Messages

1

General Discussion / Re: OPNsense + Pi-Hole Questions

« on: March 19, 2020, 03:09:21 pm »

What I haven't figured out is how to forward external DNS requests to pi-hole.  i.e., Some devices like Chromecast will also use Google DNS (even though DHCP specifies a different server).  I can't seem to setup a port forwarding rule to forward requests to 8.8.8.8 to pi-hole.  I can only get that to work by forwarding to the router (per that link posted earlier).

You can obtain your goal by creating a hairpin on the Outbound NAT.

Interface: LAN
Source: !<Pihole IP> (mind the exclamation mark) or even narrow it down to only your chromecast source IP
Source port: *
Destination: <Pihole IP> (mind the missing exclamation mark)
Destination port: 53
NAT Address: Interface address
Nat port: *
Static port: NO
Description: DNS Hairpin

2

Dutch - Nederlands / Re: open poort Wan -> intern IP Opnsense 20.1

« on: February 11, 2020, 10:36:10 am »

Ik snap niet zo goed wat je probeert te bereiken.

Hoe zien je Firewall rules er uit? In principe hoef je om te kunnen gamen alleen maar een Pass rule aan te maken op je LAN naar buiten. Zie 1e screenshot op deze pagina: https://docs.opnsense.org/manual/firewall.html

Kan je screenshots delen?

3

General Discussion / Re: Cannot get forced redirect of DNS to Pihole

« on: January 26, 2020, 12:43:59 am »

Thanks Northguy!
One more question, is there a package/plugin similar to "pi hole" for opnsense?
I saw one called sunnyvalley but not sure if this can take place of phhole or it's an overkill for a basic home usage.

There is DNSBL for Unbound and Sensei from Sunnyvalley. Don't know if they suit your needs, so you need to experiment for yourself.

4

General Discussion / Re: Cannot get forced redirect of DNS to Pihole

« on: January 25, 2020, 10:09:47 am »

It will work if you put a NAT loopback on the outbound NAT. Need to come back later with screenshots (not in the opportunity right now). You could also google on hairpin nat to see if you can come up with the solution yourself.

Hi,

Create a port forward like this (NAT Port forward):
Interface: LAN
Protocol: TCP/UDP
Source: invert -> 192.168.1.22
Source Port: Any
Destination: invert -> LAN ADDRESS
Destination Port: DNS
Redirect Target: 192.168.1.22
Redirect Port: DNS
Nat Reflection: Disabled

Create an outbound NAT translation like this (NAT Outbound):
Interface: LAN
Protocol: any
Source: invert -> 192.168.1.22
Source Port: Any
Destination: 192.168.1.22
Destination Port: DNS
Translation/Target: interface address

This should do the trick. One drawback is that in pihole you will see all redirected traffic coming from OPNsense instead of your client.

When configuring a hard coded DNS like 1.1.1.1 and using nslookup, it still shows that 1.1.1.1 is resolving the DNS, but actually you will find an entry in pihole.

Maybe it can be done in an easier way. Open to suggestions.

5

General Discussion / Re: Cannot get forced redirect of DNS to Pihole

« on: January 24, 2020, 12:29:19 pm »

It will work if you put a NAT loopback on the outbound NAT. Need to come back later with screenshots (not in the opportunity right now). You could also google on hairpin nat to see if you can come up with the solution yourself.

6

General Discussion / Re: No DHCP DNS registration when using Unbound with BIND DNSBL ad-block

« on: January 14, 2020, 07:39:04 pm »

Did you perform the last step from the HOWTO? This is meant to fix your issue:

Fixed Unbound Config
When you think your setup runs stable and you still need your Unbound cause of local overrides you can set BIND as your forwarder in Unbound. Just add this to yout custom options field:

do-not-query-localhost: no
forward-zone:
name: „.“
forward-addr: 127.0.0.1@53530

7

Hardware and Performance / Re: [HOWTO] Graciously shutting down APU2D4 with a hardware button

« on: December 23, 2019, 05:35:18 pm »

Should work in a breeze when following info provided. Don't know what goes wrong?

8

Dutch - Nederlands / Re: Gezocht: Opnsense 17.7 download

« on: November 30, 2019, 08:31:13 am »

Probeer eens iets van wat hier vermeld staat: https://wiki.opnsense.org/manual/opnsense_tools.html Misschien biedt dat een oplossing?

9

19.7 Legacy Series / Re: Maltrail consuming a lot of CPU after 19.7.3

« on: November 27, 2019, 01:08:51 pm »

Hi,

Please refer to

https://github.com/stamparm/maltrail/commit/f71c5c7d02d47341f009d3d0f1dbf0ccb63f86ea

10

19.7 Legacy Series / Re: Maltrail consuming a lot of CPU after 19.7.3

« on: November 26, 2019, 10:27:15 pm »

Not sure for my case, just noticed it. Meanwhile MT development committed a patch. @mimugmail, is there an advised way to apply the patch to the plugin? I don't think opnsense-patch can be applied to another repo?

11

19.7 Legacy Series / Re: Maltrail consuming a lot of CPU after 19.7.3

« on: November 26, 2019, 10:26:38 am »

What does your /var/log/maltrail/error.log show? Mine is flooded " with Received unexpected datalink (186) ". Cannot find root cause for it, but this is definitely the rootcause for high CPU load on my device.

12

Dutch - Nederlands / Re: Kan niet inloggen op opnsense

« on: November 25, 2019, 12:40:35 pm »

Al via SSH of serial geprobeerd?

13

Hardware and Performance / Re: PCENGINES APU[1-5] Coreboot SeaBIOS Open Source Firmware

« on: November 09, 2019, 06:01:50 pm »

Removed the response. Since Dave decided to remove his question, my answer to his question is no longer relevant.

14

General Discussion / FYI: NordVPN compromised.

« on: October 23, 2019, 06:23:04 pm »

https://nordvpn.com/nl/blog/official-response-datacenter-breach/

15

General Discussion / Re: [SOLVED] A potential DNS Rebind attack has been detected

« on: September 03, 2019, 04:01:28 pm »

Just wondering: you mark this issue solved, but don't add the solution. For my curiousity and future readers reference: what was the solution?