and during that I have changed some routing issues that I had when I wrote this entry, which I think may have been the cause of the sloppy state issue (packages leaving through one interface but returning through another)

I will check up on it tonight.

[State Type]

Hi all

I am in the process of migrating from an old Edgerouter 4 to OPNSense, and for the most part, i've gotten things working as intended, but, I currently have a single pain-point that I am not entirely sure about.

I am currently using 3 ports on my device, 0 is WAN (which I do not think is relevant for this), I have a routed /29 on a server in port 1, and then I have my LAN on port 2.

When I connect to a TCP based service on my server from my LAN (port 2 to port 1), I can connect just fine, so the firewall rule work, but after 15 or so seconds, I start seeing "Default deny / state violation rule" in the firewall log, and then the session is disconnected.

But, if I set State Type to sloppy state, then it works as intended.

The docs does not say much about sloppy state tracking, so my question is, is it a "bad" thing to enable?

Or is it just something that is required, maybe due to the way I have configured my network? (The service is running in a docker container with port binding, so there might be more in play here than just OPNsense)

The setup seems to work fine for external connections, so I would not think it should be a big security issue having it enabled on LAN only connections.

You don't. OPNsense will use one of the IP addresses and be the default gateway in that particular network, 5 more are usable for devices. The lowest (lowest 3 bits 000) and the highest (111) address are not usable at all. That's how IP works.

This is not the case for a routed /29 in a link/transport net, the entire /29 is useable for devices.

I have a similar setup on another location, where I currently use 7 IPs.

I think OPNsense calls this a far gateway, when your gateway resides in another net.

A transfer net is the setup, yes, a /30 with the /29 routed "inside".

I've setup the /30 on the WAN interface, but how do I set up the full /29 on an interface, without OPNsense using one of the IPs?

In your example, 192.168.0.1 would be "used" on the OPNsense interface, and not useable on a device, correct?

I am new OPNsense user and i'm still not entirely sure i've wrapped my head around how opnsense does "routing". (I am currently using an EdgeRouter)

I have a /29, lets use 192.168.0.1/29, fully routed.

If I assign 192.168.0.7/29 to an interface, can I still use that IP "behind" the interface, or do I need to do some form of NAT, possibly 1:1, to access the equipment on that port?

Also, if I have multiple interfaces and I need to break up the net and "route" some of the IPs to one, some to another, how is this possible? (I think that this is maybe where virtual IPs should be used)


Thanks in advance for any help

Let me preface, I am by no means a networking or firewall expert, but I am currently building a small Proxmox server that will be running a mix of VMs and containers, and I am planning on putting an OPNSense in front of it all.

I have a routed /29, in a linknet, but I am wondering on how to best separate the individual servers in a virtual environment.

Should I create a proxmox bridge for each, and end up with an OPN with 10+ virtual NICs, or would it be better to use VLAN devices and a single bridge proxmox VLAN aware bridge, with all servers connected?

Or is there possible a better suited solution for a setup like this?