Topics

Hello

I've been having some issues for quite some time, since 21.7. I'm currently on the most recent version:
OPNsense 22.7.4-amd64
FreeBSD 13.1-RELEASE-p2
OpenSSL 1.1.1q 5 Jul 2022

I have 2 ISP connections, main one being WAN and backup (radio) being WAN2.

WAN is fiber optic but ISP sucks, unfortunately cannot cancel as of now and have to deal with the issues, at least 2 times a week around midnight there is packet loss ~25% so it's not entirely down.... our setup correctly switches to WAN2.

This issue tend to last for 1 or 2 hours, but when WAN starts working correctly now and there is no longer packet loss all the traffic keeps going through WAN2 without switching back to WAN.

I even tried setting up a corn task to reset the WAN interface around 3am.

Allow default gateway switching = OFF
GW GROUP: failover (WAN Tier 1, WAN Tier 2)
FIREWALL LAN Rule: !192.168.0.0/16  Gateway: failover

Anything we are not setting up correctly? Or is this an issue with opnsense?

Hi

I'm trying to find a way for another platform we have read the current gateway statuses and display alerts while using it.

Is there any way to read via API/JSON the gateway statuses? I have 3 ISPs which I would like to monitor without having to login to OPNSense GUI.

Thanks

I'm currently getting very low throughput on OpenVPN. ISP connection is 200/200 however over OpenVPN it goes down to 25/25 mbps aprox.

According to a lot of research online this GW server+CPU should be more than enough to achieve at least 100 mbps, but I would like to get as near as possible to the 200 mbps available bandwidth, if not possible well at least get closer to 100.

Server specs are:
OPNsense 19.7.8-amd64
FreeBSD 11.2-RELEASE-p16-HBSD
OpenSSL 1.0.2t 10 Sep 2019
CPU: Intel(R) Atom(TM) CPU C2758 @ 2.40GHz
RAM: 8GB
SSD: 256GB Samsung EVO


OpenVPN settings:
Encryption: AES-128-CBC
No Hardware Crypt acceleration
No compression

Custom server settings
fast-io;
sndbuf 0;
rcvbuf 0;
push "sndbuf 524288";
push "rcvbuf 524288";

Custom client settings
fast-io
fragment 0
mssfix 0
sndbuf 524288
rcvbuf 524288


Any suggestions?

EDIT: resolved.

Hi,

So far multi-wan has been working OK in my setup (OPNsense 19.7.8-amd64) if a link goes down default gateway switching does is thing.

We currently have 3 ISPs and 1 LAN port in the gateway.

Currently this is the setup:
ISP1 (100/100 DHCP, default gw)
ISP2 (10/10 Static, deprecated, to be removed)
ISP3 (200/200 Static, new one)

Anyway, I have a VPN connection working through the default gateway but it has a dynamic IP and I'm attempting the VPN to be able to receive connections through a the new service (non-default/non-active) gateway but it doesn't work.

When I try to connect to the VPN via ISP3 I ran packet captures and incoming traffic as expected comes from a the non-default gateway ISP3, but the outgoing packets are trying to go via the default gateway (ISP1) instead of the same WAN port it came from (ISP3).

Am I missing something?

Thanks

[(now this is what I'm not sure if I need one even for a non transparent proxy)]

Hi

I'm a little confused about SSL and Squid Proxy.

So I've deployed Squid and trying to implement category based rules along with some custom domain rules, however it doesn't seem to be blocking correctly the domains blacklisted.

I do NOT need transparent mode, I'm perfectly OK in setup devices manually with proxy settings.

Squid settings are:
General:
Proxy enabled
Use via header
X-Forwarded-For header handling Append client's IP

Forward proxy, all default except:
Enable SSL inspection: yes
CA to use: none (now this is what I'm not sure if I need one even for a non transparent proxy)

Let me know, thanks!
Sergio M.

So with the wan balancing/fail over setup finally now my only remaining configuration is per client proxy settings.

What I want is everybody to go through the cache proxy. Regular users to have Facebook/Youtube/... blocked, some devices with some things unblocked, other devices other sites unblocked, so on...

For what I understand everybody has the same privileges if using the proxy. Is it possible to have different settings for other devices?

Thanks.

Hi,

I've gone through possibly all the documentation regarding multi-wan, including:
https://docs.opnsense.org/manual/multiwan.html
https://docs.opnsense.org/manual/how-tos/multiwan.html
...Google....Forums... but I don't know if I missed something but my multi-wan setup is not working.

/** UPDATE:
I have verified the main reason why this is happening is due to 8.8.8.8 & 8.8.4.4 going from OPNSENSE box to GW1, from the network 8.8.4.4 it goes correctly through GW2 but from opensense box it does now, how can I force it?

Firewall rule for LAN has src * and destination 8.8.4.4 set to GW2, so shouldn't that rule apply to itself too?
**/

GW1 - ISP1:
IP: 192.168.1.254
IFACE: igb2
DNS 8.8.8.8
Description:  Default 100/100 mbps wan, public ip is dynamic

GW2 - ISP2:
IP: 192.168.1.1
IFACE: igb2
DNS 8.8.4.4
Description: FailOver 10/10 mbps wan, public ip is static

LAN:
IP: 192.168.2.1
IFACE: igb0

Routing policy for some IPs going to WAN2 specifically, but everything else via WAN1. Works ok.

What I'm attempting is to route everything via GW2 whenever GW1 goes down, as a fail over. If I unplug GW1, GW2 should still be accesible through the same interface as it's on the same internal network as GW1, but they both go down.

System: Gateways: Group:
FailOver group, GW1 is tier 1, GW2 is tier2. Trigger Level: packet loss.

Everything else is just according to the manual, like the DNS policy routing, LAN policy routing gateway via gateway group.

I did notice though that tracerouting 8.8.4.4 via lan goes through the expected GW2, but if I do it from opnsense box via diagnostics traceroute it still goes via GW1, regardless if the GW is up or down. Also when the cable is unplugged for GW1, both GWs go down simultatenously.

Any help?

Thanks.