Topics

i'm unable to connect to 45.90.28.111 (nextdns) using curl

doesn't work -
curl -v https://dns.nextdns.io/info --connect-to ::45.90.28.211:443
Connecting to hostname: 45.90.28.211
* Connecting to port: 443
* Trying 45.90.28.211:443...

working - i can connect -
curl -v https://dns.nextdns.io/info --connect-to ::76.76.2.11:443

anyone know why? can't seem to figure out whats wrong on opnsense.

Hello
After upgrading to 23.7.12 (from 23.7.10) DNS DOH to Nextdns servers stopped working.

Upgraded to 23.7.12 without any issues for a day or so, without making any opnsense changes, DNS suddenly stopped working.

If i remove nextdns servers then everything works.  I confirmed via connecting to wireguard vpn that nextdns servers still works.  once i disable wireguard then dns stops working.
using unbound with TLS to nextdns servers.

i checked using curl -v https://dns.nextdns.io/info --connect-to ::45.90.28.201:443
and the result is failed to connect to 45.90.28.201 (nextdns server)

no issues using curl to the same ip if i connect thru wireguard/vpn.

Anyone know what i need to do?  Thank you!

Hello
After upgrading to 23.7.12 (from 23.7.10) DNS DOH to Nextdns servers stopped working.

Upgraded to 23.7.12 without any issues for a day or so, without making any opnsense changes, DNS suddenly stopped working.

If i remove nextdns servers then everything works.  I confirmed via connecting to wireguard vpn that nextdns servers still works.  once i disable wireguard then dns stops working.
using unbound with TLS to nextdns servers.

i checked using curl -v https://dns.nextdns.io/info --connect-to ::45.90.28.2XX:443
and the result is failed to connect to 45.90.28.2XX (nextdns server)

no issues using curl to the same ip if i connect thru wireguard/vpn.

Anyone know what i need to do?  Thank you!

Looks like my HP TP720 (CPU type   AMD GX-420CA SOC with Radeon(tm) HD Graphics (4 cores, 4 threads)) can't handle 1Gigabit speeds with Wireguard ON.  Without Wireguard 1.5Gigabit speeds is easily achieved on the box.



Can anyone advise what's a good hardware in the range of 300-500dollars that is capable of supporting Wireguard + 1.5Gigabit speeds?

Thanks!

Hi all i'm new to opnsense need some help routing all vpn traffic in my network thru wireguard VPN.

I followed this guide to setup Windscribe VPN with wireguard - https://www.wundertech.net/how-to-set-up-wireguard-in-opnsense/

and with the routing i used this guide - https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html

However I can't tell if i'm actually connected to the VPN and on my internal network if i go whatsmyip.com it doens't show the windscribe's ip.

Any assistance is greatly appreciated!

the Handshake tab shows -
wg1   XXXXXXTjPUnnUtUapeLa2xA2XHvBFc=   0

the status tab shows -
interface: wg1
  public key: XXXXXXXRztjod9crXHynuqkK2w=
  private key: (hidden)
  listening port: 51820

peer: XXXXnnUtUapeLa2xA2XHvBFc=
  endpoint: 173.205.XXXX:1194
  allowed ips: 0.0.0.0/0
  transfer: 0 B received, 44.95 KiB sent
  persistent keepalive: every 25 seconds


from windscribe vpn setup file - changed IPs for privacy
[Interface]
PrivateKey = XXXXXYCQi6XsVBOQSXVo=
Address = 100.124.XXX.1/32
DNS = 10.255.255.3

[Peer]
PublicKey = XXXXXXXnUtUapeLa2xA2XHvBFc=
AllowedIPs = 0.0.0.0/0
Endpoint = XXXXX.whiskergalaxy.com:1194
PresharedKey = XXXXUActIlB17JctoldX9J3Y=

opnsense wireguard settings -
<server version="0.0.4">
        <servers>
          <server uuid="7c7c7be9-fb42-4048-af5a-52df37948a69">
            <enabled>1</enabled>
            <name>windscribe</name>
            <instance>1</instance>
            <pubkey>XXXtjod9crXHynuqkK2w=</pubkey>
            <privkey>XXXXXXYCQi6XsVBOQSXVo=</privkey>
            <port>51820</port>
            <mtu>1420</mtu>
            <dns/>
            <tunneladdress>100.124.XXX.1/32</tunneladdress>
            <disableroutes>1</disableroutes>
            <gateway>100.124.XXX.2</gateway>
            <peers>eb08a058-9ed7-4dfd-9354-66e28fbe3046</peers>
          </server>

<client uuid="eb08a058-9ed7-4dfd-9354-66e28fbe3046">
            <enabled>1</enabled>
            <name>windscribeXX</name>
            <pubkey>XXXXXXXOTjPUnnUtUapeLa2xA2XHvBFc=</pubkey>
            <psk/>
            <tunneladdress>0.0.0.0/0</tunneladdress>
            <serveraddress>XXXXXX.whiskergalaxy.com</serveraddress>
            <serverport>1194</serverport>
            <keepalive>25</keepalive>
          </client>

When I select option 12) update from console, it doesn't work. So i'm trying to do the update via CLI. Does anyone know the commands i need to execute and update to 23.1 (from 22) ?
Thank you!

my option 12 does this -
Fetching change log information, please wait... Missing /usr/local/etc/pkg/repos/OPNsense.conf
ld-elf.so.1: /usr/local/sbin/opnsense-verify: Undefined symbol "ucl_object_iterate"

This will automatically fetch all available updates and apply them.

A major firmware upgrade is available for this installation: 22.7
Make sure you have read the release notes and migration guide before
attempting this upgrade. Around 500MB will need to be downloaded and
require 1000MB of free space. Continue with this major upgrade by
typing the major upgrade version number displayed above.

Minor updates may be available, answer 'y' to run them instead.

Proceed with this action? [22.7/y/N]:y
Missing /usr/local/etc/pkg/repos/OPNsense.conf
Starting web GUI...done.
Generating RRD graphs...done.
Missing /usr/local/etc/pkg/repos/OPNsense.conf

I upgrade to 22.1.10_4 and now when i do an opnsense-update, i get the error:
Missing /usr/local/etc/pkg/repos/OPNsense.conf

In the gui i get
Firmware status
Could not find the repository on the selected mirror.

Here is the log from the GUI status/update function-
***GOT REQUEST TO CHECK FOR UPDATES***
Currently running OPNsense 22.1.10_4 (amd64/OpenSSL) at Sat Feb  4 22:52:05 EST 2023
Fetching changelog information, please wait... Missing /usr/local/etc/pkg/repos/OPNsense.conf
ld-elf.so.1: /usr/local/sbin/opnsense-verify: Undefined symbol "ucl_object_iterate"
Updating FreeBSD repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: .......... done
Processing entries:
Newer FreeBSD version for package zziplib:
To ignore this error set IGNORE_OSVERSION=yes
- package: 1301000
- running kernel: 1300523
Ignore the mismatch and continue? [y/N]: pkg: repository FreeBSD contains packages for wrong OS version: FreeBSD:13:amd64
Processing entries... done
Unable to update repository FreeBSD
Error updating repositories!
pkg: Unknown repository: OPNsense
***DONE***

Hi
I'm using pihole (192.168.1.6) setup with upstream to Unbound/Opnsense box (192.168.1.16) and there are a few DNS queries that randomly fails.
The error i get for going to tradingview.com is DNS_PROBE_FINISHED_NXDOMAIN.

This happens randomly throughout the day with no changes to pihole or opnsense.  And fixes itself randomly too.

Anyone know what settings i should be checking?


here's my dig output
dig tradingview.com

; <<>> DiG 9.10.6 <<>> tradingview.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28184
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;tradingview.com.      IN   A

;; ANSWER SECTION:
tradingview.com.   49   IN   A   34.215.69.139

;; Query time: 7 msec
;; SERVER: 192.168.1.6#53(192.168.1.6)
;; WHEN: Thu Oct 08 11:33:13 EDT 2020
;; MSG SIZE  rcvd: 60

Hello all,
I'm using an HP 610plus hardware with OPNSense and was hoping to optimize my network for FIOS gigabit internet.  Can anyone share some advice or optimizations i can do ?

Thank you!

I followed this guide. https://docs.opnsense.org/manual/how-tos/proxytransparent.html
and http transparent proxy is working, however when i enable the HTTPS NAT port forward rule from the guide (step7) above, all sites don't work. 



This is the rule that once enabled, i can't access any sites..
Interface
LAN
TCP/IP VERSION
IPv4
Protocol
TCP
Source
LAN net
Source port range
any - any
Destination
any
Destination port range
HTTPS - HTTPS
Redirect target IP
127.0.0.1
Redirect target port
other/3129
Description
redirect traffic to proxy
NAT reflection
Enable
Filter rule association
Add associated filter rule

I upgraded from 20.1.1 to 20.1.2 and now i can't access the webadmin and nothing works EXCEPT DHCP.
I've tried my gb3 and 4 ports still nothing....but it's giving out DHCP.

I can't access anything for some reason.  any ideas how i can fix this?


<opt4>
<if>igb3</if>
<descr>OPT4</descr>
<enable>1</enable>
<spoofmac/>
<blockpriv>1</blockpriv>
<ipaddr>192.168.1.1</ipaddr>
<subnet>24</subnet>
</opt4>
</interfaces>
<dhcpd>
<lan>
<enable>1</enable>
<defaultleasetime>12000</defaultleasetime>
<gateway>192.168.1.16</gateway>
<domain>88.com</domain>
<ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
<numberoptions>
<item/>
</numberoptions>
<range>
<from>192.168.1.220</from>
<to>192.168.1.254</to>
</range>
<winsserver/>
<dnsserver>192.168.1.6</dnsserver>
<dnsserver>192.168.1.16</dnsserver>
<ntpserver/>