Messages

I recently added a "URL Table (IPs)" alias to the configuration of this firewall cluster.

What I realized: when I configure the table's URL in the GUI the request is being sent via the configured proxy. The hourly refetch of the URL is not done via the proxy at all: the proxy log is empty and I verified in a packet capture that the firewall retrieves the file directly. The log on the standby firewall (that does not have Internet access in the setup) has following log entry that also points in that direction:

Code Select Expand

(Caused by NewConnectionError("HTTPSConnection(host='<hostname>', port=443): Failed to establish a new connection: [Errno 65] No route to host")))

I had a quick look into iter_addresses source code (alias/uri.py) and it looks as though no proxy is being set there?

Ich habe die XMLs beider Firewalls verglichen: die aktive hat die alten Firewall-Rules (<filter>) und die alten Outbound-NAT (<nat><outbound>) Tags komplett leer, während die inaktive Firewall die Teile noch komplett hat. Der Migrations-Assistent auf der inaktiven Firewall exportiert auch genau diese Teile in das CSV.

Ich werde in der GUI den letzten Schritt des Migration-Assistant testen, um die Rules/Outbound-NAT zu löschen. Wenn das nicht geht, dann editiere ich das XML ;-) Mich wundert irgendwie, dass bis auf den unkommentierten GitHub-Bug hier im Forum nichts dazu steht (bzw. habe ich nichts gefunden).


EDIT: Das Löschen über den Migration-Assistant auf der inaktiven Firewall funktioniert exakt so, wie man das erwarten würde. Alles unnötige verschwindet, ebenso der Migration-Assistant. Ob das nun so geplant/gedacht ist oder ein Bug, das weiß ich nicht.

Ich hänge mich hier mal an den Thread an:

Ich habe die Firewall-Rules auf einem meiner Cluster schon sehr lange per Migration-Assistant migriert und heute auch die Outbound-NAT-Rules durch Source-NAT-Rules ersetzt (26.7.4_1). Auf der aktiven Firewall ist der "Migration-Assistant" Menu-Punkt seither auch verschwunden (ebenso der Outbound-NAT Menupunkt). Auf der Standby-Firewall gibt es aber beide Untermenus noch. Der Migration-Assistant dort würde auch gerne die "Current Rules" für Firewall und Outbound NAT exportieren wollen.

Müsste man die Legacy Firewall Rules und die Outbound NAT Rules auf der Standby-Firewall auch im Assistant noch manuell löschen? Wird das ggf. nicht synchronisiert?

Vielen Dank!

EDIT: https://github.com/opnsense/core/issues/10289 scheint das Problem zu beschreiben. Hat aber niemand kommentiert.

Well well... I can for sure just click the trashcan icon. As the buttons were greyed out I did not try before ;-)

Hi,

I just did an upgrade to 26.7 on one of my clusters that have some outbound NAT rules configured. I used the migration assistant steps (export, import, delete outbound NAT) to migrate the NAT rules. Unfortunately I still see the "sort of old" outbound rules in the GUI:



Those old (disabled) rules appeared somewhen during the 26.1 migration and also had an error from the beginning: "This Firewall" and "NO NAT" were not reflecting correctly and it picked the hardcoded IP of one of the firewall nodes as source and a - to me - arbitrary object instead of "NO NAT". The migration assistent rules are correct, though.

Is there a way to get rid of those old rules? I already tried rebooting but it did not help.

Thanks,
jk

Just to confirm: The cronjob works perfectly for the bogons download. It is using the proxy. Also there were no "arpresolve" errors being logged the past days which means nothing tried to connect "to the Internet". Looks good.

Thanks!

Thanks for your answers, franco!

(Honestly,) I only tried the bogons download from the command line (and it failed). But I had only tried because there was no bogons files on the secondary firewall while there was one on the primary - this is why I suspected this to be a problem. I will update the cronjob to run more often and check if (updated) files appear! I'll let you know.

> That's not a usual setup and most people in stricter environments don't care too much about not having outside access for stray components since everything is configured to use local services.

All services I found I configured to use local services as well (although I'm not doing the stunt because I need a "stricter environment" but I am constrained with the public IPs, unfortunately 😕). I will have an eye on it - luckily there is a nice error message from arpresolve that indicates once the secondary firewall tries to access the default gateway... 🙃

Looking forward to using OPNsense in the environment!

[TL;DR]

TL;DR

Is there a(n easy) way to proxy cronjobs in OPNsense (like for bogons download, ...)?

Network Setup

I am currently prototyping a (non-standard) firewall setup with an HA pair of OPNsense gateways (the gateways are only doing firewalling and NAT, no services like dhcp/dns/squid/vpn/...). The challenge I have is that the provider uplink is currently configured with a /30 transport network (official IPv4 addresses) so that obviously I can only have one IPv4 address for the communication - the transport network is used by the provider to send additional networks to me.

Idea

I have found script-driven solution(s) for such scenarios but did not really like having additional scripting (that might break in the future) applied and came up with following idea:

• Use a private IP network on the wan interfaces of the OPNsense gateways fw1 (192.168.0.1/24) and fw2 (192.168.0.2/24).
• Add my IP address from the /30 transport network as a CARP address: 192.0.2.86/30 (provider has 192.0.2.85)
• Add a (default) gateway: 192.0.2.85 (which works fine once you have the CARP address configured)
• Configure Outbound NAT, firewall rules, etc.

Findings

I really like how this works without any scripting and for all communication traversing the OPNsense (Clients<->Internet) this seems to work fine from my testing. Also the CARP failover works like a charm with all connections and NATs being preserved properly. 🥳

Obviously all gateway-originating traffic will be a challenge from the secondary firewall as it does not have an official IP to communicate towards the Internet. For configd there is a documentation snippet how to add a proxy configuration which allows the firewalls (the primary but also especially the secondary) to update packages (and install plugins, ...) via a proxy. As there is no services running on the firewalls there is only some outbound connections left that can be fixed easily: NTP (obviously easy to fix with internal NTP servers), DNS (same), syslog (same).

There is at least one job that does not seem to use the proxy configuration which is the bogons download that is triggered by crontab.

... and finally the Questions

• Is there a(n easy) way to make fetch in the bogons-download use the http_proxy as well? Also without breaking other stuff?
• Is there other cronjobs/daemons/functions that I missed that may have the same problem when no Internet is available on the secondary firewall?

Thanks.