"
DNSSEC is completely different form DNS over TLS. To enable it, you need to go to services > UnboundDNS > DNS over TLS. You can use cloud flare DNS (1.1.1.1) with port 853 to enable it. I would recommend forcing all traffic on port 53 to go to unbound through the firewall. After you set it up, verify by using the cloudflare site for testing DNS over TLS. It can only test cloudflare DNS over TLS so if you use another DNS you need to find a way to verify that. Good Luck!
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Pages1
#2
General Discussion / weird issues with network
Today at 06:30:39 AM
I need some help with figuring out what is going on.
I'll start with my setup:
I am running opnsense on proxmox. I have a 8 core, 16 thread AMD ryzen 5 with 32GB RAM. Of this, 14 threads are assigned to the opnsense along with 28GB of RAM. The system has a 500GB drive for Proxmox and a 256GB drive for opnsense. I have a 2.5GB port for internet and a 2.5GB port for LAN along with a 1GB port for proxmox admin controller. The traffic from NICs for opnsense is blocked by proxmox firewall for security. I have VLANs for internet connected IOT devices, work computers, adult devices, kids devices, and non-internet connected IOT devices. I am using Omada OC300 controller with 3 wireless APs and 3 wired smart switches for WiFi and ethernet connections. I have a total of over 50 devices connected. i also have a server for local AI with Home assistant and NextCloud exposed through a cloudflare tunnel with Geo restrictions blocking access from anywhere outside the US and a bunch of other restrictions. Everything that supports 2-factor has 2-factor and the server can only be logged in with public key and 2-factor.
On Opnsense, I have zenarmor with policies set to block unknown devices so each device must be manually approved. I also have multiple policies with a Home level subscription. I am running surricata with snort rules, Maltrail, monit, and CrowdSec for security. I also use KEA dhcp and unbound DNS, and have a Wazuh agent running for general security. I have disabled root access to the GUI, which was set up with 2-factor TOTP and created a separate user which also has 2-factor enabled. Omada also has 2-factor. I use let encrypt certs for my domain on both. I also have static ip addresses set for all devices. I know, its a lot.
For the past year, I have been having weird issues with Opnsense.
Issue 1:
I have a car that is connected to my network and it seems to be connected fine. I can get updates for the car through wifi. However, when it is connected to my network, the API for the car does not work and the car mobile app shows that it is disconnected. I have tried to disable surricata, zenarmor, Maltrail, monit, corwsec, and Wazuh and it still shows as not connected on the app. It also wont connect through the API I use with Home Assistant when connected to my network. I dont see any firewall states that are have an issue for the device. I see nothing blocked in zenarmor. It all looks fine. Now for the odd part. I reinstalled the entire system including the proxmox, which was updated to 9.2 (latest), and reinstalled Opnsense 26.7. I used my backup configs for Opnsense and Zenarmor to restore everything. Everything in the car worked fine for a day or so and then it was showing up as not connected in the app and API. I disabled everything after it showed up as not connected and it changed nothing. The logs for Opnsense show no updates or changes to configs. Wazuh shows no changes either. I have no idea where to look for more details on why this is happening.
Issue 2:
I upgraded my daughters computer and updated the motherboard and cpu, so the wireless card changed. I trusted the device in zenarmor, updated the mac address, and it all looked like it was fine except the wifi would not connect to the internet. I could not find anything being blocked in any of the security software.
Issue 3:
When I used to connect my phone to the network, the browser would randomly have issues like pages not loading css (plain html only) and my VPN would randomly drop. It would also stop working at times and clearing app cache force restarting it would return it normal. This would never happen on the 5g data.
I work extensively with Linux, software dev, AWS, and a secured system at work, so I have some decent knowledge, but BSD is not something I have done much work with. I have considered wifi interference and lowered the power on the APs and one of the APs is located right in my bedroom which is near my work desk.
I will also give a little bit of background in to why I am so paranoid about security. Years ago, I informed the FBI of a person who was involved in hacking ISP like Comcast and many financial institutions and that person went to prison for years with over a $1M confiscated along with expensive cars and homes. He found out that I informed the FBI before he went to prison possibly through the court case, and he was someone I knew. He was involved with foreign hackers from Russia and many hackers from around the world including another one in the US who was of Russian origin. I'm not saying I'm getting hacked, but it certainly is in the back of my mind since he has all the information needed to track me.
I would like determine why this odd stuff is happening to my network despite no logs indicating any issues. I need someone who is an expert in Opnsense to help me diagnose the issue since I admittedly have limited knowledge of BSD and mostly interact with Opnsense through the GUI. There are other details I may be leaving out about the setup and can share information after I de-ID the output. Can someone with extensive knowledge help me diagnose this and find root cause, please?
I am not a bot. I am not making any of this up. I am a slightly paranoid human looking for some help. I have already tried to use Gemini and my local qwen 3.8 and it was mostly things I had already looked at like logs and firewall rules and states. I dont understand how something can change without me making a change to it and no logs or alerts indicating any issues.
I'll start with my setup:
I am running opnsense on proxmox. I have a 8 core, 16 thread AMD ryzen 5 with 32GB RAM. Of this, 14 threads are assigned to the opnsense along with 28GB of RAM. The system has a 500GB drive for Proxmox and a 256GB drive for opnsense. I have a 2.5GB port for internet and a 2.5GB port for LAN along with a 1GB port for proxmox admin controller. The traffic from NICs for opnsense is blocked by proxmox firewall for security. I have VLANs for internet connected IOT devices, work computers, adult devices, kids devices, and non-internet connected IOT devices. I am using Omada OC300 controller with 3 wireless APs and 3 wired smart switches for WiFi and ethernet connections. I have a total of over 50 devices connected. i also have a server for local AI with Home assistant and NextCloud exposed through a cloudflare tunnel with Geo restrictions blocking access from anywhere outside the US and a bunch of other restrictions. Everything that supports 2-factor has 2-factor and the server can only be logged in with public key and 2-factor.
On Opnsense, I have zenarmor with policies set to block unknown devices so each device must be manually approved. I also have multiple policies with a Home level subscription. I am running surricata with snort rules, Maltrail, monit, and CrowdSec for security. I also use KEA dhcp and unbound DNS, and have a Wazuh agent running for general security. I have disabled root access to the GUI, which was set up with 2-factor TOTP and created a separate user which also has 2-factor enabled. Omada also has 2-factor. I use let encrypt certs for my domain on both. I also have static ip addresses set for all devices. I know, its a lot.
For the past year, I have been having weird issues with Opnsense.
Issue 1:
I have a car that is connected to my network and it seems to be connected fine. I can get updates for the car through wifi. However, when it is connected to my network, the API for the car does not work and the car mobile app shows that it is disconnected. I have tried to disable surricata, zenarmor, Maltrail, monit, corwsec, and Wazuh and it still shows as not connected on the app. It also wont connect through the API I use with Home Assistant when connected to my network. I dont see any firewall states that are have an issue for the device. I see nothing blocked in zenarmor. It all looks fine. Now for the odd part. I reinstalled the entire system including the proxmox, which was updated to 9.2 (latest), and reinstalled Opnsense 26.7. I used my backup configs for Opnsense and Zenarmor to restore everything. Everything in the car worked fine for a day or so and then it was showing up as not connected in the app and API. I disabled everything after it showed up as not connected and it changed nothing. The logs for Opnsense show no updates or changes to configs. Wazuh shows no changes either. I have no idea where to look for more details on why this is happening.
Issue 2:
I upgraded my daughters computer and updated the motherboard and cpu, so the wireless card changed. I trusted the device in zenarmor, updated the mac address, and it all looked like it was fine except the wifi would not connect to the internet. I could not find anything being blocked in any of the security software.
Issue 3:
When I used to connect my phone to the network, the browser would randomly have issues like pages not loading css (plain html only) and my VPN would randomly drop. It would also stop working at times and clearing app cache force restarting it would return it normal. This would never happen on the 5g data.
I work extensively with Linux, software dev, AWS, and a secured system at work, so I have some decent knowledge, but BSD is not something I have done much work with. I have considered wifi interference and lowered the power on the APs and one of the APs is located right in my bedroom which is near my work desk.
I will also give a little bit of background in to why I am so paranoid about security. Years ago, I informed the FBI of a person who was involved in hacking ISP like Comcast and many financial institutions and that person went to prison for years with over a $1M confiscated along with expensive cars and homes. He found out that I informed the FBI before he went to prison possibly through the court case, and he was someone I knew. He was involved with foreign hackers from Russia and many hackers from around the world including another one in the US who was of Russian origin. I'm not saying I'm getting hacked, but it certainly is in the back of my mind since he has all the information needed to track me.
I would like determine why this odd stuff is happening to my network despite no logs indicating any issues. I need someone who is an expert in Opnsense to help me diagnose the issue since I admittedly have limited knowledge of BSD and mostly interact with Opnsense through the GUI. There are other details I may be leaving out about the setup and can share information after I de-ID the output. Can someone with extensive knowledge help me diagnose this and find root cause, please?
I am not a bot. I am not making any of this up. I am a slightly paranoid human looking for some help. I have already tried to use Gemini and my local qwen 3.8 and it was mostly things I had already looked at like logs and firewall rules and states. I dont understand how something can change without me making a change to it and no logs or alerts indicating any issues.
Pages1
