Messages

About 60 internal hosts running ZeroTier, which request port mappings via NAT-PMP all the time

As in Servers or as in Clients ?

If you are talking about Clients you could try this : https://forum.opnsense.org/index.php?topic=52419.msg275740#msg275740
ZeroTier Documentation is mentioning P2P so that should work too for just Clients I guess ?!

[i]

That's up to you.  You probably weren't using Debian when they created the problem.

My point is :

There is no problem.

Not in Debian and not in OPNsense.

I don't know about OpenWRT.

Then research it :)

TP-Link is fine for simple stuff like unmanaged switches.
Anything that requires firmware more advanced than that you can only stay away from.

Almost bought one the other day and still might do it in the future : Nothing wrong with their products IMHO...

Ubiquityi totally sucks; they can't even write documentation.

I have other issues with them, but if you can live with those then they are fine too.
In Wall Accesspoints are AWESOME!!! :)

Aruba makes nice switches and access points, and I have an HP router that comes with outstanding documentation which I took out of service because it's too loud.  Apparently they have put Aruba stickers on their routers.  Maybe those would be an option, but they might be expensive.
Do they do wireguard now?

Another thing to research ;)

I'm not aware of such plugins.  System: Configuration: Backups doesn't mention anything in that regard.

Maybe put a hint onto that page: "More backup options may be provided by plugins you can install."

The world is already dumbing down soo much...

Let's not go that far in OPNsense : Mmmkay ?!

Of course I can't know everything.

But you can research your options...

No, when the connection is gone, it's gone and I have to drive there to fix it.

Then you need some kind of OOB device or IPMI/iDRAC/iLO for your OPNsense in such cases :)

Recovering from a disaster is one thing; unexpectedly being forced to do the so-called migration of firewall rules is another thing.
I was told here that it'll take many years before the so-called migration is required.

You keep saying that, but I think you have mixed things up with ISC which will be useable for some years to come, but eventually needs to be migrated to DNSmasq/KEA before it completely disappears!

Other than that, I'm grateful for the help I'm getting here.

You are welcome! :)

Just wait for 26.7.7_7 hotfix ;)

LOL! ^_^

Unrelated, but you're one of the lucky ones, my ISP never liked VLANs, while it works for months at some point the WAN interface going through the VLAN would inexplicably lose the public IP while the other WAN interface (direct connection) remains perfectly fine.

No funky ISPs like that here in The Netherlands luckily ;)

- manage.sync.omnigroup.com
- omnisync.ai

Those two lead me to regular websites and seem to be something targeting Apple users for Documents Syncing/Sharing software and the other thing is some Canadian startup "AI" Movie Editing software...

So I am guessing one of those is "calling home" from your network ?!

[4. Side Aspect: Hiding Administrative Services]

4. Side Aspect: Hiding Administrative Services

There is another, somewhat different issue I encountered while reviewing my HAProxy setup.

Sometimes we want to retain remote access to administrative services without exposing them to routine Internet scans.

A good example is Proxmox VE hosting OPNsense as a VM. If OPNsense fails after an update or configuration mistake, we may need SSH access to the PVE host to repair the firewall or start a fallback VM. Obviously, that access must not depend on the failed OPNsense instance. But we also do not necessarily want to advertise our hypervisor's management interface to the entire Internet.

This requirement is not limited to hypervisors. It applies to various management interfaces and other services that should remain available without being easily discoverable.

That's what OOB devices are for ?!

Another option is to login from a completely different system where you can create a temporary NAT session for the specific IPMI/iDRAC/iLO or Server IP Address and use that to fix whatever needs fixing.
If you want you can combine that with let's say Wireguard VPN connectivity :)


Anyway...


I am 100% a fan of NOT running any kind of Reverse Proxy on a Firewall/Router so I hope a lot of people will read this topic in the future!


Some other common stuff I would also keep away from my Firewall/Router :
- DNS because I use Pi-Hole + Unbound on a seperate device.
- VPN because Certificates are annoying + This Reverse Proxy write up reasoning.
- Multicast DNS Bridging that some people do between their regular VLAN and IoT VLAN or for IPTV purposes, because rebooting your Firewall/Router because IGMP Proxy stopped working properly is NOT COOL !!!
Also the reason why I point people to something like this : https://berthub.eu/articles/posts/kpn-interactieve-tv-zelf-doen/
IMHO the best solution for IPTV users :)

I attached a difference file between the current (older) config.xml file (<), and the newer config file I was using up until late last night (>).

No you didn't :P

I'm not versed in XML language so maybe you can look at these differences and spot something.

It's just a simple text file basically so you can do that yourself too ;)

Cheers,
Franco

Just a quick last FYI reply :

The upgrade to 26.7.7 went smooth and even after one additional manual reboot there were no WAN DHCP issues on my VLAN Interface 300 so I am guessing this issue won't come back anymore either.

Must be all those sevens that fixed it! ;)

Sounds like a job for RADIUS but ALL of your networking equipment needs to support it :)

VMPS - very Cisco specific 😉

And yes, FreeRADIUS has got a backend for that.

you need client support

Not for VMPS. That's the good part. It "simply" does dynamic MAC address <> VLAN mapping.

802.1x is a different matter, correct.

I will look up VMPS but I really meant 802.1x in this case ;)

If only Mikrotik configuration was not such a hassle... I like Unifi for everything switching and APs.

I have got one UniFi Switch making weird noises since a week or so : https://community.ui.com/questions/US-8-started-making-a-weird-noise-Time-to-replace-the-capacitors/43594bc0-9399-4354-ac63-01473fb34c74

And I think I will replace it with this one : https://www.zyxel.com/global/en/products/switch/gs1200v3-series/specifications (GS1200-8v3)
Costs just € 23 and seems to be just as good for the thing I need it to do :)

The only thing that's really difficult is replacing the In Wall units should I ever need to.
Maybe I will have a look at MikroTik despite not really liking their CLI syntax from what I can remember...

In the end I want to migrate everything to devices with their own webGUI or SSH access (or both) and no longer have to mess around with that stupid UniFi Controller since they ruined everything starting with version 6.x.x when everything became so bloated !!! :(
Despite needing Java and MongoDB the last 5.x.x version was IMHO a lot better than all that nonsense they are doing now...

<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9

Out of memory?

More like out of sockets ?!

I checked the Unbound configuration and all my settings were wiped out in the GUI yet it is running based on my check command: dig +short txt proto.on.quad9.net.

Maybe the webGUI simply did not load the settings properly because of all the issues ?!

Did you have a look at the Unbound things I suggested ?


To be honest I am running out of suggestions so here are two last ones :
- Test the RAM.
- Check the adapter/power supply.

That's all I got for now...

Good luck! :)

but what about putting all unknown MACs into an isolated subnet?

Sounds like a job for RADIUS but ALL of your networking equipment needs to support it :)

I have the OISD big block list for myself, which has some Ad blocking, but for clients, I just choose the NSFW list.

OISD should be avoided IMHO after some discussion with the maintainer in the past :
- Server the lists were hosted on went offline at a certain point in time.
Turned out the guy was hosting it on a NUC via his home internet connection... d0h!
- The list is "too safe" and allows too many domains in fear of breaking anything...
- There was also some other stuff that I forgot by now.

TL;DR : There are better Blocklists out there! :)

Sadly, too much Ad blocking also breaks a lot of those sponsored websites on the top of [your favorite search engine] your search results.

I think that's no longer the case after some experimenting with Google at least for someone at the official Pi-Hole Forum.

It gets angry people since most people are used to clicking on the first result, past the unrequited AI sputter.

I am a big fan of stuff like : https://noai.duckduckgo.com/
A nice alternative domain without the Machine Learning Chatbot crap :P

[TIP :]

It isn't perfect, but keeps devices (iOS, Android, ChromeOS) and browsers from reaching DNS via alternate means.

https://forum.opnsense.org/index.php?topic=9245.150

Can we assume you tried to post this : https://forum.opnsense.org/index.php?topic=9245.msg267025#msg267025 ?

TIP : Click on the date of a post to get a direct link to it! ;)

once every minute

The connection is thus reestablished every minute

We've already played around with the keepalive interval and timeout, but that didn't really help.

The interval is currently 10 and the timeout 120 seconds, but the disconnect messages are appearing every minute on the dot.

A long time ago when I was maintaining some OpenVPN Servers we had similar issues when Clients were behind more than 1 NAT Router and the connection becomes instable.

If you don't want the connection to go down every minute then your 'Hello/Dead timers' need to be very short or in other words shorter than that minute.
Try 10 and 50 seconds and see how that works out ?

What's the goal of this idea?

I am wondering the same, because this setup basically only covers Router hardware failure as long as you have only 1 ISP on the WAN side...

Keeka is mostly correct, although the subject is a bit muddy for historic reasons.

OK... so...

This was before :

The "associated" rule was rendered into config.xml as a separate rule and could change with the edit of the NAT rule it belongs to, but it could not be easily changed on an update in bulk (during a firmware update for example) if it needed an improvement.

This is now :

With "registered" rules the code to generate the rule can be adjusted to modify it later if needed.
In that sense it's no longer a config.xml bound rule and more of an automatic rule.
Visibility wise both approaches are the same nowadays, but in the past the rule render into config.xml was likely preferred because there was no visibility for automatic rules around.

Right ?!


And could you please explain the "config.xml bound rule" topic a bit more ?
I thought that ALL RULES are always written to config.xml ?!