Messages

1

23.1 Legacy Series / Re: Why are there two WireGuard plugins?

« on: January 20, 2024, 11:07:06 pm »

Hi @GuruLee,

OPNsense 24.1 RC1 has the wireguard kernel mode netmap support available. Any chances you can give that a try? Or alternatively you can wait for 24.1 to be generally available.

With OPNsense 24.1 and Zenarmor 1.16.1 and forward, Zenarmor (and Suricata in IPS mode) is able to handle kernel mode wireguard as well.

2

Zenarmor (Sensei) / Re: Zenarmor packet flow

« on: October 10, 2023, 06:15:14 pm »

Hi @Monviech,

That's a very helpful initiative, thanks.

Zenarmor (or Suricata in IPS mode) will be just between Ingress Interface and Scrub; and for the Egress path, it'll be between Traffic Shaping and Egress Interface.

Hope this inforamtion is helpful.

3

Zenarmor (Sensei) / Re: Zenarmor pages blank

« on: September 24, 2023, 03:05:05 am »

Got it, can you also run below command:

Code: [Select]

/usr/local/opnsense/mvc/app/library/OPNsense/Zenarmor/CLI.php settimestamp

4

Zenarmor (Sensei) / Re: Zenarmor pages blank

« on: September 24, 2023, 12:32:40 am »

Hi @gaurhoth,

We've heard this from a few more users and trying to get to the root cause.

In the meantime, a quick question and a workaround:

- Do you also use zenconsole cloud management ?
- If so, can you restart the cloud-agent to see if this resolves your problem? (You can do so either on the console (service senpai restart) or on Zenconsole FW dashboard.

5

Zenarmor (Sensei) / Re: Wireguard interface active, but Zenarmor not filtering/reporting data.

« on: August 26, 2023, 09:09:31 pm »

Hey @franco,

Thanks for the heads-up. Yes, it the tun patch is not in 23.7, that must be the reason.

Looking forward to the test kernel; team will go ahead and test it.

WRT wireguad-kmod netmap support, we're working on it to see whether it would be feasible to develop/maintain. We'll reach out to the team once we have some meaningful progress.

6

Zenarmor (Sensei) / Re: Zenarmor causes long outages with native netmap driver

« on: August 26, 2023, 08:59:20 pm »

That's good to hear indeed. Another reason why we should focus on improving emulated mode.

Let us check this on our lab as well.

7

Zenarmor (Sensei) / Re: Zenarmor causes long outages with native netmap driver

« on: August 26, 2023, 06:05:22 pm »

Got it, with IPv6+wan tracking interface initialization take a bit more longer because OPNsense tries to re-initialize the WAN interface as well.

Another question: when you use emulated netmap mode, is it better?

8

Zenarmor (Sensei) / Re: Zenarmor causes long outages with native netmap driver

« on: August 26, 2023, 12:15:28 am »

Hi JasMan,

When you start/stop zenarmor engine, zenarmor (same with suricata in IPS mode) issues a call to netmap to start/stop inspecting packets for your protected interfaces respectively.

Once this is requested, netmap re-initializes the interface causing down/up events for the particular ethernet interface.

When OPNsense code notices a link down/up event; it tries to re-initialize and refresh interfaces and services.

This is expected. The thing I'm surprised in your case is that it takes so long for things to "calm down".

Quick question: do you have IPv6 enabled in your network or is it just IPv4?

9

Zenarmor (Sensei) / Re: RAM and CPU

« on: August 05, 2023, 01:57:31 am »

Hi @zzup,

This looks like a pretty decent system.

I can't see how much in there in ARC memory; but I'm guessing High RAM usage might be due to ZFS ARC cache. When there's available memory, ZFS will want to use it for caching. If it sees that some neighbor processors might need extra memory, it should happily return back some of the ARC memory.

More on this: https://wiki.freebsd.org/ZFSTuningGuide

10

Zenarmor (Sensei) / Re: Considering reinstallation of ZenArmor after major crash

« on: July 27, 2023, 12:14:12 am »

@doug, sorry that it did not work out for you this time.

Trying to understand what went wrong WRT elasticsearch database, my best guess is our ES installation might be clashing with another Elasticsearch deployment. To our experience, this usually happens if you're also using Michael's community repository. If you also have that repo enabled as well, pkg might be installing the one which is also served by the community repository, instead of Zenarmor-managed ES database.

Is that the case for you?

11

Zenarmor (Sensei) / Re: fresh installed Zen, but its MENU doesn't show up.

« on: July 19, 2023, 08:41:18 pm »

Hi @fabricioguzzy,

You'll also need to install os-sensei, which is the actual zenarmor package. os-sunnyvalley just enables the repository which serves actual zenarmor packages.

Please see here for detailed instructions:
https://www.zenarmor.com/docs/opnsense/installing/install-zenarmor-ngfw-plugin-on-opnsense-web-ui#zenarmor-next-generation-firewall-plugin-installation

12

Zenarmor (Sensei) / Re: RSS Intel igb and Netmap Driver

« on: June 29, 2023, 06:57:31 am »

Hi @Taunt9930,

If you don't have any reliability issues, native netmap mode should produce better performance figures. But this will be only noticeable once you hit your CPU limits, under normal load, there should not be much difference (according to our tests and what we've received as feedback from our users).

We've introduced emulated improvements as an effort to provide netmap support for drivers which do not have their native support; as an effort to bring a driver-agnostic reliable netmap capability for all ethernet drivers. So, if you don't have issues with your native mode, no harm using that.

WRT RSS, you should be able to safely use RSS with either native or emulated mode. The only caveat is you won't see the performance improvements RSS is offering till we ship multi-core enabled zenarmor. Zenarmor will continue to run on a single CPU core (all queues for a single interface will be served through a single CPU core).

Hope this information is helpful.

13

Zenarmor (Sensei) / Re: OPNsense upgrade failure with Zenarmor (23.1.7)

« on: June 15, 2023, 07:55:41 pm »

Hi @almodovaris,

Thanks for the video. It was very helpful in understanding what's going on.

It looks like the crash is indeed caused by the 'sysctl' binary while trying to update net.inet.ip.intr_direct_queue_maxlen sysctl value.

Although the crash is not directly caused by zenarmor per se; something along the package install path seems to be triggering an operating system bug leading to an OS panic.

We're trying to reproduce this on our environment.

14

Zenarmor (Sensei) / Re: New Zenarmor update?

« on: June 15, 2023, 06:05:04 pm »

Hi @opnsenseuser,

You're correct. There were a few bug-fixes on the engine side of things which might have improved things on your end.

One bug was causing some DNS resolutions to fail in an ad-doc manner after the engine has stayed up for about 4-5 days. This was affecting small deployments and was a result of insufficient memory pre-allocation in small deployment tiers.

We advise updating to 1.13.2 if you're running on 1.13.x release series.

For the full list of updates, please see:

https://www.zenarmor.com/docs/support/release-notes#1132---june-14-2023

15

Zenarmor (Sensei) / Re: Trusting Zenarmor (fka Sensei) / Sunny Valley Networks

« on: June 07, 2023, 05:00:02 am »

Hi @jf2001j, @TheForumTroll,

Thank you for sharing your feedback related to the Heartbeat.

We appreciate your feedback. As shared previously, we believe we are lucky to be serving a technically sophisticated and privacy-conscious user community.

Indeed, this is helping us very much in our quest to provide a great security product without sacrificing the privacy of our users. Compliance with applicable regulations, including CCPA and the General Data Protection Regulation (GDPR), is of utmost importance to us.

@jf2001j, as you correctly pointed out, there are several other technical points where heartbeat messages are helping us to improve the quality of the software:

The information about the number of unique installations provide us insights on several key performance metrics:

• Pro-active detection of software problems: After every release, an unexpected drop  in the number of deployments generally signals us that there might be a software problem affecting some of our users, which allows us to act proactively and start a remediation process without any delay which might impact an even greater number of users.
• Ability to understand how new capabilities shipped with a new release is perceived by our users: We are able to assess this from an increase in the rate of new deployments after a software release.
• Understanding how the software is performing on a newly introduced vs existing platforms: The platform information in the heartbeat provides us this information.
• Understanding which releases are being used and on which platforms & versions: so that we can decide safe EOL dates for supporting individual platforms and releases
• Understanding which platforms Zenarmor is being deployed on, helps us focus our porting and integration efforts.

Also, the number of unique installations information allows us to provide this KPI to our investors so that they have an understanding of how the software is perceived in the field. This is one of the reasons with which we can justify a free tier in the eyes of our investors.

We take it as homework to add this information to the help section of the Heartbeat selection.

Regarding whether IP addresses and similar information which do not directly identify the user:

While we were working on the latest version of the PP and ToS, although there are several interpretations whether it's personal information or not, we decided that it would be safer if we handled them as sensitive information.

To that end, we've placed the necessary security mechanisms in place. The relevant sections in the Privacy Policy ensures that this information is legally safeguarded.

We respect an individual's right to have a differing opinion with our view of this data as information  necessary to maintain our quality of service to our installed user base. We take very seriously our responsibility to protect all data from any purpose other than what’s been stated. We appreciate that individuals or organizations may not wish to share any data when using our service. In this case we understand their decision to uninstall and discontinue the use of our software.

Your feedback is well noted and appreciated. We’ll continue to carefully consider your input in our decision making processes as we continue providing the best possible service to our customers. Thank you.