Topics

Hi everyone,
I have a little question... I'm using unbound dns and Haproxy for all my stuff.
I'm publishing services on a swarm cluster.
Some services are available through Haproxy, but I'm thinking about a dns load balancing service: not publishing the service trough haproxy public service (front public port de number), but through a dns load balancing service which is able to serve all ports...
Is there a service/plugin for that on Opnsense?
Regards,
Goldorak92

Hi everyone,

I've just upgraded my firewall to 20.7, and I'm experimenting a change in the GeoIP's functionalities.

I have a GeoIP-alias with 4 countries: BE-FR-DE-UK
I have a wan rule, just after the "automatically generated rules":
- source: GeoIP alias ; port: *, proto: IPv4 TCP/UDP
- destination: this firewall

Before the upgrade, this rule was working as expected.
Since the upgrade, the rule seems not to be applied, packets are dropped by the default deny rule.

Here is a test, from an ip in 37.164.0.0/14:
- with source=GeoIP alias, packets dropped by defaut deny rule

Code Select Expand


        WAN Aug 3 15:09:58 37.164.x.y:z 8.x.y.z:w tcp Default deny rule
WAN Aug 3 15:09:58 37.164.x.y:z 8.x.y.z:w tcp Default deny rule
WAN Aug 3 15:09:54 37.164.x.y:z 8.x.y.z:w tcp Default deny rule

- changing source from GeoIP alias by the public ip of the device, packets allowed by the rule

Code Select Expand


        WAN Aug 3 15:11:26 37.164.x.y:z 8.x.y.z:w tcp WAN_GeoIP_In
WAN Aug 3 15:11:26 37.164.x.y:z 8.x.y.z:w tcp WAN_GeoIP_In
WAN Aug 3 15:11:25 37.164.x.y:z 8.x.y.z:w tcp WAN_GeoIP_In

I had a look in the alias GeoIP settings:
- last update: 2020-07-28T16:43:02
- Total number of ranges: 402405

Just to be sure, I had a look in /usr/local/share/GeoIP/alias, in FR-IPv4, the range of the device is present:
37.164.0.0/14

Edit: I went in pfTables, and the alias is not populated.
BTW, the corresponding file in /var/db/aliastables is populated...

Is this normal?

Any advice ?
Thanks,
Goldorak92

Hi guys,

For information, OpenSSL published a vulnerability paper yesterday:

https://www.openssl.org/news/secadv/20200421.txt

It's impacting our Opnsense20.1.4 which is using OpenSSL 1.1.1f .

Regards,
G.

Hi Guys,

43 view, no replies, ok...

Thanks, it works

G.

Hi guys.

I have a question about Network Time service.
On my OpnSense Appliance, I have only IPV4 enable.
The Network Time service is enable on one interface (LAN).
When I check netstat, I can see that the ntp service is listening both udp4 and udp6.

Code Select Expand


# netstat -a | grep ntp
udp4       0      0 localhost.ntp          *.*                   
udp6       0      0 localhost.ntp          *.*                   
udp6       0      0 fe90::4352:3aaf:.ntp   *.*                   
udp4       0      0 MyBigFirewall.ntp   *.*                   
udp4       0      0 *.ntp                  *.*                   
udp6       0      0 *.ntp                  *.*


Is there a way to configure ntp only for ipv4 ?

Goldorak92