Messages

1

19.1 Legacy Series / OPNsense hangs on to dynamic IP like superglue.

« on: February 06, 2019, 06:04:33 am »

OK I have a situation where I need to get opnsense to release the ip and get the adsl provider to give a new one. It would appear that OPNsense retains the last one used, shutting it down for minutes and even rebooting the bridged modem does no good. It would appear that OPNsense does too well of a job getting the same IP as before even with DHCP to the ISP. Any ideas?

2

19.1 Legacy Series / Re: OPNsense 19.1 released update!

« on: February 04, 2019, 12:13:12 am »

From a security perspective, it really depends on your threat landscape. I don't think the average person is likely to see network-based attacks targeting the various microarchitectural vulnerabilities plaguing SMT and speculative execution as of late. However, if you feel that you might be of interest to someone with the ability to carry out successful attacks remotely, it'd be best to leave SMT disabled.

In short: determine your risk and plan and mitigate accordingly.

The only other question is whether or not there is any performance advantage for a firewall/router to use hyperthreading or if it is even utilized by anything in this OS.

3

19.1 Legacy Series / Re: OPNsense 19.1 released update!

« on: February 03, 2019, 11:05:06 pm »

Mine went painlessly on both a fanless machine with a Jetway NF592 Motherboard and an Intel  Core i7-7700T running in non hyperthreaded mode and my second machine running a Jetway NF9J-Q87 with an Intel Core i5-4570S. Both are running ZFS. The first one running ZFS with the equivalent of Raid 6 on Six M.2 drives since the board has six SATA ports. The second one running ZFS in mirrored RAID.

Franco or anyone who cares to opine, what is the consensus on hyperthreading with an edge appliance? I have it turned off in which case a quad core Core i5 would be all one would need.

4

19.1 Legacy Series / Re: 19.1 development milestones

« on: November 25, 2018, 08:36:10 pm »

How about ad-blocking, is it on the 19.1 roadmap?

I have to turn mine off to even use dozens of websites so the webmasters have gotten smarter.

You can already use the proxy and set it up to use it to import lists such as Shalla, etc. The proxy as of yet only works with single wan. On one of my firewalls I set the proxy up and have it update the lists once per week. The benefit of the proxy filter is that you have numerous categories you can block including phishing sites. 

5

18.7 Legacy Series / Re: accessing modem gui via wan port

« on: August 14, 2018, 08:24:24 pm »

You are all welcome. It's unnerving not to be able to see if your modem is still synced at the right speed much less do firmware updates.

6

18.7 Legacy Series / Re: accessing modem gui via wan port

« on: August 13, 2018, 07:40:01 pm »

No, my virtual IP is in the same subnet as the Vigor but one different for example the Vigor is 192.168.1.1 and the VIP on the WAN of OPNsense is 192.168.1.2. This also alllows for a mask of 30. I'm not using VLAN. I also disabled the DHCP server on the Vigor even though it is already in bridge mode. I'm also only using the first Multi-PVC/VLAN entry in the modem.

7

18.7 Legacy Series / Re: accessing modem gui via wan port

« on: August 13, 2018, 10:34:00 am »

If the router uses DHCP then the virtual IP, floating rule and NAT should be fine.

8

18.7 Legacy Series / Re: accessing modem gui via wan port

« on: August 13, 2018, 09:23:13 am »

I actually have two Vigor 130s running in balanced and was able to get gui access to both of them which is considerably more complicated than a single wan. First, what type of wan connection, dhcp static or PPPoE. The latter can be done but it takes even more work. https://forum.opnsense.org/index.php?topic=8616.msg38219#msg38219

If you have PPPoE (I hope you don't, it's not great) you can actually add an ethernet interface using the device that PPPoE is using and assign it as for example, 192.168.1.2. When using PPPoE the interface shows as something like pppoe_igb0 or something like that, in the example you would then assign igb0 as a network interface and make the fixed ip in the same subnet as your modem's failsafe ip address.

If you are not using PPPoE and are using Squid ( I don't anymore) just the virtaul ip assigned to the wan and a browser using the proxy will work. The ways I outlined above will always work with  no proxy needed.

9

18.7 Legacy Series / Re: NTP time sync not possible from linux?

« on: August 10, 2018, 11:22:54 am »

By firewallip do you mean the lan ip of OPNsense?

10

18.7 Legacy Series / Re: PPPoE not reconnecting

« on: August 09, 2018, 04:08:04 am »

I don't think I added much value to the thread but I am trying to figure out what you did.

Does your Modem have a PPPoE passthrough mode that you are now using rather than a standard bridge or are you handling PPPoE in the modem and letting it supply a local ip to your router's wan creating a double NAT situation? My modem offers PPPoE passthrough as an option. I think the only difference is that with PPPoE passthrough, you are not limited to one PPPoE session as you are with bridged mode which is limited to the one bridged device being an OPNsense router in this case.

11

18.7 Legacy Series / Re: PPPoE not reconnecting

« on: August 07, 2018, 11:37:24 pm »

NOT OT but still related to the OP's PPPoE problem:

Mine starting behaving oddly as well after the ISP forced me from DHCP to PPPoE on one of my two ADSL wan links( the one with that carrier). Last night when watching a movie online the machine rebooted itself, I had to release and restart that connection on one instance prior to this. My Roku had enough cache to keep playing during the reboot. Glad I upgraded to the most memory containing model. I only went PPPoE on that wan last Sunday so it's likely not 18.7 specific.

I use the TMPFS option for /var/log so I now belatedly set my OPNsense install to send logs to my file server. I have no logs prior to it rebooting itself. I will say that PPPoE is very talkative compared to other methods. Why PPPoE is even used is another subject, it's needless overhead with a weird MTU size. If it happens again I should have logs on my file server.

Oh did I mention how much I loathe PPP anything? Not only that but I loathe PPP anything, hehe.

OT:
There is a way to get the solid drive pampering effect of having dynamic content such as logs in TMPFS but not lose the logs after a reboot and that is to have the system back up the logs once per hour to a compressed tarball on the actual hard drive(s) and decompress that file on bootup after TMPFS is mounted. It would compress on a normal shutdown as well. If it was a cold reboot such as when something faults out, you would always have less than an hour's worth of logs missing.

12

18.7 Legacy Series / Re: Roadmap : false advertising?!

« on: August 02, 2018, 02:20:17 pm »

I can't think of any reason why any semi-civil person would want to side with someone touting a project who feels so good about it that they feel the need to resort to 13 year old bullying and taunting behavior. This person is really doing PFsense a disservice. When OPNsense forked, I was still trying PFsense but the behavior of that community in response to the fork was a total turn off. Looking at OPNsense goals at the time as well as the accessibility and transparency of the devs cemented my decision to give OPNsense a go. I would never want to be associated with a community that accepts and engages in this sort of behavior. I have seen this individuals smear campaigns before, it comes across an incoherent babble like I would see in the confused ward at a care facility except those folks cannot help it, this person can help it but chooses not to.

13

General Discussion / Re: ZFS

« on: August 02, 2018, 02:03:51 pm »

At least it can boot it and thankfully OPNsense installs easily over BSD thanks to the script.

14

18.7 Legacy Series / Re: Fresh RC1 Install Observations.

« on: July 28, 2018, 02:01:33 am »

On your USB stick, do you use conf/config.xml or just config.xml ?


Cheers,
Franco

Just by your question I think I may be doing it wrong. I was leaving the config  xml file exactly as downloaded from the gui under system configuration. Does it need to be renamed to ONLY config.xml and/or residing in a directory called conf? My guess by looking in the root directory of my installed firewalls is that you need a conf directory with conf.xml in it.

As far as filesystems go, at least the installed system does indeed have a module called msdosfs. I'm sure it is in the installer kernel as well?

15

18.7 Legacy Series / Re: Fresh RC1 Install Observations.

« on: July 27, 2018, 05:21:40 am »

I tried fat16 and ext2fs, made no difference. I think the importer looks for an installation rather than a config file in an empty directory as it has done all along. the zfs import does try to find it in zroot at least so far.