1
Tutorials and FAQs / Re: Moving OPNSense to new hardware
« on: October 23, 2024, 11:49:27 pm »
For good measure, i usually go into each interface and specify "Prevent Interface Removal"
Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
2
General Discussion / Re: Who uses opnsense in companies
« on: October 23, 2024, 11:29:10 pm »
I have had great success setting up a OPNsense firewall for each of my clients. I feel they are far better protected than any of the "business" solutions offered by the ISP.
3
24.7 Production Series / Re: Updated to 24.10 broken business subsricption?
« on: October 17, 2024, 10:42:19 pm »
I think this is related, as that error is the top of what is happening here.
I highly recommend pulling back this release before more folx upgrade their production systems
https://forum.opnsense.org/index.php?topic=43474.0
I highly recommend pulling back this release before more folx upgrade their production systems
https://forum.opnsense.org/index.php?topic=43474.0
4
24.7 Production Series / Re: 24.10 BE upgrade CRL errors
« on: October 17, 2024, 08:50:01 pm »
Hi all
Where are we with this?
I just upgraded both, and this only happens on BE, the most up to date CE appears to be doing just fine.
It's just in my VMs. I'm glad I tried the upgrade, which both succeeded fine. I'll hang back and re-upgrade my 24.4 VM at a later time, try again and make sure it's working fine before I upgrade my main system, as well as of my subscribing clients.
Thank you
Where are we with this?
I just upgraded both, and this only happens on BE, the most up to date CE appears to be doing just fine.
It's just in my VMs. I'm glad I tried the upgrade, which both succeeded fine. I'll hang back and re-upgrade my 24.4 VM at a later time, try again and make sure it's working fine before I upgrade my main system, as well as of my subscribing clients.
Thank you
5
Hardware and Performance / Re: SFP+ Ports Not Working or not seen on Firewall with OPNSense
« on: August 02, 2024, 04:40:58 pm »
There might also be tunables like this they can coerce the Intel chip to cooperate with the modules:
hw.ix.unsupported_sfp
Force Intel driver to use unsupported SFP+ modules. Def: 0
boot-time
Set the value to: 1
hw.ix.unsupported_sfp
Force Intel driver to use unsupported SFP+ modules. Def: 0
boot-time
Set the value to: 1
6
General Discussion / Re: os-theme-cicada v1.36 harder to read
« on: July 30, 2024, 08:07:42 am »
Here is a shot of a rules table
7
General Discussion / os-theme-cicada v1.36 harder to read
« on: July 30, 2024, 08:07:14 am »
Hi All
I wanted to reach out and discuss the Cicada theme, which is a gorgeous dark mode of the stock theme.
I thought the screen brightness was more dim than usual, however, I am finding reading text a little harder unless I cut out more light in the room.
The change happened on package os-theme-cicada version 1.36, from 1.35 .
It feels like the brightness was affected globally, or like an alpha blending of 0.70 was applied against black as the background. I am not a huge fan of the graphics being all around darker, however, can we make the text a bright white, or at least like in 1.35?
Screenshots attached of BE edition (1.35) and CE 24.1.10_8 (1.36). Not shown, but a applies to CE 24.7.0_5 too.
Thanks
YFA
I wanted to reach out and discuss the Cicada theme, which is a gorgeous dark mode of the stock theme.
I thought the screen brightness was more dim than usual, however, I am finding reading text a little harder unless I cut out more light in the room.
The change happened on package os-theme-cicada version 1.36, from 1.35 .
It feels like the brightness was affected globally, or like an alpha blending of 0.70 was applied against black as the background. I am not a huge fan of the graphics being all around darker, however, can we make the text a bright white, or at least like in 1.35?
Screenshots attached of BE edition (1.35) and CE 24.1.10_8 (1.36). Not shown, but a applies to CE 24.7.0_5 too.
Thanks
YFA
8
General Discussion / Re: RDP access to windows behind opensense from external IP
« on: July 29, 2024, 11:43:25 am »
add an allow rule for the interface shown with the error Default deny / state violation rule
9
General Discussion / Re: Possible bug?
« on: July 09, 2024, 03:28:56 am »
That seems more for a hardware (even if VM) question. What are you using for your VM management?
10
General Discussion / Re: Opnsense business
« on: June 20, 2024, 06:55:17 pm »
We'll check that out, or at least a 10 year, aligned with how often we renew domains etc.
11
General Discussion / Re: Is this a bug? var/log filling up 4gb of logs in days.
« on: June 18, 2024, 12:33:38 am »
something is filling up the logs very fast, I wish there was a way to see each log area and get the totals of each size.
For now you need to do the following to see which one is swelling up. Log in to the box via console, ssh, serial.
cd /var/log
du -hscx -- *
From there it will depend what you need to address, maybe you have disk issues, network card causing too many interrupts, someone is trying to break in through the firewall, you have a device constantly requesting an ipv6 address
When you see which one is largest, it will have a latest.log, dmesg, syslog etc.
You can run this to watch the log and keep refreshing even if the file is rotated:
tail -F logFile
For now you need to do the following to see which one is swelling up. Log in to the box via console, ssh, serial.
cd /var/log
du -hscx -- *
From there it will depend what you need to address, maybe you have disk issues, network card causing too many interrupts, someone is trying to break in through the firewall, you have a device constantly requesting an ipv6 address
When you see which one is largest, it will have a latest.log, dmesg, syslog etc.
You can run this to watch the log and keep refreshing even if the file is rotated:
tail -F logFile
12
Hardware and Performance / Re: Question about managed switches
« on: June 13, 2024, 05:04:12 am »
Those should work fine and deliver on vlan. they're a bonus having some level of prioritization. I use the GS308EP series. I think the gs108 should be similar. I don't do port bonding/lagg, and these do only a more basic mode than lacp.
13
General Discussion / Re: Assign multiple IPs via DHCPv4 / DHCPv6 to the same Host/DUID/MAC Address
« on: June 08, 2024, 09:26:10 am »
Then use one of those obscure systems podman, hetzner, or eurovision. I won't put my name behind obscure software.
Don't forget both protocols are very different. I'll set static reserved ipv4 addresses. for my very important devices, I'll give them a static ipv6 address. The ipv6 client presents something totally different than a simple Mac address. the ipv6 leases tries to find the ipv4 version but it's not guaranteed. Besides servers, it's not really important what ipv6 a client device has.
Don't forget both protocols are very different. I'll set static reserved ipv4 addresses. for my very important devices, I'll give them a static ipv6 address. The ipv6 client presents something totally different than a simple Mac address. the ipv6 leases tries to find the ipv4 version but it's not guaranteed. Besides servers, it's not really important what ipv6 a client device has.
14
General Discussion / Re: Correct config with IPv4 and v6
« on: June 06, 2024, 06:01:35 pm »
In your WAN interface config, you might need to uncheck a box that says, Only Request ipv6 route. it's in the same place as the prefix request. The address you "should" be handed starts with 2001:xxx.... That would then be a world accessible IPv6 to your FW.
For me it's not worth enabling the v6 listening side because it is a dynamic IP allocation, and my domain registrar does not yet support dynamic DNS for AAAA records, IPv6 version of a host A record.
For me it's not worth enabling the v6 listening side because it is a dynamic IP allocation, and my domain registrar does not yet support dynamic DNS for AAAA records, IPv6 version of a host A record.
15
General Discussion / Re: Wireless Access Point Issues
« on: June 04, 2024, 07:19:39 pm »
This would be a first for something going into Bridge mode on its own. On these off the shelf devices, you usually have to manually put it Bridge mode. Once you do that, it stops being a firewall and you don't need it to be handing out addresses. The mode switch usually makes it reboot too. I had some Asus devices, and noticed the WAN/Internet port doesn't work the same way as the remaining switch ports. I would just plug the switch1 into port 1 of the WAP