Messages

My guess - it often depends on your browser. Using LibreWolf like me might not be the best idea if you update OPNSense.. *shrug*
But error messages starting with "Danger" - well, that just feels like your forgotten uncle from Nigeria sending you millions of Dollars..

Well, to be honest - and this is not really a good idea - I lost interest in most error messages during updates. They appear so often that I now ignore them - and wait 5 minutes if the remote machine, 250km away, comes back to life anyway.

Hiho,
I often need(ed) a script to check for internet connectivity. Some devices offer some kind of, but most of them just try to ping google or similar, not the best idea IMHO. So I made my own, changed it quite often to my needs and use it to monitor connections or to react to failures like restarting a DSL or cable modem or the commonly bad ISP provided plastic box call "WIFI Superduper Highend Router".
Had this problem today, searched for something better, did not found much, so I just drop it here, some might find it useful, hf.
Will have errors, problems, bugs, but well, it's an oooold script and grown over the years.

Code Select Expand


#!/bin/bash

# v0.6.2 Zeitkind
# Watchdog-script for testing Internet connectivity.
# Runs here on an internal Linux machine, but could be anything that knows bash.
# Script might need to be root, so use cron or sudo to start?
# If connection is down, we can trigger other things, like
# starting a failover line or try reseting the dumb modem / router provided by your ISP
# Have you tried turning it off and on again?
# Cable modems started in routing mode, but should have started in bridging mode
# but line was down and profile from ISP was not loaded - also those funny things.
# ...

# Check for log file and create it
if [ ! -f /var/log/connection-check.log ]; then
touch /var/log/connection-check.log
fi

# Only 1 instance of this script should run
# Check is lock file exists, if not create it and set trap on exit
if { set -C; 2>/dev/null >/tmp/connection-check.lock; }; then
         trap "rm -f /tmp/connection-check.lock" EXIT
else
         echo "Lock file exists... exiting"
         exit
fi

# Counters counts the failed connection-checks with either google.com or the second site, eg. sfr.fr
counter1=0
counter2=0

# Function to reset counters
# If only one connection is successful, we are nevertheless online and can reset both.
# Not needed if we don't run the script as a daemon, we just exit the script then.
reset_counters() {
  counter1=0
  counter2=0
}

# Function to log a message and run a script
#
# If we need to restart our router, we log this and call a script that can power off
# and power on the router (or the cable modem or the cheap switch or everything).
# Use your own script, whatever is needed.
# I have a Tasmota power plug and a script called restart-router.sh
# The cheap plastic router from ISP tends to lock up, so I need to power cycle this pos.
# Tasmota should be able to stack commands with Backlog; didn't work for me though, so we just
# power off, wait some seconds and power on again.
# curl -X POST http://<IP>/cm?cmnd=Power%20off
# sleep 10s
# curl -X POST http://<IP>/cm?cmnd=Power%20on
# Log the restart event
# echo "$(date +"%Y-%m-%d %H:%M:%S") Tasmota: Restarted router." >> /var/log/connection-check.log
#
log_and_restart() {
  echo "$(date +"%Y-%m-%d %H:%M:%S") $1" >> /var/log/connection-check.log
  /usr/bin/restart-router.sh
# Router or Modem needs some time to boot and reconnect, so we wait.
# DSL connections might take quite long to reestablish. Adjust for your needs.
# Remark: Some DSL line ports reset on ISP side if our modem is not powered on for
# several minutes, might help to test if your line port is ancient or bad or often
# crash on ISP side and they don't fix it.
  sleep 5m
}

# Main testing loops. We use wget to check for Google and our provider
# We use 2 tries and wait for the answer, line might be busy.
# This whole script can be called by other scripts or cron, so logging that we are online is optional
# Space in /var/log might be limited anyway, be sure to clean the logs or use logrotate etc.
# Logging failed tests is also optional, remove the #'s to enable the parts you want.

while true; do
  wget -q --tries=2 --timeout=10 --spider http://google.com
# If we reach google, we are online and can just exit the script.
# Change this if you want to run this script as a permanent daemon etc. - not recommended though.
  if [[ $? -eq 0 ]]; then
#    echo "$(date +"%Y-%m-%d %H:%M:%S") Google answers, we are online." >> /var/log/connection-check.log
    exit
  else
    counter1=$((counter1+1));
#    echo "$(date +"%Y-%m-%d %H:%M:%S") Google unreachable $counter1" >> /var/log/connection-check.log;
# For debugging write to console
#    echo $counter1;
  fi

  wget -q --tries=2 --timeout=10 --spider http://sfr.fr
  if [[ $? -eq 0 ]]; then
# If we reach our provider, we are online and we just exit the script.
# But the provider itself might be offline, so we could mod here and fire up a
# different connection or switch to a backup line.
# Some providers offer a special "ping-test-server" to check the connection, might also be
# a possibility. I recommend against using eg. ping 8.8.8.8, Google sometimes just ignores
# pings. Same with 1.1.1.1 or 4.4.4.4 etc. pp.
#    echo "$(date +"%Y-%m-%d %H:%M:%S") SFR answers, we are online." >> /var/log/connection-check.log
    exit
  else
    counter2=$((counter2+1));
#    echo "$(date +"%Y-%m-%d %H:%M:%S") SFR unreachable $counter2" >> /var/log/connection-check.log;
# For debugging write to console
#    echo $counter2;
  fi

# If either of the counters are still zero, i.e. one test was successful, we are online
# and can exit the script, it could be started by cron again etc.
# If the scripts gets modified to run all the time, we need to reset the counters to zero.
# If we just exit, that doesn't matter.
  if [[ $counter1 -eq 0 || $counter2 -eq 0 ]]; then
#    reset_counters
    exit
  fi

# If both connection tests fail 5 times, we seem to be offline.
  if [[ $counter1 -eq 5 && $counter2 -eq 5 ]]; then
    log_and_restart "We seem to be offline, restarting router!"
    if [[ $? -eq 0 ]]; then
      break
    fi
  fi
# We should wait some time before we test again.
# If Internet has just a short hiccup, 30s will be fine.
  sleep 30s
done

# After rebooting the router/modem, Internet should come back, so we test
# We can log this if we want
while true; do
  wget -q --tries=2 --timeout=10 --spider http://google.com
  if [[ $? -eq 0 ]]; then
#    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi

  wget -q --tries=2 --timeout=10 --spider http://sfr.fr
  if [[ $? -eq 0 ]]; then
#    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi

# We are still offline, but restarting the router or modem twice in a short time isn't really the best idea.
# So we wait half an hour, probably the ISP has problems.
# We can log this

#  echo "$(date +"%Y-%m-%d %H:%M:%S") Router restarted, but still offline. Sleeping for 30 minutes"  >> /var/log/connection-check.log;
  sleep 30m
# Waited enough, leave while to re-check.
  break
done

while true; do
  wget -q --tries=2 --timeout=10 --spider http://google.com
  if [[ $? -eq 0 ]]; then
#    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi

  wget -q --tries=2 --timeout=10 --spider http://sfr.fr
  if [[ $? -eq 0 ]]; then
#    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi

# Both tests failed, so we are still offline after about an hour, so we restart the router again.
# We wait 6 hours for the next test, probably the ISP has problems.
# This script was made for a remote place far away, so adjusting the values might be a good idea.
  log_and_restart "Router restarted again. Let's see.."
# Now try again 
  wget -q --tries=2 --timeout=10 --spider http://google.com
  if [[ $? -eq 0 ]]; then
    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi

  wget -q --tries=2 --timeout=10 --spider http://sfr.fr
  if [[ $? -eq 0 ]]; then
    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi
 
# Still offline, so we have to wait again 
echo "$(date +"%Y-%m-%d %H:%M:%S") Router restarted, but still offline. Sleeping now for 6 hours"
  sleep 6h
# Waited enough, leave while to re-check.
  break
done

while true; do
  wget -q --tries=2 --timeout=10 --spider http://google.com
  if [[ $? -eq 0 ]]; then
    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi

  wget -q --tries=2 --timeout=10 --spider http://sfr.fr
  if [[ $? -eq 0 ]]; then
    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi

# We are still offline, now we restart the router after 24h and pray..
  log_and_restart "Router restarted again. Let's see.."
 
# Now try again 
  wget -q --tries=2 --timeout=10 --spider http://google.com
  if [[ $? -eq 0 ]]; then
    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi

  wget -q --tries=2 --timeout=10 --spider http://sfr.fr
  if [[ $? -eq 0 ]]; then
    echo "$(date +"%Y-%m-%d %H:%M:%S") Online again!" >> /var/log/connection-check.log;
    exit
  fi
 
# Still offline, so we have to wait again 
echo "$(date +"%Y-%m-%d %H:%M:%S") Router restarted, but still offline. Sleeping now for 24 hours"
 
  sleep 24h
# Now we don't exit, we just restart our router every 24h.
# "Worked for me."® :D

done


Oh man, ich werd' echt alt. Das Problem hat mich also schon mal genervt, dann hab ich im Stress hier was geschrieben, sofort wieder vergessen, und bin nu dank Google auf diesen, meinen, Thread gestoßen...
*facepalm*

Hab jetzt mal alles zwischen
<rrddata>
</rrddata>
gelöscht, ma guggn, danke.

Aber warum?

Versions    OPNsense 21.1.9_1-amd64
FreeBSD 12.1-RELEASE-p19-HBSD
OpenSSL 1.1.1k 25 Mar 2021

Log wird vollgespamt mit

2021-07-29T12:40:26   configctl[3463]   event @ 1627550554.91 msg:   
2021-07-29T12:40:26   configctl[3463]   event @ 1627550554.91 msg:   
2021-07-29T12:40:26   configctl[3463]   event @ 1627550554.91 msg:   
2021-07-29T12:40:26   configctl[3463]   event @ 1627550554.91 msg:   
2021-07-29T12:40:26   configctl[3463]   event @ 1627550554.91 msg:

GUI ist zäh bis unbenutzbar, CPU bei Ecke 100% Auslastung (configctl), Internetanbindung dürftig, aber noch da, nur halt CPU-bedingt übelst. Reboot macht alles wieder heile.

Kennt das jemand? Hatte das früher schon öfters mal auf einem anderen Gerät, aber nie rausgefunden warum. Hab dann mal dort einen automatischen Neustart jedes WE eingestellt und seitdem Ruhe. Heute nu an meiner Hauptanbindung, aber auch kein Hinweis auf Ursache. Aktiv sind noch paar Plugins

os-mail-backup (missing)   
os-acme-client (installed)   
os-api-backup (installed)   
os-clamav (installed)      
os-dmidecode (installed)   
os-dyndns (misconfigured)   
os-hw-probe (installed)      
os-intrusion-detection-content-snort-vrt (installed)
os-lldpd (installed)      
os-mdns-repeater (installed)   
os-smart (installed)      
os-wireguard (installed)   
os-zerotier (installed)

Wobei ich grade noch die zwei gefixt habe
Unregistering plugin: os-mail-backup
Registering plugin: os-dyndns
Glaube aber nicht, daß die Schuld waren, aber wer weiß..
Der LLDPd und MDNS Repeater sind aktuell deaktiviert.

OPNsense 21.1.8_1-amd64
FreeBSD 12.1-RELEASE-p19-HBSD
OpenSSL 1.1.1k 25 Mar 2021

Egal ob Haken oder nicht, in den Backup-xmls landen nu immer RRD-Daten.
Mit Haken: 4,8MB
Ohne Haken: 7,6 MB

Am Ende der xml's stets

<rrddata>
    <rrddatafile>
      <filename>ipsec-packets.rrd</filename>
[ewiglangerASCIIKrempel]...

Mit Haken halt rund 3MB kleinerer ASCII-Block, aber sollte da nicht einfach .. nichts stehen? Oder sind im Backup nu immer irgendwelche RRD-Daten drin?

RRD Daten werden auch ins Nextcloud-Backup gebeamt, nicht nur das manuelle Backup.

Dein 10.0.0.5/24 ist keine IP, sondern ein Netz. Ergo weißt du einem User eine IP aus diesem Netz zu, aber nicht eine spezifische IP, die nur der und immer nur der hat. Das funktioniert eben mit ifconfig push, und nur dann kannst du per IP die Firewallregeln entsprechend der User anpassen.
Klar, braucht man nur, wenn man auch eine entsprechende Anzahl an Usern hat - die auch spezifische Zugriffsrechte haben. Wer nur 1-2 Leutchen am VPN hat, braucht diese Option (oder ganze Listen in einem config-dir) eh nicht.

Damit ordnest du aber keinem User eine spezifische IP zu, damit trennt man eher Gruppen.
Wie oben schon erwähnt (Link zur OpenVPN-Webseite), macht man das entweder per push oder durch eine Liste in einem config-Verzeichnis, welches aber unter OPNSense nicht zugänglich wäre - oder nur per shell und ohne Backup und...
Jedem Nutzer ein eigenes Netzwerk zuteilen, ist ja nicht wirklich zielführend, auch wenn es bei nur wenigen Nutzern machbar ist.
Ich weiß nicht, ob man den OpenVPN-Client dazu bringen kann, das Push-Kommando zu ignorieren, ansonsten ist mir nicht ganz klar, warum diese Option wegfallen soll.

Is-it-only-me or is https://shop.opnsense.com/ kinda broken? If I click on "Appliances", I get.. nothing - https://shop.opnsense.com/#

Über push regelst du ja nur die routen..

Ne, mit ifconfig-push legst du die IP des Clients fest, und kannst dann mit Firewallregeln diese IP beschränken:
ifconfig-push 10.23.45.67 255.255.255.248;
Firewall: unter OpenVPN-Interface, alles first match:
10.23.45.67 darf auf IP interner Mailserver
.. weitere Regeln für alle User...
und zum Schluss: Alle dürfen nix

Edit: Und wenn man bei den Firewallregeln mit Aliasen arbeitet, hat man auch nicht sooo viel an Regeln zu erstellen. Ein nettes GUI dafür wäre mit aber auch .. willkommen.

Moin.

In den Einstellungen "Client Specific Overrrides" bei OpenVPN ist mir aufgefallen, daß "Advanced" als deprecated markiert ist. Nu mache ich da aber meine clientspezifischen Dinge wie ifconfig-push rein um z.B. den Zugriff auf interne IP-Bereiche zu beschränken. Alternativen wären wohl Konfig-Verzeichnisse wie in
https://community.openvpn.net/openvpn/wiki/Concepts-Addressing
beschrieben, aber Zugriff auf ein /etc/openvpn/mein-ccd hat man hier ja gar nicht.
Wie regelt man dann in Zukunft Zugriffsrechte per Client? (A darf nur 192.168.55.10; B darf ganzes 192.168.88.0, C darf alles)

I somehow miss an easy way to renew a DHCP or xDSL-connection anyway. It's always a pita to troubleshot connection problems, reboot is more or less the only safe way to check if WAN/ISP fails or something else goes wrong. I'd really like to have a dedicated status page for DHCP & xDSL-DHCP with only for DHCP and PPPoA/E relevant log entries and esp. the PPPoE/A replies (like PADI/PADO etc.). And a simple button with "Reconnect" or "Renew IP". Even many cheap plastic routers offer a better GUI.. :(
Same for status of a WAN-DSL-combo interface. The (virtual) DSL-interface is never shown as connected, I added a dummy WAN-interface (static IP) to check the (physical) connection status (like 1000baseT <full-duplex>).

Sicher, daß es nicht nur die Anzeige ist? Bei PPPoE gibt es ja quasi 2 WAN-Schnittstellen, das "echte" physische Interface und das eher virtuelle PPPoE-Interface Huckepack. Das physische Interface hat bei PPPoE keine IP, da es auch gar nicht als Netzwerkschnittstelle genutzt wird, es stellt ja lediglich das physische Medium für die PPPoE-Bridge bereit. Intern wurde früher bei PPP-Verbdinungen oft als Dummy die IP 1.1.1.1 o.ä. vergeben, keine Ahnung, wie FreeBSD das macht. Deshalb hab ich ein Dummy-Interface auf der WAN-Schnittstelle mit fester 10er-IP angelegt, damit ich den physischen Verbindungsstatus überhaupt mal angezeigt bekomme (sonst hat WAN im Dashboard kein Netzwerkkabel drin...). Ziemlich nervig, könnte man sicher besser lösen, aber funktioniert.

Had the same problem and no answer. Also back to OpenVPN.
The second issue I have is that there is no OpenSource ZeroTier Central/Controller to host a private network? All I can see is a "License to self-host ZeroTier Central" for $100 per month. Call me paranoid, but unless I can host the controller myself, ZeroTier is not better than other such solutions like Hamachi & Co. And paying $100 per month is not an option for private use.. ^^

Draytek xDSL modem:
https://www.draytek.de/vigor130.html
There is an older model without vDSL, DrayTek vigor120(b), but to be ready for vDSL I'd take the newer one.
The 130 is in fact a little router, but can be put into a pure bridged modus.