1
21.7 Production Series / Re: Enable HSTS on Nginx Reverse Proxy
« on: December 01, 2021, 10:11:24 pm »
You may have missed to reload the server.
Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
2
General Discussion / Re: Why I don't like openssl...
« on: November 30, 2021, 05:56:22 pm »
@franco I think the problem is another. Since the APIs are different so that LibreSSL is not an entire drop in replacement for OpenSSL, it fails because it was not really adopted by open source projects depending on OpenSSL.
Also, LibreSSL did not support TLS 1.3 for a long time so I guess there was a big difference in the expectations of the OpenBSD developers (maximum stability and security) and the developers out there working with it (also the support of current features count).
Also, LibreSSL did not support TLS 1.3 for a long time so I guess there was a big difference in the expectations of the OpenBSD developers (maximum stability and security) and the developers out there working with it (also the support of current features count).
3
German - Deutsch / Re: Nur bekannte Geräte zulassen
« on: November 29, 2021, 10:28:09 pm »
Auch MAC-Adressen funktionieren mit FreeRadius.
4
General Discussion / Re: Why I don't like openssl...
« on: November 29, 2021, 09:17:10 pm »
Maybe they will teach that anyway, so that might be the reason. However it would make sense, to write it differently then as that way it is bad for the reputation.
BTW: Fefe commented that simmilar to you:
http://blog.fefe.de/?ts=9f619581
BTW: Fefe commented that simmilar to you:
http://blog.fefe.de/?ts=9f619581
5
German - Deutsch / Re: Nur bekannte Geräte zulassen
« on: November 29, 2021, 09:05:25 pm »
Mit 802.1x kannst du den host mit dem Login in das Kinder-VLAN stecken und wenn kein 802.1x daher kommt, kannst du das Gerät dem Gäste-VLAN zuweisen. Das würde dir auch ermöglichen, dass du dich anschließen kannst und in dein VLAN kommst.
6
General Discussion / Re: Where do custom NAXSI basic rule (whitelist rule) conditions get applied?
« on: November 28, 2021, 01:10:55 pm »
Main Rules: Global
Basic Rules: Location
Basic Rules: Location
7
General Discussion / Re: Full Backup / Clone SSD possible, how?
« on: November 25, 2021, 12:51:17 pm »
Cold standby is likely not working but hot stand by should work.
Either by using RAID 1 or HAST
https://docs.freebsd.org/en/books/handbook/disks/#disks-hast
Either by using RAID 1 or HAST
https://docs.freebsd.org/en/books/handbook/disks/#disks-hast
8
German - Deutsch / Re: OnlyOffice Docs hinter HAproxy betreiben
« on: November 23, 2021, 07:30:54 pm »9
General Discussion / Re: Backup: Nextcloud configuration
« on: November 21, 2021, 06:42:07 pm »
This is the OCS API:
https://github.com/opnsense/plugins/blob/master/sysutils/nextcloud-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Nextcloud.php#L283
It is used to get the real user id if the user is an LDAP user.
However it might be a sign, that your server is misconfigured, not reachable or OPNsense does not trust that particular certificate (afaik there was an issue with some LE certificates).
https://github.com/opnsense/plugins/blob/master/sysutils/nextcloud-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Nextcloud.php#L283
It is used to get the real user id if the user is an LDAP user.
However it might be a sign, that your server is misconfigured, not reachable or OPNsense does not trust that particular certificate (afaik there was an issue with some LE certificates).
10
German - Deutsch / Re: OnlyOffice Docs hinter HAproxy betreiben
« on: November 21, 2021, 06:37:00 pm »acl existing-x-forwarded-host req.hdr(X-Forwarded-Host) -m found
acl existing-x-forwarded-proto req.hdr(X-Forwarded-Proto) -m found
http-request add-header X-Forwarded-Host %[req.hdr(Host)] unless existing-x-forwarded-host
http-request add-header X-Forwarded-Proto https unless existing-x-forwarded-proto
Ich bin jetzt nicht der HAProxy experte, aber das hier sieht gefährlich aus.
Theoretisch könnte man die Header dann auch von außen setzen.
11
German - Deutsch / Re: ftp.exe im CMD im Windows funktioniert nicht - opensense als Firewall vorhanden
« on: November 16, 2021, 10:31:18 pm »
Ja, da muss man einfach nur den 21er Port umleiten.
Wo du Unrecht hast ist, dass so ein Proxy normal ist. Das ist bei pf so. Im netfilter Projekt (Linux Firewall) ist im conntrack ein Filter drin, der die data connection als related markiert.
https://github.com/torvalds/linux/blob/master/net/netfilter/nf_conntrack_ftp.c#L76
Kommt dann aber effektiv auf das Gleiche raus.
Wo du Unrecht hast ist, dass so ein Proxy normal ist. Das ist bei pf so. Im netfilter Projekt (Linux Firewall) ist im conntrack ein Filter drin, der die data connection als related markiert.
https://github.com/torvalds/linux/blob/master/net/netfilter/nf_conntrack_ftp.c#L76
Kommt dann aber effektiv auf das Gleiche raus.
12
Web Proxy Filtering and Caching / Re: How do I restrict the proxy from allowing access to local networks?
« on: November 13, 2021, 06:16:19 pm »
Via a custom ACL. That is AFAIK not available in the Gui
13
German - Deutsch / Re: Vortragender für OPNsense in Österreich
« on: November 12, 2021, 08:06:40 pm »14
Web Proxy Filtering and Caching / Re: Transparent HTTP Proxy
« on: November 10, 2021, 07:59:22 pm »
Just redirect HTTP (port forward) and forward HTTPS unmodified (just a normal pass rule) to the internet.
15
Tutorials and FAQs / Re: API Documentation
« on: November 06, 2021, 08:57:03 am »I have to add over 100 vlans + NAT rules + DHCP Servers and don't want to do that by hand.
I would do that directly in the config.xml.
Download it, create your settings and upload it again. Afterwards reboot after checking everything is there.