Topics

Hello!

I have been having this problem literally since day one that I started using OPNSense.  It didn't matter in the past, but I am moving to a new device and some of my requirements are changing.  I have a rule set up to allow the opt1 network to access the opt1 address * * and I have two rules forwarding ports 80 and 443 to the Squid Proxy (transparent).  I have the exact same rules on my LAN interface.  On my LAN interface, I can access the firewall just fine using the LAN IP.  On OPT1, I get an Access Denied message from Squid saying that Access Control is preventing me from accessing the GUI.  I have checked every setting I can find, and I cannot find anything in the Web Proxy that would allow/prevent me from accessing the Web GUI.  I checked the Settings and the Web GUI is listening on LAN and OPT1.  I made sure that reply-to is disabled on the OPT1 firewall rule.

Does anyone have any other ideas as to why I can access the Web GUI just fine from the LAN interface, but not at all from the OPT1 interface?

Earlier this week, I started getting PR_END_OF_FILE_ERROR from FireFox when trying to go to protonmail and I have seen it on a couple of other random sites.  No device on my network is able to load protonmail, not from any browser, phone, or app.  I have tried disabling AV, etc., to no avail.  I updated the firewall to OPNsense 23.1.9-amd64 hoping that might resolve it, but the issue persists.  If I take my devices off my network, they can connect fine.  The common point is the firewall.  Does anyone have any ideas of what I can do to resolve this?  I have added the various proton* sites to the SSL no bump list, but no change.  I can nslookup the proton sites and ping them with no trouble.

Thoughts?

Hello!

Last night, I upgraded to 22.7.5.  Immediately after, any browser on the network that uses Secure DNS through CloudFlare is unable to load any secure sites.  I don't really even know where to start looking for the problem.  No settings have changed since before the upgrade.  I am running a filtering proxy, and I added 1.1.1.1 to the SSL No Bump list just in case, but that didn't help.  My normal DNS for the firewall is OpenDNS and doesn't seem to be having an issue.  I have all DNS requests captured and forwarded to Unbound.

Any thoughts?

Update: CloudFlare isn't the only one that doesn't work.  One of the android phones was set to use AdGuard as a Private DNS and no secure sites would work on that phone until that setting was disabled (or it was connected to the cell network).

Hello!  I am having a strange issue that I cannot seem to run down.

When anyone on my network tries to browse to https://idahoparcels.us they receive this error message:

Code Select Expand

The following error was encountered while trying to retrieve the URL: https://104.238.74.120/*

    Access Denied.

Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect.

Your cache administrator is admin

Generated Wed, 08 Jul 2020 03:59:09 GMT by network (squid/4.11)

104.238.74.120 is the IP that the site is hosted on.  I get the same message if I try to go to the IP address directly.  This site works just fine if I check it from outside the network.  I have tried everything I can think of, including putting this on the no-bump-ssl list and on the whitelist, both by FQDN and by IP, but I get the same result every time.  The certificate returned is the internal cert, just like when any other site comes up against the ACL.  I have other sites in the whitelist and they work just fine. 

I have the proxy set to Transparent, Enable SSL Inspection, and Log SNI information only.  All other sites work correctly.

I also have tons of these errors in the log, but I don't think they are related:

Code Select Expand

SendEcho ERROR: sending to ICMPv6 packet to [2620:1ec:bdf::10]: (65) No route to host

When I look in the access log for idahoparcels.us, I get this:

Code Select Expand

2020-07-07T20:59:09.630000 0 192.168.0.110 NONE/403 3682 GET https://idahoparcels.us/favicon.ico - HIER_NONE/- text/html
2020-07-07T20:59:09.360000 0 192.168.0.110 NONE/403 3682 GET https://idahoparcels.us/wordpress/ - HIER_NONE/- text/html
2020-07-07T20:59:05.140000 0 192.168.0.110 NONE/403 3682 GET https://idahoparcels.us/wordpress/ - HIER_NONE/- text/html
2020-07-07T20:56:03.520000 0 192.168.0.110 NONE/403 3682 GET https://idahoparcels.us/wordpress/ - HIER_NONE/- text/html
2020-07-07T20:52:49.960000 0 192.168.0.110 NONE/403 3682 GET https://idahoparcels.us/wordpress/ - HIER_NONE/- text/html
2020-07-07T20:44:20.790000 0 192.168.0.110 NONE/403 3682 GET https://idahoparcels.us/wordpress/ - HIER_NONE/- text/html
2020-07-07T20:40:39.300000 0 192.168.0.110 NONE/403 3729 GET https://idahoparcels.us/wordpress/ - HIER_NONE/- text/html
2020-07-07T20:40:33.780000 95 192.168.0.110 TCP_MISS/404 629 GET http://www.idahoparcels.us/ - ORIGINAL_DST/104.238.74.120 text/html
2020-07-07T20:40:31.150000 105 192.168.0.110 TCP_MISS/404 629 GET http://www.idahoparcels.us/ - ORIGINAL_DST/104.238.74.120 text/html
2020-07-07T20:40:26.060000 91 192.168.0.110 TCP_MISS/404 629 GET http://www.idahoparcels.us/favicon.ico - ORIGINAL_DST/104.238.74.120 text/html
2020-07-07T20:40:25.630000 115 192.168.0.110 TCP_MISS/404 629 GET http://www.idahoparcels.us/ - ORIGINAL_DST/104.238.74.120 text/html
2020-07-07T20:33:45.340000 0 192.168.0.110 NONE/403 3729 GET https://idahoparcels.us/favicon.ico - HIER_NONE/- text/html
2020-07-07T20:33:45.080000 0 192.168.0.110 NONE/403 3729 GET https://idahoparcels.us/wordpress/ - HIER_NONE/- text/html
2020-07-07T20:33:31.910000 154 192.168.0.110 TCP_MISS/200 26666 GET http://idahoparcels.us/favicon.ico - ORIGINAL_DST/104.238.74.120 image/x-icon
2020-07-07T20:33:31.330000 128 192.168.0.110 TCP_MISS/200 1007 GET http://idahoparcels.us/ - ORIGINAL_DST/104.238.74.120 text/html

If I search for  104.238.74.120, I get:

Code Select Expand


2020-07-07T21:03:14.520000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T21:03:14.340000 0 192.168.0.110 NONE/403 3682 GET https://104.238.74.120/* - HIER_NONE/- text/html
2020-07-07T21:03:14.340000 2 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:59:14.370000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:59:13.780000 0 192.168.0.110 NONE/403 3682 GET https://104.238.74.120/* - HIER_NONE/- text/html
2020-07-07T20:59:13.760000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:59:09.630000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:59:09.570000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:59:09.360000 2 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:59:05.370000 6 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:59:05.120000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:56:03.640000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:56:03.500000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:55:35 0 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:53:42.760000 2 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:53:07.950000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:53:07.900000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:52:56.720000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:52:56.430000 0 192.168.0.110 NONE/403 3682 GET https://104.238.74.120/* - HIER_NONE/- text/html
2020-07-07T20:52:56.410000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:52:50.160000 2 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:52:49.940000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:44:21 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:44:20.780000 2 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:40:40.450000 4 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:40:39.280000 3 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:40:33.780000 95 192.168.0.110 TCP_MISS/404 629 GET http://www.idahoparcels.us/ - ORIGINAL_DST/104.238.74.120 text/html
2020-07-07T20:40:31.150000 105 192.168.0.110 TCP_MISS/404 629 GET http://www.idahoparcels.us/ - ORIGINAL_DST/104.238.74.120 text/html
2020-07-07T20:40:26.060000 91 192.168.0.110 TCP_MISS/404 629 GET http://www.idahoparcels.us/favicon.ico - ORIGINAL_DST/104.238.74.120 text/html
2020-07-07T20:40:25.630000 115 192.168.0.110 TCP_MISS/404 629 GET http://www.idahoparcels.us/ - ORIGINAL_DST/104.238.74.120 text/html
2020-07-07T20:34:09.710000 0 192.168.0.110 NONE/403 3729 GET https://104.238.74.120/favicon.ico - HIER_NONE/- text/html
2020-07-07T20:34:09.690000 5 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:09.660000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:09.290000 0 192.168.0.110 NONE/403 3729 GET https://104.238.74.120/* - HIER_NONE/- text/html
2020-07-07T20:34:09.270000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:09.170000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:08.130000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:07.090000 2 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:06.050000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:05.010000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:03.910000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:03.740000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:03.540000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:00.220000 3 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:34:00.080000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:56.910000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:56.770000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:54.430000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:54.140000 3 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:54.050000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:45.330000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:45.290000 5 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:45.060000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:44.870000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:43.830000 2 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:42.790000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:41.750000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:39.280000 3 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:39.090000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:38.970000 2 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:33.530000 13 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:33.150000 1 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:32.990000 175 192.168.0.110 TCP_DENIED/200 0 CONNECT 104.238.74.120:443 - HIER_NONE/- -
2020-07-07T20:33:31.910000 154 192.168.0.110 TCP_MISS/200 26666 GET http://idahoparcels.us/favicon.ico - ORIGINAL_DST/104.238.74.120 image/x-icon
2020-07-07T20:33:31.330000 128 192.168.0.110 TCP_MISS/200 1007 GET http://idahoparcels.us/ - ORIGINAL_DST/104.238.74.120 text/html

Does anyone have any ideas?