Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Topics - rrosson

#1
I support multiple family and friends via an openvpn site-2-site connection to assist them with their computer issues (yes I am that guy). All existing openvpn (not legacy) connections that were setup before 24.7 are still functional and routes/access continue to work which allows me access. All new openvpn site-2-site connections created after 24.7 I am able to reach the firewall but no other network hanging off the firewall.

Where there are no ip network conflicts this is just a simple site-2-site (p2p) with routes from the local and remote network. Where there is a nip network conflict BINAT rules have been added to eliminate it. Like I mentioned these continue to work as there where setup before upgrading to 24.7.x.

All rules and tcpdump show the traffic entering the tunnel but the other end never sees it.

I serve as the server and all others are clients. Each client is configured with static keys and a certificate for authentication. Followed the docs on openvpn site-2-site instances for all connections

Has any one tried setting up a site-2-site since upgrading to 24.7.x?

If require more information please let em know and I will provide upon request.

- Ron
#2
In setting up multiple site 2 site route based VTI connections following https://docs.opnsense.org/manual/how-tos/ipsec-s2s-route.html I think I discovered a possible bug. Both sides are running OPNsense version 22.1.3.

I had two site 2 site VTI's configured and when adding a third I discovered that the net mask is not consistent.






My Side IPOther Side IPNetmaskDescription
10.111.1.110.111.1.230remote site 1
10.111.1.310.111.1.429remote site 2
10.111.1.510.111.1.630remote site 3

When I go to add 'remote site 3' it breaks site 2. To work around this I changed the second octet to 112 for site3 on both sides. This brings up the tunnel but the routing is only working to each of the firewalls. Neither side is able to get to the networks that they have routes.

Both sites have unique IP networks on each side and do not clash.

This appears to only reveal itself when doing more than two site 2 site route based IPsec VPN.

Any ideas?

TIA
-Ron
#3
Is there is place to change the value of "client_max_body_size". One of the services I have sitting behind my OPNsense firewall's Nginx reverse proxy is nextcloud. I have searched through every menu inside of the Nginx proxy and am unable to find where to change this value. My current hack/workaround is editing the file directly till I can find a resolution.

I am aware this is not recommended but am only hoping it is going to be short term.

TIA