Topics

Today I've upgraded to 25.1.9_2. After the upgrade my local hosted website was no longer approachable through the OPNSense Nginx proxy server. Investigating what the problem was by pinging my local webserver url from the console the error is "cannot resolve [my website's url]: Name does not resolve" Hereafter I've tried a bunch of other local url's and all were not resolved. Conclusion can only be that OPNSense no longer is using my local DNS server to resolve local addresses. I ended up to resolve the issue for now was to input the internal url into the /etc/hosts file to make my website available for the outside world.
I can't figure out as to why this situation occurred after the upgrade to 25.1.9_2.
Any ideas?

Today I've upgraded 2 similar servers to version 25.1.5_5 and both don't show the console menu after boot-up anymore like use to be but goes right away to the login prompt.
Is this a new feature or a bug?

Just upgraded to 25.1 and ran into this problem. LDAP bind error [; Can't contact LDAP server].
I have tested the LDAP connection prior to the update and it was still operational.
This happened on 2 machines, one after the other. Where #2 is for backup purposes.
Using the OPNSense tester results in:
The following input errors were detected:
    Authentication failed.
    error: User DN not found

I checked the connectivity from the console:
nc xx.xx.x.x 389 -v -w 10 and the response is:Connection to xx.xx.x.x 389 port [tcp/ldap] succeeded!
So what is wrong with the upgrade?
Added on Sunday 2-2-2025:
Forgot to mention that this is related to OpenVPN.
I've created for some users a local password, added local database to instance settings of OpenVPN and these users are now able to login.

My own fault. Forgot to input the associated subnet addresses in the parameter's field.

Encounter this problem on a fresh 24.7.1 install having multiple WoL cron jobs defined.
Configd_20240821.log entries are:
Waking up host B4:99:Bx:Bx:Ex:Dx followed by returned exit status 1 and next by message ... ['B4:99:Bx:Bx:Ex:Dx' ''] returned Error (1). Same goes for the other WoL jobs.
Running the manually the Wake on LAN service in the GUI performs well and the log entries are just Waking up host B4:99:Bx:Bx:Ex:Dx and no exit status 1 or Error (1).
Other Cron jobs for Letsencrypt and Proofpoint seem to run fine.

Last year I ran into a similar problem https://forum.opnsense.org/index.php?topic=35447.msg172767 but that was solved somehow. During the OPNsense upgrades hereafter OpenVPN wouldn't upgrade anymore and got stuck at version 2.6.10. I did not bother too much as clients were still able to log into OpenVPN.
Now I'm setting up a new server and using the new Instance option for OpenVPN. Everything was rapidly up and running but I could not get assigning a fixed client IP address to work, no matter what option I tried after a whole afternoon Googling for a solution. None of the suggestions found solved the problem.

At last I decided to copy the settings of a working Legacy Server and Client from my "old" working FW but with that I stumbled into other problems. With the exact copy of Legacy settings from my old FW I all the time get a TLS Error: TLS handshake failed and the only difference is the newer OpenVPN version 2.6.11.

Does anyone know a proper guide on how to setup an Instance with fixed client addresses?

I'm setting up a new server which is connected to a new fiber provider to replace an existing old server still operational connected to a different fiber provider.
Instead of using a backup from the old machine I want to set-up the new machine from scratch.
I have configured the LAN port of the new machine with a fixed IP address in the same subnet as the LAN of the "old" machine in order to have both WebGui's in sight while copying settings and rules from the "old" to the "new" machine. This works flawless from my workplace in the office being connected to another subnet on the "old" machine.
Once connecting to the "old" machine via OpenVPN there is no response from the WebGui of the "new" machine so traffic is somewhere blocked but while looking at the life logs on both machines it is clear that the request is passing through bot firewalls. The only possible related error I found in the general log of the new machine saying "Error   lighttpd   (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.76/src/mod_openssl.c.3510) SSL: 1 error:0A00009C:SSL routines::http request (10.67.6.102)" .
So obviously this is the webserver not accepting the request.
Does anyone understands this lighttpd error and what can be done to overcome?

Another question is the following:
My new connection is 1Gbit opposed to 50Mbit of the old one so I'd like to use the available speed of this new connection through the "old" server while setting up this new firewall. What would be the best solution to route web traffic through this high speed connection.

Hi,
Today I ran into an unexpected problem while setting up a new server to replace old hardware.
After the initial install I was able to login while pointing to the LAN port with default given IP address as per default.
I created an 3rd port OPT1 and initially configured this port with DHCP. What ever rule I made for this OPT1 port I couldn't get access to the web interface. After some hair pulling hours the only difference I could find was that on my "old" OPNSense box the OPT1 port had a fixed IP address instead of DHCP. So I changed on my new box OPT1 to a fixed available IP address and voila, the https connection was established. Now I changed the fixed IP address to the same one given by DHCP and no connection is possible. Firewall log shows that the request may pass so ends up in the firewall itself with no response.
What is the explanation for this behavior? Is this a hidden feature?

I've move this one to OPNsense Forum »English Forums »24.1 Production Series »

An error occured during the update:

Starting configd.
>>> Invoking update script 'refresh'
*** OPNsense\OpenVPN\OpenVPN Migration failed, check log for details

and found this in the log file:

Failed to connect to configd socket: Connection refused while executing firmware status

Which I believe is related to this error.
Other than that the system seem to run fine besides the curl security issue.

Just upgraded from 23.7.5 to 23.7.6 and found this after a security audit:

***GOT REQUEST TO AUDIT SECURITY***
Currently running OPNsense 23.7.6 at Sat Oct 14 11:19:49 CEST 2023
vulnxml file up-to-date
curl-8.3.0 is vulnerable:
  curl -- SOCKS5 heap buffer overflow
  CVE: CVE-2023-38545
  WWW: https://vuxml.freebsd.org/freebsd/d6c19e8c-6806-11ee-9464-b42e991fc52e.html

1 problem(s) in 1 installed package(s) found.
***DONE***

In curl-8.4.0 it has been fixed...

Just upgraded from 23.7.3 to 23.7.4 and following errors occurred:

>>> Invoking update script 'refresh'
*** OPNsense\OpenVPN\OpenVPN Migration failed, check log for details

Not clear in which log to look for details.
and from the Backend log:

2023-09-23T12:36:56   Error   configd.py   [0982ddac-13f7-4a49-9d4b-04b2649c4514] Script action failed with Command '/usr/local/opnsense/scripts/firmware/read.sh ' died with <Signals.SIGABRT: 6>. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 44, in execute subprocess.check_call(script_command, env=self.config_environment, shell=True, File "/usr/local/lib/python3.9/subprocess.py", line 373, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '/usr/local/opnsense/scripts/firmware/read.sh ' died with <Signals.SIGABRT: 6>.   
2023-09-23T12:35:40   Error   configd.py   Failed to connect to configd socket: while executing firmware status   
2023-09-23T12:35:30   Warning   configd.py   Stopping daemon.

Looks to me like something went wrong with a Python script related to OpenVPN migration error.
I've upgraded 2 servers and both show the same problem.
What to do???

SInce the upgrade I lost the fixed assigned IP addresses for my clients and now they are getting IP addresses assigned by the system. Also the Client Specific Overrides tab is empty now but I still can see the custom_options>ifconfig-push correctly defined in the config. A reboot doesn't help and it looks like the client specific overrides are ignored. This is very inconvenient as a lot of my firewall rules depend on fixed assigned IP addresses.
I should have looked better as there are some posts about this subject and will continue in the existing thread.

I'm struggling recently to find out what the reason might be of a client getting an error (screenshot attached) while making a service request on our website. In the Naxsi log I think I found the error number. It would be handy if it were possible to toggle the rule to ensure this is indeed the reason for the error.
Would it be possible to add an enable/disable feature like the firewall rules to the Naxsi rules rather than deleting and creating the rule again?

Actually looking for something else I discovered that in the /usr/local/etc/nginx/naxsi_core.rules file the rule #MainRule "str:/" "msg:slash in args" is commented out with "#" while in the Naxsi WAF policy settings page this feature has been enabled. Does anyone knows what the reason could be? Or is this a bug?

The NGINX HTTP configuration page starts with " HTTP Listen Address" and " HTTPS Listen Address". When a Virtual IP on WAN is entered one would expect that NGINX will start listening on this IP address but this is not the case. How to fix???

Does anyone has an idea how to handle this Warning?
A virtual IP on my production OPNSense box needs to be changed to a different mode but is not allowed.
Should I delete this Virtual IP first and than create it anew? Or is there another way...

I'm trying to setup nginx reverse proxy having multiple virtual IP's and I wonder what is the appropriate way to catch traffic entering a specific virtual IP. Nginx is running and both port 443 and 80 are open, checked that in shell with sockstat. After starting nginx no traffic was catched so looking at life log I saw that traffic was blocked by the "Default deny / state violation rule". In order to direct HTTP(S) traffic to nginx I made a NAT port forward rule to the local LAN interface. That kind of works but it don't believe this is the right way. Any suggestions?

Hi,
I'm trying to get a remote WoL service to work but get "Default deny / state violation rule" errors all the time which to my understanding is a pre-defined floating rule. Using the OPNSense Wake-on-LAN utility works like a charm but using a remote Wake-on-LAN client on a PC connected to the OPT1 network to wake up a server on the LAN network is being blocked by this floating rule. What rule or rules do I need to apply in order to get it to work?
Thanks!

I need to disable security.ssl.enable_ocsp_stapling in firefox otherwise the webgui is not accessible. I'm using a letsencrypt cert. How to fix this.

I just noticed "strongswan-5.9.4 is vulnerable" while running a security check and found out that a fix is out there, strongswan-5.9.5. Will this be fixed in version 22.1.1?