Messages

1

German - Deutsch / Re: Port Umleitung in DMZ (smtp)

« on: December 16, 2018, 06:17:56 pm »

Wenn du mails schreiben willst, machst du das über den mailserver und bindest den filter über das Milter-Protokoll an.

-> https://en.wikipedia.org/wiki/Milter

2

German - Deutsch / Re: Port Umleitung in DMZ (smtp)

« on: December 16, 2018, 11:06:17 am »

Also ich versuch es mal zu verstehen, würde mal sagen du brauchst 2 DNAT regeln, wenn es so in etwa dem entspricht, was ich verstanden habe.

3

18.7 Production Series / Re: Nginx Plugin :: Log Viewer

« on: December 14, 2018, 08:50:28 pm »

nginx now has a log rotation which should prevent logs becoming that large. Maybe it will work tomorrow as it wasn't ever rotated yet

4

18.7 Production Series / Re: Nginx Plugin :: Log Viewer

« on: December 14, 2018, 06:27:50 pm »

This would not help,  If you have around 400M  (just separate: 402_653_184) on server side, it will definitely also kill your browser even if I pass that through in smaller pieces. For such big log files I would not recommend to use them in a web interface. In your case I would recommend the ELK stack, which is better optimized for such problems (pagination is a problem here because the amount of entries is not fixed and new pages may come every second).

5

18.7 Production Series / Re: NGINX listen on WAN

« on: December 14, 2018, 06:17:47 pm »

floating rules apply to multiple interfaces (you can select them or you can leave it empty for all) and the quick option defines if the rule is first (checked) or last match (unchecked). Quick rules override interface rules and not quick rules will be overridden by interface rules (if there is another for the same packet).

6

18.7 Production Series / Re: os-wol plugin

« on: December 14, 2018, 06:14:17 pm »

Since the plugin has no logfile -> syslog

7

18.7 Production Series / Re: NGINX listen on WAN

« on: December 13, 2018, 10:35:55 pm »

Am I right in thinking this should work externally with a rule to allow external addrs to the firewall on the http server port configured in nginx?

Yes, the plugin does not configure firewall rules, so you have to do this by yourself.
You will very likely need a (quick) floating rule which allows access from everywhere

8

18.7 Production Series / Re: NGINX listen on WAN

« on: December 13, 2018, 05:24:53 pm »

1. Define an upstream server
2. Define an upstream (set the upstream server from (1))
3. Define a location and set the upstream  from (2)
4. define an HTTP server and use the location from (3)
5. click the orange buttons with two arrows at the bottom of the view and it should work

---
I have not written the other mandatory fields but I am sure you know what to fill in.
TLS requires that you add a certificate (with key).

9

German - Deutsch / Re: Überlegungen eines Wechsels von pfsense

« on: December 13, 2018, 05:18:56 pm »

Was mich einfach mal so interessieren würde, weil das immer wieder als Argument kommt: @MTA was gefällt dir denn an der "Lizenzpolitik" so viel anders/besser?

Könnte sein, dass er sich daran stört, dass die letzten Jahre die Lizenz so oft gewechselt wurde.

10

18.7 Production Series / Re: Map IPv6 to IPv4

« on: December 12, 2018, 10:32:15 pm »

HAProxy should support client certificates as well (https://github.com/opnsense/plugins/issues/426).

11

18.7 Production Series / Re: Map IPv6 to IPv4

« on: December 12, 2018, 10:11:53 pm »

I have implemented Streams in the nginx plugin which has been released today but haproxy should be able to do this as well. Both are similar in configuration so use whatever you have already on your machine. Please note that you will loose the real source IP unless the upstream service is capable of the PROXY protocol which is supported by both.

12

18.7 Production Series / Re: Nginx Plugin :: WAF Whitelist

« on: December 12, 2018, 05:46:00 pm »

1.4 + 1.5 were a lot of work and diff of 1.3 and 1.5 is around the same size as the first version (~2k lines of code).

So I hope it became a good release

13

18.7 Production Series / Re: Haproxy and Letsencrpyt integration

« on: December 11, 2018, 06:22:25 pm »

See the screenshot attached

14

18.7 Production Series / Re: HAPROXY: Which Ports to which target to open for reverse proxy

« on: December 11, 2018, 06:13:43 pm »

you probably want a rule

PASS IPv4+IPv6 TCP FROM ANY:ANY TO THIS_FIREWALL:WEB_PORTS

WEB_PORTS: Alias for 80,443

15

18.7 Production Series / Re: HAPROXY: Which Ports to which target to open for reverse proxy

« on: December 10, 2018, 10:27:14 pm »

this will not work, you need to bind it on 0.0.0.0 and :: to be publicly available.