Messages

[Reply-to]

Hi,

Thank you for pointing me in the right direction!
After a few hours of troubleshooting, I finally managed to get it working.
It turns out that the issue was that I needed to add the AirVPN gateway to the AirVPN firewall rule using the Reply-to option.
The solution was simply to set:
Reply-to:

Code Select Expand

AirVPN_GWEverything is now working as expected!

Thanks again for your help!

[Why is it so incredibly difficult to get port forwarding working through a VPN on OPNsense?]

Why is it so incredibly difficult to get port forwarding working through a VPN on OPNsense?
I'm using AirVPN and have configured WireGuard. The connection is established, and I have a successful handshake.
Policy-based routing is also working correctly when I connect my computer to the dedicated VLAN.
However, I simply cannot get port forwarding to work. I have already configured the port forwarding on the AirVPN side, and my goal is to run Plex through the VPN.
I've done this before with pfSense without any issues. However, after migrating to OPNsense, I eventually gave up trying to get it working. Now I'd like to give it another shot.
Could someone please explain, step by step, how to configure this properly in OPNsense?
To make things easier, let's use the following example:

• Plex server local IP:
  
  Code Select Expand
  10.20.30.40
• Plex internal port:
  
  Code Select Expand
  32400
• AirVPN forwarded port:
  
  Code Select Expand
  45678
• AirVPN gateway:
  
  Code Select Expand
  AirVPN_GW

What I'm trying to achieve is to access my Plex server through the AirVPN public IP using port

Code Select Expand

45678, with traffic forwarded through the WireGuard tunnel to my local Plex server on

Code Select Expand

10.20.30.40:32400.
I'd really appreciate a clear explanation of which NAT rules, firewall rules, and routing settings are required, and how they should be configured to make this work.
Thanks in advance!

Hi,

 I can't reproduce this error in Firefox versions 155 or 156. The firewall rules are scrolling normally for me.

Thanks,

I love screenshots, sometimes they tell more than words. :)

Thank you all for the suggestions and for the links, I'm going to check them out as well.
I also read that you can use HAProxy, so I was playing around with that and managed to get it working.

Yes, I have two Pi-holes acting as primary and secondary DNS servers. But instead of using two IPs, I'd like to use a virtual IP.

Hi,

I'd like to group multiple IP addresses into a virtual IP, but I can't find where to do it in OPNsense. 
I have two Pi-holes and want to group them into one virtual IP.

[DoT traffic on port 853]

@meyergru

Yes, with the rules I've been using it seems to work well. I also have a few additional DNS rules in place to tighten things up a bit.

I also redirect DoT traffic on port 853, which helps prevent devices from bypassing the local resolver using encrypted DNS directly to external providers.

Additionally, I've been experimenting with blocking DoH endpoints, starting with things like Google DNS, to stop clients from using DNS-over-HTTPS to bypass local policies. So far this setup seems to be working well in my tests.

Hi,

This is one of the DNS redirect rules I have for my IoT devices, and I'm sure it is working as it should. 🙂
The firewall rule is set to "manual."
Please correct me if I'm wrong.

Under Settings - NETWORK in your Unifi, in the bottom. Global Switch Settings. There you will find Ethernet Port Profiler
Create New - (image 2) Add your VLANS into Tagged VLANs, like Image 2.

I think you need to add Profile and add your port profiler into it(your vlan).

Are there any updates on this case?

I've experience the same issue when I configure DoT in Unbound with Quad9 Servers even when I only enable 1 Server (ex. 9.9.9.9). Most times, the issue is reproducible (no DNS resolution for any DNS-client; SERVFAIL in Log) after running the following DNS-Checker: https://dnscheck.tools

Thanks for your update.

Hi,

Got the same error with 26.1.2 also when i run the DNS-Checker.

Hi,

Thank you for your reply.
I have already done what you suggested earlier, but unfortunately it did not resolve the issue.

Is there anyone else out there who has managed to fix this?

I am experiencing an issue with port forwarding over a VPN connection, and it appears that multiple users are encountering the same behavior.

I have a single forwarded port configured through AirVPN. To validate the setup, I tested the configuration using pfSense, based on reports from other users that port forwarding functions correctly in that environment. With identical firewall and NAT rules applied, the forwarded port successfully opens and is reported as reachable.

However, when applying the same port-forwarding and firewall rules in OPNsense, the port remains closed. I have verified that the rules are functionally equivalent and applied to the correct interfaces. Despite this, inbound traffic to the forwarded port does not reach the internal host.

I have found several reports from other users describing the same issue, and after reviewing existing discussions, there does not appear to be a definitive resolution.

Is this a known limitation or bug in OPNsense's VPN/NAT handling, and if so, is there a fix planned?
Additionally, what architectural or implementation differences between pfSense and OPNsense could explain why the same configuration works in pfSense but fails in OPNsense?

[0.002]

Hi.

So, does a delay value of 0.002 represent 2 milliseconds or 2 seconds? I'm having difficulty understanding the logic behind this.
What I'm ultimately trying to achieve is to monitor my RTT (gateway ping) over time to see whether it changes.
My current RTT is around 2.3 ms, and it would be useful to have this displayed as a graph in the Reporting → Health section.
That's why I started this discussion, to better understand what these values represent and how to interpret the reported numbers.

user: 2,304  <------ 2,3 or 2304?
nice: 0
system: 1,59      <------ 1,59 or 159 ?
interrupt: 0
processes: 370,081      <------ What is this, 370 or 370,081 (three hundred seventy thousand and eighty-one)

Looking at the screenshot I would assume I see a decimal point.  Looking at your post I see commas that add to the confusion.  RRD/system health uses averages so it's very likely decimal points as shown in the GUI.
Cheers,
Franco

Hi,

Sorry about that, I did use commas in my previous post, but I actually meant decimals.

user: 2.304  <------ 2.3 or 2304?
nice: 0
system: 1.59      <------ 1.59 or 159 ?
interrupt: 0
processes: 370.081      <------ What is this, 370 or 370.081 (three hundred seventy thousand and eighty-one)  <---- That seems like a lot of processes.

I was hoping I could found some health report of the RTT (ping gateway) like the widget in the dashbord of Gateway.
But the health report is showing "delay" 0.002 and this number doesn't mean anything to me :)
I was hoping it was showing the RTT/ping gateway in "ms" in my case 2.3 ms