Topics

Hi People,
after upgrade to 24.7 the CARP Status Widget fails to load.
thanks a lot

Hello Community,
As the title suggests, after an upgrade, the IMAP(993) reverse proxy (with haproxy) no longer works for me.
I remember reading that old ciphers were deactivated, tls1.X, etc.
Unfortunately, I can't find a proper way to temporarily get IMAP working again until I have updated the IMAP server.
Any suggestions? Keywords?
Thanks in advance,

Servus Community,
Wie der Titel andeutet, nach ein upgrade, funktionert bei mir das IMAP(993) reverse Proxy (mit haproxy) nicht mehr.
Ich erinnere mich gelesen zu haben das alten ciphers deaktiviert wurden, tls1.X, etc.
Ich finde leider keine richtige Einsatz um tempörär IMAP wieder zum laufen zu bringen bis ich den IMAP server auf neuen Stand gebracht habe.
Irgendein Vorschlag ? Stichworte ?
Vielen Dank im Voraus,

Hello everyone,
My goal is to migrate step by step or interface by interface from a dhcp server to opnsense kea.

Can anyone confirm that dhcrelay and kea can run in parallel?
So far I have worked with dhcrelay (HA Mode) and forwarded all DHCP requests from the various interfaces (VLANs) to an external DHCP server (Linux).

Now I want to move one subnet at a time to "opnsense kea", i.e. turn on kea in opnsense and configure the corresponding subnet etc. for one interface, while the others continue to be passed on via dhcrelay...
Should I pay attention to anything special?

Thanks in advance,

Servus,
kann ich ein Zertifikat nach den widerrufen löschen ?
Unter openvpn, ein nicht widergerufen aber gelöschte Zertifikat weiter akzeptiert wird deshalb die Frage.
Vielen Dank !

[In/out errors 6801598 / 1657]

I upgraded to 22.1 last week and everything went off without a hitch.
A quick hardware overview.
I run Opnsense as pure Firewall (High Avail. Scenario, 2 Hosts, 2 Switch, LACP)
Hosts with  32G, Xeon E2620,  Intel x520-DA2.
1 host with Fiber/ 1 Host with DAC.

lacp over both ports on X520.
more vlans on top of lagg.

Interface Statistics for lagg0

In/out packets   716441825 / 712558018 (358.71 GB / 284.60 GB)
In/out packets (pass)   716347241 / 712557150 (358.70 GB / 284.60 GB)
In/out packets (block)   4574009 / 868 (92 KB / 44 KB)
In/out errors   6801598 / 1657


Interface Statistics for ix0
In/out errors   6738215 / 0

Interface Statistics for ix1
In/out errors   63383 / 0

Same behavior with DAC or Fiber Gbic's
Same behavior for both Hosts

Any Hints ?

Hallo miteinander,
die HAProxy Configuration meldet eine Warnung nach den update auf 22.1.

22.1: wird mit HAProxy 2.4 mitgeliefert
21.7: ist mit HAProxy 2.2 dabei


[WARNING] (92134) : Proxy '110_HTTP_MAIN': L6 sample fetches ignored on HTTP proxies (declared at /usr/local/etc/haproxy.conf.staging:118).
[WARNING] (92134) : Proxy '110__HTTP_ALIAS': L6 sample fetches ignored on HTTP proxies (declared at /usr/local/etc/haproxy.conf.staging:240).
Warnings were found.
Configuration file is valid

aus /usr/local/etc/haproxy.conf.staging

118: http-request redirect scheme https code 301 if !acl_5f60ada90e0303.52206732 !acl_5f60ac7b7738e3.07651849
240: http-request redirect scheme https code 301 if !acl_5f60ada90e0303.52206732 !acl_5f60ac7b7738e3.07651849


acl acl_5f60ada90e0303.52206732 path_beg -i /.well-known/acme-challenge/

# ACL: SSLEstablished
acl acl_5f60ac7b7738e3.07651849 req.ssl_ver gt 0

# ACL: no_acme_challenge
acl acl_5f60ada90e0303.52206732 path_beg -i /.well-known/acme-challenge/

Irgendeine Idee ?
Vielen Dank im Voraus,

Hi community,

i may have a problem cutting off long queries from haproxy.
Is there a config parameter to extend the length of the url / queries?
How do I get a rollback to haproxy 2.2.17?

Hello!
I have a case here with 2 opnsense (cascaded connected).
One of them has a public IP and the second is cascaded (DMZ).
Letsencrypt runs on the first Opensense.
I would like to synchronize the certificates for extensions to the second Opensense and restart the GUI there (so the letsencrypt certificates are used for the GUI in the second router) .... is that possible?  how to? ideas ?
Thanks in advance

Hello!
How can I increase the logging of the haproxy?
So far, no matter what I have changed .. under services-> haproxy-> log ...
I see only
....
2021-07-15T12:55:39   haproxy[14562]   Proxy SMTP_backend_25 started.   
2021-07-15T12:55:39   haproxy[14562]   Proxy SMTPS_backend_465 started.   
2021-07-15T12:55:39   haproxy[14562]   Proxy SUBMISSION_backend_587 started.   
2021-07-15T12:55:39   haproxy[14562]   Proxy IMAPS_backend_10993 started.   
2021-07-15T12:55:39   haproxy[14562]   Proxy proxy started.   
....

thanks a lot

Hello!
if you create a zone in bind (regardless of whether webui / api), then the hosts, and then delete the zone again, the hosts remain in the configuration file. The problem is if you have created the zone several times (for testing or automation via API), deleted it and then created it again, the size of config.xml becomes huge. side effect is that the webgui is sluggish when the config.xml is so big.
In my case:
config.xml with bind block was about 9 MB in size,
after deleting the bind block using ...
sed -i '' -e '/ <bind> /, / <\ / bind> / d' config.xml
my config.xml is now about 300k.
Cheers

Hi!
Ich versuche den DHCP im Sense als Ersatz von meinen Stand-Alone DHCP.
Wie kann ich mehrere Subnetzte definieren für die gleiche VLAN bzw. Interface ?

Wie ich es verstanden habe bisher: Der DHCP-Server in OpnSense kann nur Pools für Subnetze erstellen, mit denen er direkt verbunden ist. Daher kann ich keine zusätzlichen Pools erstellen, um Remote-Subnetze zu bedienen, die DHCP-Anforderungen über z.B. einen  Cisco / HP Helper weiterleiten.

Hintergrund:
Zum Beispiel an mein OPT5 habe ich folgende Netze.
192.168.1.0/22   (    IP: 192.168.1.1 OPT1)
192.168.10.0/24 (Alias: 192.168.10.1 auf OPT1)
192.168.20.0/24 (Alias: 192.168.20.1 auf OPT1)

Wie lege ich für die 92.168.10.0/24 und 192.168.20.0/24 Pool bzw. reserviere ich die IP's dafür ?

Hi!
After update to 21.1.3, all titles on Dash board are ...
"system_information_title"
"services_status_title"
"openvpn_title"

and on click,


Page not found

Go back to previous page

Any hints ?
Thanks a lot

Hi!
I have a case here with 2 opnsense (cascaded connected).
One of them has public IP and the second is supposed to be attached to the DMZ.
Letsencrypt is up and running on the first opensense.
I would like to sync the certs with renewals to the second opensense, and start the GUI again (so the letsencrypt certs are used for the GUI in the second router) .... is that possible?
Thanks a lot

Hi @all !

Log on update ...

Code Select Expand


...
[48/52] Extracting redis-5.0.9: ......... done
You may need to manually remove /usr/local/etc/redis.conf if it is no longer needed.
[49/52] Upgrading os-frr from 1.17 to 1.19...
[49/52] Extracting os-frr-1.19: .......... done
Stopping configd...done
Starting configd.
Migrated OPNsense\Quagga\General from 1.0.1 to 1.0.2

Notice: Undefined variable: field_rfcls in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 150

Notice: Trying to get property 'name' of non-object in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 150

Fatal error: Uncaught OPNsense\Base\ModelException: class  of wrong type in model definition in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:150
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(196): OPNsense\Base\BaseModel->getNewField('OPNsense\\Base\\F...')
#1 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(252): OPNsense\Base\BaseModel->parseXml(Object(SimpleXMLElement), Object(SimpleXMLElement), Object(OPNsense\Base\FieldTypes\ContainerField))
#2 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(272): OPNsense\Base\BaseModel->parseXml(Object(SimpleXMLElement), Object(SimpleXMLElement), Object(OPNsense\Base\FieldTypes\ContainerField))
#3 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(328): OPNsense\Base\BaseModel->parseXml(Object(SimpleXMLElement), Object(SimpleXMLElement), Object(OPNsense\Base\FieldTypes\ContainerField))
#4 [internal function]: OPNsense\Base\BaseModel->__construct()
#5 /usr/local/opnsense/mvc/script/run_migrat in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 150
Reloading plugin configuration
Configuring system logging...done.
Reloading template OPNsense/Quagga: OK
Reloading template OPNsense/Syslog: OK
[50/52] Upgrading opnsense from 20.7.4 to 20.7.6...
[50/52] Extracting opnsense-20.7.6: .......... done
Stopping configd...done
Resetting root shell
...


Everything seem to be working fine, any thing i should worry about?  beyond submitting a report from the ui, do i need to provide more information?

Thank a lot.

Hello @community,

Issues with os-ftp-proxy plugin

At Opnsense HA with 2 WAN Interfaces.
Haproxy Working, no problems.

Connect to FTP
on WAN1: connect, login and file transfer posible
on WAN2: connect and login works, but   file transfer not posible
Any Hints ?
Thanks a lot

PS: configured as in the guide https://forum.opnsense.org/index.php?topic=3868.0

Hallo @community,
Ich sehe den Wald vor lauter Bäumen nicht!

opnsense HA mit 2 WAN Interfaces
Haproxy mit https proxing zu Web Servers im DMZ Bereich.
Alles soweit OK.

Das Problem:
WAN1 anpingbar (von aussen) und "https://xxx"  ist erreichbar
WAN2 anpingbar (von aussen) und "https://xxx"  ist NICHT erreichbar

Anfragen über WAN2 werden über WAN1 geantwortet und NICHT über WAN2 (bestätigt mit Packet Capture) !!!
WAN1 z.Z. Default Gateway (active)


Hinweis:
1) ein netstat -ln bestätigt das den port 443 auf beide WAN Schnittstellen läuft's
2) firewall logs zeigen dass die ports nicht blockiert sind und Daten/Anfragen ankommen.
3) Bei beide WAN's (WAN1 und WAN2) sind als Gateway (ganz unten) die entsprechenden Gateways eingetragen.
4) Unter Firewall ‣ Settings ‣ Advanced: Sticky Connections ist gesetzt.
5) Unter Firewall ‣ Settings ‣ Advanced: Disable force gateway ist gesetzt.
6) Beide Gateway zu jeder WAN haben die Option "Upstream" aktiviert.


Tips ? Hint's ?
Vielen Dank im Voraus ...

[-i lagg0_vlan99]

Hi @all!


On:  Services: DHCPv4: Relay
At moment, are 2 interfaces selected (vlan116 and vlan33)
my dhcp server (172.30.99.100) is running on vlan99

but ps -awux shows ...

/usr/local/sbin/dhcrelay -i lagg0_vlan116 -i lagg0_vlan33 -i lagg0_vlan99 172.30.99.100

why the extra "-i vlan99" ?  dhcrelay should not listen on vlan99!
I think, for the same reason, multiple dhcprequests appear on the dhcp server.

Thanks a lot.

Servus,
Nach den ich eine Interface gelöscht habe, blieben einige Firewall regeln noch in der Configuration.
In der GUI sind die Regeln nicht mehr zu finden aber ... unter rules.debug sind folgende Zeilen noch zu finden...

#debug:Unable to convert address, see to for details|Interface any not found
# pass in quick on ##any## proto udp from {any} to {{"network":"anyip","port":"1194"}} port {1194} label "0f9806fdebb796369e646267896c1372" # : OpenVPN OpenVPN Local wizard
#debug:Unable to convert address, see to for details|Interface any not found
# pass in quick on ##any## proto udp from {any} to {{"network":"anyip","port":"1194"}} port {1194} label "0f9806fdebb796369e646267896c1372" # : OpenVPN OpenVPN Local wizard
#debug:Unable to convert address, see to for details|Interface any not found
# pass in quick on ##any## proto udp from {any} to {{"network":"anyip","port":"1199"}} port {1199} label "fe123266aa1201162fd586c345c20628" # : OpenVPN OpenVPN Local TCP wizard


Wie kann ich die Regeln manuell löschen ?
Vielen Dank im Voraus

Hello!
After update to 20.7.1 netdata is not working...

ps awux |grep -i netdata
netdata  5317   0.0  0.0   18472   8116  -  SN   14:01       0:00.08 /usr/local/libexec/netdata/plugins.d/apps.plugin 1
netdata 14509   0.0  0.1   54720  30480  -  SN   14:01       0:01.19 /usr/local/bin/python3.7 /usr/local/libexec/netdata/plugins.d/python.d.plugin 1
netdata 17179   0.0  0.1   84900  23820  -  IN   14:00       0:13.80 /usr/local/sbin/netdata -u netdata -P /var/db/netdata/netdata.pid
netdata 23227   0.0  0.0   18420   8416  -  IN   14:00       0:01.03 /usr/local/sbin/netdata --special-spawn-server
root    50945   0.0  0.0 1060960   3244  0  R+   14:09       0:00.00 grep -i netdata


netstat -l -n -4 |grep 10999 (not opened port) !!! 10999


dmesg
pid 30949 (netdata), jid 0, uid 302: exited on signal 11 (core dumped)


removed, removed netdata cache dirs, etc, and new install ....

Cheers