Messages

1

23.1 Legacy Series / Re: block incoming wan on dest IP and allow domain names

« on: June 11, 2023, 03:14:57 pm »

Thanks!

I will look into sniproxy, see if its worth setting up.

I am using the acme plugin on opnsense, but only for opnsense itself. I could indeed move it all there, but it would require manual setup for each domain/service I setup with custom scripts to distribute certs (we wanted to keep it simple and straightforward right ). The container I am running is fully automated; I spin up a new app inside a container and it automatically gets setup. (Its jwilder/nginx-proxy with acme-companion, in case you're wondering).

Anyway, sniproxy . I'll look into it .

Thanks!

2

23.1 Legacy Series / Re: block incoming wan on dest IP and allow domain names

« on: June 11, 2023, 02:38:51 pm »

Thanks, yes simple and straightforward is the way to go  .

IPS / IDS is too complicated and way too much for my needs.
Zenarmor with its cloud based service based in the US is a no-go for me .

I cant / don't want to move my nginx, its running in a container with Acme scripts to provide automatic certificate generation and renewals.

I was hoping it could be as simple as creating an alias with hostnames and providing that to the NAT rule but alas, that didn't work.

Perhaps running nginx or haproxy specifically for this purpose in front of my internal nginx could work? Any thoughts on that?

3

23.1 Legacy Series / block incoming wan on dest IP and allow domain names

« on: June 11, 2023, 01:52:07 pm »

I have a fixed external IP, I own a domain name and I have setup several services I run from home, almost all of them behind an nginx reverse proxy with SNI setup based on sub domains.

My current port forwarding rules are set to destination WAN address, port 80/443 with a forward to nginx.

It gets hammered, obviously and nginx stops it, so no real issues. I could possibly setup fail2ban as well but I was wondering if I could setup opnsense to stop direct hits on IP address only? Same way nginx identifies fqdn's via SNI could opnsense possibly do the same and stop it if the destination domain is not allowed?

Thanks!

4

23.1 Legacy Series / Re: unbound deleting custom-options.conf

« on: May 18, 2023, 10:42:13 am »

Thanks for the help.

I'm not sure why that config uses 45.90.28.0, that doesn't work. Using their "real" public IP addresses does.

So in short, its working .

5

23.1 Legacy Series / Re: unbound deleting custom-options.conf

« on: May 18, 2023, 10:15:43 am »

it is, but nextdns is providing me a config that I (with my limited DoT knowledge) am unable to translate to the opnSense DoT config:

forward-addr: 45.90.28.0#123ab4.dns.nextdns.io

I tried to work it out, but I have no idea how to translate the line above to a working domain, ip, port and cn for DoT via GUI to work.

ps. im mucking around with DNS, but while this forum and other sites work, docs.opnsense.org seems down for me? Is it?

6

23.1 Legacy Series / unbound deleting custom-options.conf

« on: May 18, 2023, 09:56:21 am »

I need to add the following to unbound config:

Code: [Select]

forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 1.2.3.4#bla.dns.nextdns.io
  forward-addr: 1234:1234::#bla.dns.nextdns.io
  forward-addr: 1.2.3.5#bla.dns.nextdns.io
  forward-addr: 1234:1235::#bla.dns.nextdns.io

I tried to create the file /var/unbound/etc/custom-config.conf and add the above, but the file gets deleted.
I tried to add it to /var/unbound/unbound.conf, and that config gets removed.

How do I add the above, which file do I edit or create?

I did find this:
https://forum.opnsense.org/index.php?topic=13978.0

But the custom box (as found in previous versions and in pfsense) is nowhere to be found.

Thanks

7

23.1 Legacy Series / Re: 23.1.7_3 dhcp seems to no longer hand out dns and search domains

« on: May 14, 2023, 09:44:31 pm »

Who is building a plugin for NextDNS? Maybe I'm misreading the upstream report, but want to stress the point that we talk about a hard requirement of a plugin for OPNsense, not just fixing upstream software (it doesn't care and that's good).

FWIW, I would encourage authors of plugins to try and contribute to the official plugins repository so that way I could have changed it up front without any visible breakage.


Cheers,
Franco

No one, I think. Nextdns-cli isn't actually a plugin, its small application (nextdns-cli) that can be installed by calling a installer script.

I made the report hoping the Nextdns-cli devs could have a look at it. I don't think they are aware OPNsense made this change.

8

23.1 Legacy Series / Re: 23.1.7_3 dhcp seems to no longer hand out dns and search domains

« on: May 14, 2023, 10:41:14 am »

https://github.com/nextdns/nextdns/issues/835

9

23.1 Legacy Series / Re: 23.1.7_3 dhcp seems to no longer hand out dns and search domains

« on: May 14, 2023, 10:19:14 am »

Cheers!

10

23.1 Legacy Series / Re: 23.1.7_3 dhcp seems to no longer hand out dns and search domains

« on: May 14, 2023, 09:16:43 am »

Are you using AdGuard plugin? Possibly AdGuard running on port 53? Or something else out of the ordinary running on port 53 other than Dnsmasq/Unbound?


Cheers,
Franco

I'd love to hear your thoughts as to you why you'd ask.

Even though DNS is working fine and I was able to confirm that my clients weren't picking up DNS and search domain info after a lease renew, I guess it could be something else has changed and my setup no longer works as I expect?

I actually prefer unbound as primary DNS resolver but when I setup split DNS with unbound, the NextDNS cloud portal showed only a single device for all DNS queries (ie, opnsense).

With the nextdns local service, it logs the client name (hostname) for each query which makes it really easy to troubleshoot why a webpage or redirect isn't working. With all queries coming from opnsense, there's no telling as there can be hundreds of queries per minute or even per second sometimes.

11

23.1 Legacy Series / Re: 23.1.7_3 dhcp seems to no longer hand out dns and search domains

« on: May 13, 2023, 09:47:30 pm »

Yes, nextdns actually.

Unbound runs on 5353. Nextdns listens on 53 and has forwarders for my internal domains to localhost:5353. Ive been using this setup for years now, first on pfsense and more recenty on opnsense.

12

23.1 Legacy Series / Re: 23.1.7_3 dhcp seems to no longer hand out dns and search domains

« on: May 13, 2023, 08:04:58 am »

I'm not so sure anymore if this issue was due to the updates.

I rolled back to 23.1.6 and reverted to a config from a couple of days back. The issue persists.

I reverted another change I made in Unifi controller which didn't help (and it shouldn't have it was unrelated).

I then entered the DNS IP address and search domains in DHCP in OPNsense (which I tried before after the updates) and slowly clients are coming back online.

I have now reverted all the clients manual changes I made to DNS.

I have no idea what is causing this and it did start after the updates yesterday morning. Obvioulsy OPNsense was the first thing I looked at to blame . When I looked into it, it looked like when clients renewed their lease they were loosing DNS settings as if OPNsense wasn't passing that along anymore.

Every client, including STB's, mobile devices, appliances lost their DNS settings.

Settings are still in place even though they should'nt have to. I might remove it later today to see what happens.

13

23.1 Legacy Series / Re: Help with rollback

« on: May 12, 2023, 09:22:06 pm »

I need to learn to read better.

Code: [Select]

opnsense-revert -r 23.1.6 opnsense
 

14

23.1 Legacy Series / Help with rollback

« on: May 12, 2023, 09:11:52 pm »

Ive seen and read https://docs.opnsense.org/manual/opnsense_tools.html

I understand which tool does what, but I need to revert all updates I received this morning and go back to last night state.

If this is possible, can someone please help me out?

15

23.1 Legacy Series / 23.1.7_3 dhcp seems to no longer hand out dns and search domains

« on: May 12, 2023, 01:39:50 pm »

OPNsense 23.1.7_3-amd64
FreeBSD 13.1-RELEASE-p7
OpenSSL 1.1.1t 7 Feb 2023

Since the updates I installed this morning, clients that renew no longer receive settings other than an IP address, subnet mask and default gateway. No DNS servers or search domains seem to get passed on to clients.

I've noticed this behavior on mobile phones, macos clients, linux clients and windows.

I've seen some other issues recently mentioned on the forums, about dynamic dns, unbound restarting.

Perhaps we can add this to the pile of issues .

if theres a quick fix I'd love to hear it, for now Im setting DNS manually.

Thanks.