Messages

1

Zenarmor (Sensei) / Re: Tutorial: How to Configure DoT on OPNsense Firewall?

« on: Today at 04:36:59 am »

Speaking of man-in-the-middle, in my case, I prefer using DNS-over-TLS with Cloudflare because of thier no-tracking/logging policies, but also because it it's one less way my ISP (Verizon) can track the home usage.

For those who have similar ISPs that love to log everything and sell customer data, DoT could be useful.

2

24.7 Production Series / Re: easy way to revert to former revision of OPNsense?

« on: December 01, 2024, 08:50:13 am »

Would a current backup of the Opnsense configuration not work with a release that is older but still in the same version, ie downgrading from the latest 24.7.9_1 to a earlier 24.7? I'm considering doing this myself, as I too seem to find some new quirk every other day with this latest release, when the previous update seemed to be running without any issues.

3

24.7 Production Series / Issue: DHCPv6 - Old DNS ip still being used - OPNsense 24.7.9_1-amd64

« on: November 30, 2024, 09:17:47 pm »

Yet another issue I've found which does cause minor problems. I switched the hardware I was running my DNS server (Pi-hole) on, updated any and every entry in Opnsense in regards to IPv6 address (I use fixed link-local fe80: addresses for this), and many of my devices are still using the old IPv6 addresses for DNS server. I've deleted all the leases, I've stopped the ISC DHCPv6, disabled the service entirely, deleted all IPv6 leases in Opnsense list, re-enabled, restarted, forced clients to renew DHCP, and yet they are still getting and using the old IPv6 addresses for the IPv6 DNS servers. Only 1 of my computers so far has changed the IPv6 DNS server address entries to the updated ones.

I exported a configuration to see if I could find where that old IPv6 was showing up and found them in the <dhcpdv6> section.

Code: [Select]

<dhcpdv6>
    <lan>
      <domainsearchlist>home.lan</domainsearchlist>
      <ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
      <enable>1</enable>
      <range>
        <from>::0</from>
        <to>::ffff</to>
      </range>
      <prefixrange>
        <from/>
        <to/>
        <prefixlength>48</prefixlength>
      </prefixrange>
      <dnsserver/>
      <ntpserver>fe80::xyz</ntpserver>
      <numberoptions>
        <item/>
      </numberoptions>
      <ramode>assist</ramode>
      <rapriority>medium</rapriority>
      <ramininterval>200</ramininterval>
      <ramaxinterval>600</ramaxinterval>
      <radomainsearchlist/>
      <radnsserver>fe80::aaaa</radnsserver> #This contains the old IPv6 DNS server address
      <radnsserver>fe80::bbbb</radnsserver> #This contains the old IPv6 DNS server address
    </lan>
  </dhcpdv6>
The <radnsserver> entries contain the old IPv6 DNS server entries, and I have no idea how to change that in the GUI. I can't even find any reference to that in the ISC DHCPv6 panel at all.

I did however manage to "fix" the issue by editing the configuration file and uploading/applying the new configuration to Opnsense. Now the new IPv6 DNS server addresses are being given to the DHCPv6 clients on my network. If I simply deleted those entries, Opnsense would start giving out the IPv6 address for my ISP dns server (definetely not what I want) even though I have the IPv6 DNS server address entries in System>Settings>General tab setup. I had to change the IPv6 addresses for both of the <radnsserver> entries.

Again, that did fix the issue, but I still have no idea where in the Opnsense GUI that can be changed, if at all, nor why Opnsense continued to use those old entries, and ignore the new ones, when the appropiate changes where made in the ISC DHCPv6 panel.

4

24.7 Production Series / Re: Update to latest OPNsense 24.7.9_1-amd64, now have 2 issues

« on: November 28, 2024, 06:56:16 pm »

Just adding in some pictures to show what I'm talking about:

5

24.7 Production Series / Update to latest OPNsense 24.7.9_1-amd64, now have 2 issues

« on: November 28, 2024, 04:55:18 am »

After updating to OPNsense 24.7.9_1-amd64 via GUI, I'm having 2 issues, 1 very similar to a previous issue in the previous version(s) (22.x-23.x).

First issue; netdata daemon in both the Dashboard>Services info box, and under Services>Netdata>General, shows as not running (Stopped with option available to start), when in fact it is running and available. Attempting to resolve the discrepency in the Opnsense GUI by either Restarting the service, or Stopping then Starting the service, results in Netdata failing to restart at all, and it wont restart until Opnsense itself is rebooted.

This was similar to an issue in 22.x-23.x when certain VPN services would exhibit the same exact issues. I don't believe it was ever fixed. There was a work around but I didn't know how to perform it since there were never any clear instrustions given on how to do so.

Issue 2; ever since update to 24.7.9_1, I now have over 11.5k DNS queries for "<html" and "<!doctype" every 24 hours orginating from my Opnsense box. I'm still going through the various services I have running on some of VMs in my network, but so far it does seem to be Opnsense making those queries, not any of my other VM/PC in my network.

Neither issue is affecting my network or causing downtime, both appear to be just annoyances.