Topics

Dears,
I have a question (and Issues -.-) with Route-Based IPsec setup.
First of all, I assume, that the Manual (https://docs.opnsense.org/manual/how-tos/ipsec-s2s-conn-route.html) is wrong at the Routes part: there it is stated, that on Site A the network address 10.0.2.0 (which additionally might be a typo as 10.2.0.0 was used) should be set... but 10.2.0.0 is the address of Site A and if one does... this kills the system (I tried in a third shot, as I am unable to get my VPN tunnel working)

For my issue (if anyone is willing to help): I've followed the instructions to 100% with one exception: my site B has no static public IP address... the rest has been kept as stated... (but I also have working policy-based Tunnels on Site A)

So as soon as I provide a Gateway, Site B tries to retransmit: "retransmit 1 of request with message ID 0" and Site A unregisters "05[CFG] vici client 2 unregistered for: list-conn" and finally disconnects... :((

A policy-based Tunnel has been created before as well, but I couldn't figure out how to fix the MTU issue... as soon as a package with a certain size hit the tunnel, the tunnel kept "connected", but no traffic flew through anymore... (tried all the normalization stuff :/)
therefore I tried to give the route-based tunnel a try... without luck as well -.-

Setup:
Site A, OPNsense 24.7.10_2-amd64 on FreeBSD 14.1-RELEASE-p6 (virtualized System) with a static public IP
Site B, OPNsense 24.7.10_2-amd64 on FreeBSD 14.1-RELEASE-p6 (Zima-Board) with a SIM-Card Router and non-static, non-public (incoming) IP / behind NAT

as stated... configured 1:1 like stated in the manual except the static IP parts

any help is highly appreciated!

Dears,

I am on the current stable versions:
OPNsense 24.1_1-amd64
FreeBSD 13.2-RELEASE-p9
OpenSSL 3.0.13

I don't know exactly since when, but currently the OCSP must stable function doesn't work anymore and the settings have changed... anyone faced this issue already?

Hallo liebe Community,

ich versuche, HAProxy für meine zwei Mail-Server einzurichten, was aber daran scheitert, dass die Servernicht die Sender-IP, sondern die FW-IP als "Sender" erhält (was zu Problemen mit DMARC / SPF führt).
Transparent-Mode funktioniert nicht...
Über die GUI lässt es sich meines Wissens nicht aktivieren und der Transparent-Mode funktioniert ebenfalls nicht (Dienst läuft nicht mehr... ich habe aber noch andere HTTP "Services" über HAProxy am laufen).

Weiss jemand, wie dies bewerkstelligt werden kann?

Besten Dank und liebe Grüsse

Mathias

Hallo Zusammen,

Vielleicht kann mir hier jemand helfen, da ich einfach nicht mehr weiterkomme:
Ich habe die OPNsense FW schon eine Weile mit einem Wildcard Zertifikat von LetsEncrypt und einem HAproxy in Betrieb.
Mein aktuellstes Projekt ist OnlyOffice hinter dem HAproxy zugunsten der SSL Verschlüsselung zu betreiben.

Der Server läuft lokal auf Port 80 und funktioniert dort inkl. den Doc-Editoren auch problemlos.

Wenn ich aber die Adresse über den HAproxy öffne, funktioniert zwar die grundsätzliche OnlyOffice Seite noch, jedoch die Doc-Editoren nicht mehr.

Die Einträge von Threads 16595, 19122 & 10343 haben mir leider auch nicht weitergeholfen... von OnlyOffice gibt es unter https://helpcenter.onlyoffice.com/installation/docs-community-proxy.aspx eine Verlinkung zur "zu tätigenden HAproxy Konfiguration" https://github.com/ONLYOFFICE/document-server-proxy/blob/master/haproxy/proxy-https-to-http.cfg jedoch weiss ich nicht, wie ich die Einstellungen in der OPNsense GUI vornehmen kann (wenn überhaupt?)!

Ich gehe davon aus, dass hier das Problem begraben liegt:
  acl existing-x-forwarded-host req.hdr(X-Forwarded-Host) -m found
  acl existing-x-forwarded-proto req.hdr(X-Forwarded-Proto) -m found
  http-request add-header X-Forwarded-Host %[req.hdr(Host)] unless existing-x-forwarded-host
  http-request add-header X-Forwarded-Proto https unless existing-x-forwarded-proto

Für eure Hilfe bin ich sehr dankbar!

Hallo Zusammen,

Ich betreibe noch einen alten Windoof PPTP Server. Von extern kann ich auf den Port 1723 zugreifen und die GRE Weiterleitung ist ebenfalls eingerichtet (lief bislang mehr oder weniger problemlos so)
Mir wurde aber kürzlich eine neue statische IP zugewiesen und im gleichen Atemzug habe ich ein Update auf v21.1 durchgeführt... seither bekomme ich den VPN Tunnel nicht mehr online...

Jemand eine Idee?

Herzlichen Dank und liebe Grüsse

Wuschy

Dears,

Since Update to v21, my MS RAS Server isn't reachable anymore... did some packet tracings and it seems, that no GRE packages are beeing forwarded anymore... any issues about this?

Dear all,

I face the following issue:
I've a Microserver on which I want to have a "locked down" Virtualization environment / Appliance (ESXi, OPNsense & three Windows VMs). On our LAN, we have IPs 172.22.104.xxx with VLAN tags.
So the OPNsense's WAN interface is within our LAN (currently gets a DHCP IP) and the OPNsense's LAN interface is in 192.168.1.xxx range.

I have no problem to ping from within the Appliance to our company's LAN (172.22.104.xxx). But I totaly stuck on connecting or even pinging from the company's LAN to the Appliance.
I've created a pass rule for ICMP on the WAN interface, disabled the blockings for private and bogon networks: no ping response.
When I disable the firewall / paket filtering, I get the responses...

I've also created a port forward for RDP on to a VM without any success (which makes sense when I'm even unable to ping that thing).

Under Diagnostics - pfTop, I can see the incoming connection:
pfTop: Up State 1-31/31, View: default, Order: age
PR        DIR SRC                                           DEST                                                   STATE                AGE       EXP     PKTS    BYTES     
tcp       In  172.22.104.xxx:55675                          192.168.1.103:3389                                 CLOSED:SYN_SENT     00:00:08  00:00:29        4      192   
tcp       Out 172.22.104.xxx:55675                          192.168.1.103:3389                               SYN_SENT:CLOSED       00:00:08  00:00:29        4      192

Under Log Files - Live View I can't find anything at all...

Any ideas?

Thanks for any help!!

Dear all,

First of all, I'd like to thank you very much for this great work and all your efforts!

I might have found a small issue with the most recent version of today:
Versions    OPNsense 20.1.1-amd64
FreeBSD 11.2-RELEASE-p16-HBSD
OpenSSL 1.1.1d 10 Sep 2019

I was able to bind the LDAP Server, but (following these instructions "https://docs.opnsense.org/manual/how-tos/user-ldap.html") am unable to Import Users (Step 3) as there doesn't appear a cloud import icon (neither in the Users-Overview nor in the Add-Form...)

Thanks again and all the best wishes

Hi all,

I don't get it... I've configured the (NAT) rules for GRE and PPTP and in the Log-Files, I can see an incoming connection, answered by my server but then the packages are shown up as incoming from LAN and get blocked by the default deny rule:

__timestamp__   Jun 21 21:23:18
ack   1472432395
action   [block]
anchorname   
datalen   0
dir   [in]
dst   178.197.227.178
dstport   18413
ecn   
id   5395
interface   em0
ipflags   DF
label   Default deny rule
length   56
offset   0
proto   6
protoname   tcp
reason   match
ridentifier   0
rulenr   8
seq   929540809
src   192.168.1.106
srcport   62369
subrulenr   
tcpflags   SA
tcpopts   
tos   0x0
ttl   127
urp   8192
version   4

by the way, this has worked before, but I had issues with my VPN Server and after fixing it, the FW now gets me curious!

Please help!!