Topics

[10.21.30.0, and 10.21.45.0]

Hi,

I'm facing an issue where the Prefix List I have set for BGP is only advertising 1 route from each Prefix list, I have 2 Prefix List with 2 routes in each list, and each list is added to a Route Map. I'm sure I'm not configuring as it should be, just not able to figure out what is it.

I have setup my Prefix List as follows



And RouteMaps are configured as follows





The Fortigate firewall routes from OPNSense received are as below, routes not being advertised are 10.21.30.0, and 10.21.45.0.

Code Select Expand


Routing table for VRF=0
B*      0.0.0.0/0 [20/0] via 192.168.9.11 (recursive is directly connected, port1), 02:15:57, [1/0]
B       10.21.35.0/24 [20/1] via 192.168.9.25 (recursive is directly connected, port1), 00:02:44, [1/0]
B       10.21.40.0/24 [20/1] via 192.168.10.25 (recursive is directly connected, port2), 00:02:44, [1/0]
B       192.168.1.0/24 [20/0] via 192.168.9.11 (recursive is directly connected, port1), 02:15:57, [1/0]


OPNSense receives all routes as configured in the Fortigate



Not able to figure out what is misconfigured ?

I thought it was a sequence number issue so I changed all numbers in both Prefix list and Route Map, that did not help.

Thank You

Hi All,

I have the following VLAN interface configured.


My question is whether the VLAN tag 10 is added to packets (like a switch does) that go through this interface to the outside

or

Whether the interface only allows traffic with this tag (packets not tagged with 10 are dropped).

I have gone through the https://docs.opnsense.org/manual/other-interfaces.html, and its not clear to me.

Would appreciate if someone can clarify this.

[I have Allowed Promiscuous Mode, MAC Address Changed, and Forged Transmits.]

Hi All,

The network is as follows with VLAN interfaces on the firewall.

VLAN 15 - 10.10.15.1
VLAN 25 - 10.10.25.1
VLAN 26 - 10.10.26.1

NSX-T Edge Node Management - 10.10.15.101
NSX-T Edge Node Uplink 1 - 10.10.25.101
NSX-T Edge Node Uplink 2 - 10.10.26.102

I have OPNSense running as a VM on ESXi, and NSX-T Edge Node VM with 3 interfaces, Management, Uplink 1, Uplink 2.

I have Allowed Promiscuous Mode, MAC Address Changed, and Forged Transmits.

There are no firewall rules denying any traffic.

The problem is Edge Node Uplink 1 (10.10.25.101) can ping the firewall interface and vice versa, but interface 2 (10.10.26.102) cannot ping the firewall interface.

I did a packet capture on the firewall and the firewall interface 10.10.26.1 is sending ARP Broadcast when traceroute was performed from 10.10.26.102.





I have checked the ARP table and MAC address from Uplink 1 is added but Uplink 2 there are no entries from the Edge Node. I have set up another VM (10.10.26.225) on the 10.10.26.0 network and it can reach firewall interface (10.10.26.1) without any issues, and has entries from the VM (10.10.26.225) as well.



Anyone experienced with this issue, or knows what's going on, or what can be checked ?

Sorry been on this for about a week now.

[change the LAN interface IP address]

Hi,

I do a lot of testing on firewall deployment, and configurtions in a virtual environment.

23.1_6 does not have this issue, however, both 23.1.11_1 and 23.7 have this issue.

If I disable DHCPv6 on WAN interface, shutdown the firewall, export to OVF or OVA for import elsewhere, then import it, then change the LAN interface IP address, the LAN page is inaccessible.

Of note is that when changing LAN IP address it asks for DHCPv6 on WAN even though its disabled, it does not do this in 23.1_6.

Anyone knows of a solution/fix for this, tried many way to search but could not find.

[Router A]

Hi,

I'm losing my mind having setup FRR BGP on 2 routers.

Router A - 192.168.9.21
Networks - 192.168.11.0/24

Router B - 192.168.9.31
Networks - 10.10.13.0/24, 10.10.15.0/24, 10.10.17.0/24

I can see in the routing table neither of the routes are being populated.
Router A


Router B


Router A Configuration

Code Select Expand

Building configuration...

Current configuration:
!
frr version 7.5.1
frr defaults traditional
hostname MFW.localdomain
log syslog notifications
!
router bgp 65551
no bgp ebgp-requires-policy
no bgp default ipv4-unicast
neighbor 192.168.9.31 remote-as 65555
neighbor 192.168.9.31 bfd
neighbor 192.168.9.31 update-source em0
!
address-family ipv4 unicast
  redistribute connected
  neighbor 192.168.9.31 activate
  neighbor 192.168.9.31 prefix-list All in
  neighbor 192.168.9.31 prefix-list All out
  neighbor 192.168.9.31 route-map All in
  neighbor 192.168.9.31 route-map All out
exit-address-family
!
address-family ipv6 unicast
  redistribute connected
exit-address-family
!
route-map All permit 10
match ip address prefix-list All
!
line vty
!
bfd
peer 192.168.9.31
!
!
end

Router B Configuration

Code Select Expand

Building configuration...

Current configuration:
!
frr version 7.5.1
frr defaults traditional
hostname SFW.localdomain
log syslog notifications
!
router bgp 65555
no bgp ebgp-requires-policy
no bgp default ipv4-unicast
neighbor 192.168.9.21 remote-as 65551
neighbor 192.168.9.21 bfd
neighbor 192.168.9.21 update-source vmx0
!
address-family ipv4 unicast
  redistribute connected
  neighbor 192.168.9.21 activate
  neighbor 192.168.9.21 prefix-list All in
  neighbor 192.168.9.21 prefix-list All out
  neighbor 192.168.9.21 route-map All in
  neighbor 192.168.9.21 route-map All out
exit-address-family
!
address-family ipv6 unicast
  redistribute connected
exit-address-family
!
route-map All permit 20
match ip address prefix-list All
!
line vty
!
bfd
peer 192.168.9.21
!
!
end

Both routers are advertising

Router A

Code Select Expand

BGP neighbor is 192.168.9.31, remote AS 65555, local AS 65551, external link
Hostname: SFW.localdomain
  BGP version 4, remote router ID 192.168.9.31, local router ID 192.168.11.2
  BGP state = Established, up for 00:00:03
  Last read 00:00:02, Last write 00:00:02
  Hold time is 180, keepalive interval is 60 seconds
  Neighbor capabilities:
    4 Byte AS: advertised and received

Router B

Code Select Expand

BGP neighbor is 192.168.9.21, remote AS 65551, local AS 65555, external link
Hostname: MFW.localdomain
  BGP version 4, remote router ID 192.168.11.2, local router ID 192.168.9.31
  BGP state = Established, up for 00:00:05
  Last read 00:00:04, Last write 00:00:04
  Hold time is 180, keepalive interval is 60 seconds
  Neighbor capabilities:
    4 Byte AS: advertised and received

Nt sure where the problem lies, seeing the below in logs.

Router A

Code Select Expand

2023-08-07T20:29:35 Notice zebra client 31 says hello and bids fair to announce only vnc routes vrf=0
2023-08-07T20:29:35 Notice frr_carp FRR received carp configuration event.
2023-08-07T20:29:35 Notice zebra client 28 says hello and bids fair to announce only bgp routes vrf=0
2023-08-07T20:29:35 Error bgpd [EC 100663304] ERROR: No such command on config line 34: ip prefix-list All seq 10 permit Any
2023-08-07T20:29:34 Error bgpd [EC 100663304] ERROR: No such command on config line 34: ip prefix-list All seq 10 permit Any

Router B

Code Select Expand

2023-08-07T20:36:18 Error bgpd [EC 100663299] %bgp_getsockname() failed for accept from_peer 192.168.9.21 fd 22 (peer fd 19)
2023-08-07T20:36:18 Error bgpd [EC 100663299] Can't get remote address and port: Socket is not connected
2023-08-07T20:36:18 Error bgpd [EC 33554465] 192.168.9.21 [FSM] Ignoring event BGP_Start in state Connect, prior events ConnectRetry_timer_expired, ConnectRetry_timer_expired, fd 22
2023-08-07T20:28:55 Error bgpd [EC 100663304] ERROR: No such command on config line 34: ip prefix-list All seq 20 permit Any
2023-08-07T20:28:55 Error bgpd [EC 100663304] ERROR: No such command on config line 34: ip prefix-list All seq 20 permit Any
2023-08-07T20:28:17 Warning zebra [EC 4043309122] Client 'bfd' encountered an error and is shutting down.
2023-08-07T20:28:17 Warning zebra [EC 4043309122] Client 'bgp' encountered an error and is shutting down.

Any thoughts ?!

Hi All,

Anyone else not ale to use BGP ?

I have configured 23.7 fresh, and tested BGP. It does not work, and there is nothing in the logs either, not even any error. There was no error during installation.

The Running Configuration has nothing in it either.

[which cannot be changed]

Hi All,

I know APIPA is not a routable address, however, I recently came to know PFSensse has added a feature to allow APIPA traffic on interface https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html?highlight=apipa#allow-apipa

Can I know if any such feature exists, I have an Ericsson BBU (Baseband Unit) which has an IP address 169.254.2.2 which cannot be changed, and this needs to be accessed from different network for fetching health related information.

Any thoughts ?

Thank You

[VLAN13_Servers]

Hi,

I could not understand which interface to add a block rule in this case.

I have set up VIP (10.10.13.1) on FW1 (10.10.13.2 | Sub-Interface (VLAN13_Servers).

I have set a reject any IPv4 rule on this Sub-Interface of FW1, and shutdown FW2 for testing.



Parent interface of Sub-Interface VLAN13_Servers is also added with a reject all IPv4 rule.



But the ping traffic still reaches a VM in 10.10.13.0/24 network.




I found out that if I disable the VIP (10.10.13.1 in FW1) the pings between the 2 VMs stops.

So my question is which interface do I add a block rule to block traffic from reaching the VLAN Sub-Interface, because I have added 1 block rule on Parent interface, an another block rule on Sub-Interface but the VM in 10.10.13.0/24 is still reachable ?

Thank You

Hi,

All the below is in a virtual environment.

I have a Windows Server VM which when pinged from any other device shows (DUP!). I tried to flush the ARP in the OPNSense VM, but this does not change anything.

The IP address is only assigned to 1 device, the duplicate issue comes from changing the MAC address.

Can I  know how to get rid of old MAC address informatgion from the routrer ?

Thank You

[Primary]

Hi,

I have configured OPNSense in an HA setup with VLANS. The Primary shows the CARP interfaces fine, however, the secondary shows as 1 interface as Backup, several others as Master, (and the interfaces mismatch the VLANs they are assigned to, for example, VLAN50 interface shows as assigned to VLAN30).

Primary


Secondary


Console View


This is running on ESXi so all Portgroups already have Promiscuous mode, MAC address changes, and Forged transmits enabled.

Anyone knows the issue ?

Thank You

Hi,

I just installed the 22.1 version an there seems to be some setting, or issue. When I make changes to interface and try and save it, the browser shows as saving changes but redirects to the login page.

Anyway aware of how to change this behavior, or is it a bug ?

Thank You

Hi,

I'm running a Nested Environment, and would like to know if anyone been able to successfully implement VLANs in OPNSense with Virtual Distributed Switch, where both OPNSense, vCenter, and ESXi are all running as VM's on a physical host.

If yes, can I know how to configure it, or is there a guide to follow specifically for OPNSense.

Thank You

Hi,

I have an esxi Server with an OPNsense Firewall and a CentOS, both running as VMs.

I have simple network with 2 PortGroups, Trunk (VLAN 4095), and Server PortGroup (VLAN 116)


The OPNsense Firewall has 2 vNIC


- Trunk PortGroup is em0 in OPNsense
- Server PortGroup is em1 in OPNsense
- em1_vlan116 is the Sub-Interface on VLAN116 under em1, and is configured with DHCP.

CentOS is attached to Server PortGroup


CentOS requests DHCP but the request does not reach the Sub-Interface (em1_vlan116) which is configured and instead reaches the main Interface (em1) which is not configured for DHCP.



I'm unsure what Im doing wrong here.

Any thoughts ?

Thank You

[Operation Timed Out]

Hi,

I'm trying to troubleshoot this issue since a few days now and cannot seem to find the issue.

I have a lab environment in VMware Workstation with OPNsense firewall VM, Windows as a DNS Server VM, vCenter VM, and ESXi VM hosts added to vCenter. The vCenter and ESXi are in the same subnet, Windows Server is in a different subnet.

I have been trying to add vmnics to DVSwitch but keep getting Operation Timed Out error. Upon digging further I found the following error

A general system error occurred: Connection reset by peer: The connection is terminated by the remote end with a reset packet. Usually, this is a sign of a network problem, timeout, or service overload

which I read about on VMware [ https://kb.vmware.com/s/article/76259 ] says to be related to firewall. I can't seem to find what the issue is in firewall, all ports, protocols are open and allowing all traffic.

Any thoughts.

Hi,

I have set the following rule on NTP on the WAN interface

WAN/NAT interface - 192.168.47.2 / 24
Firewall Interface - 192.168.1.21 / 24



and the rule seems to be working



However, no NTP information shows up in the dashboard.







Any thoughts what is going on ?

Thank You

[Firewall NTP Time and Sync Server]

Hi,

I have set NTP time of Canada (0.ca.pool.ntp.org, 1.ca.pool.ntp.org, 2.ca.pool.ntp.org, as obtained from https://www.pool.ntp.org/zone/ca). The sync server IP is 192.210.199.110 (stratum 2). When I check the IP address it is from US. However, the time of the firewall is still local and not of the Canada.

Is my understanding of NTP correct, that the firewall is suppose to have its NTP time set for Canada (meaning the time of the firewall should be the Canadian Time)

The actual issue is that my current time is GMT +1 but the firewall still shows as GMT 0 and which got me thinking if NTP is actually working, and that it is how I understand it is.

Firewall NTP Time and Sync Server



NTP Pool Addresses



NTP Sync Server IP Address

[ESXi Server to Windows Server]

Hi,

I have 2 networks, 192.168.28.0 (in VMware Workstation) and 10.0.64.0 (on a physical Dell Server). Both networks have 3 ESXi and 3 Windows VM in each. Both are behind their respective firewalls, the network between firewalls is 192.168.1.0.



I'm trying trying to access 10.0.64.0 network's ESXi login page from a Windows VM in 192.168.28.0, and vice versa and they seem to be just too slow to load. The following is the loading pages in seconds in each Windows VM.

Code Select Expand

Loading 10.0.64.74 login page on:

192.168.28.40 - 80 secs
192.168.28.41 - 110 secs
192.168.28.43 - 110 secs

Loading 192.168.28.74 login page on:

10.0.64.40 - 110 secs
10.0.64.41 - 90 secs
10.0.64.43 - 93 secs

I also checked at different times, the time to load the login page varies from time to time but takes nearly between 60 - 90 or more to load the login pages.

A trace route to see the route packets take.

ESXi Server to Windows Server

Code Select Expand

[root@esxi1s:~] traceroute 192.168.28.40
traceroute to 192.168.28.40 (192.168.28.40), 30 hops max, 40 byte packets
1 10.0.64.67 (10.0.64.67) 0.796 ms 0.869 ms 0.685 ms
2 192.168.1.21 (192.168.1.21) 2.187 ms 2.747 ms 2.874 ms
3 servermdc (192.168.28.40) 3.475 ms 3.752 ms 3.408 ms


Windows Server to ESXi Server

Code Select Expand

tracert 10.0.64.74
Tracing route to esxi1s.vlab.lab [10.0.64.74]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 192.168.28.35
2 3 ms 3 ms 3 ms 192.168.1.31
3 3 ms 3 ms 3 ms esxi1s.vlab.lab [10.0.64.74]

What else can I check in the firewall to determine the source of the problem.

Could it be the rules ?, or DNS misconfiguration ?

Thank You

Hi,

I'm planning to purchase a TP-Link T2500G-10TS (TL-SG3210) switch for home lab. I already have a dell server with quad-port NIC which I will connect to the switch and I'll make VLANs.

The server connects to the switch, the switch connects to my laptop which will run OPNsense VM.

My question is can I use an OPNsense VM (runningin VMware Workstation) to have a Router-on-a-stick configuration with a physical switch, or is this only possible with a physical firewall/router ?

I'm unwilling to purchase a physical firewall/router to save money if Router-on-a-stick is possible with a physical switch to firewall/router VM.

Thank You

[ESXi]

Hi,

I have a very basic setup on ESXi.

I have a Server VM - 10.0.64.49 / 27, Gateway - 10.0.64.35 / 27

I have a Firewall VM with one of its port as a Parent for VLAN 50, and a VLAN50 interface.

The Server in VLAN 50 is unable to ping its own Gateway. I have created rule for all traffic allowed on all interfaces.

Not sure what else is missing.

ESXi

Portgroups


Security Settings (Enabled for firewall HA)


Firewall NIC Portgroup


Server NIC Portgroup


Firewall

Interface Assignment


Parent Interface Configuration


Parent Interface Rule


Server Interface Rule


Server VLAN 50


Server Sub-Interface Configuration


Server Ping Response


tcpdump on Parent Interface of VLAN50

Code Select Expand

root@firewallsm:~ # tcpdump -e -n -i vmx6
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vmx6, link-type EN10MB (Ethernet), capture size 262144 bytes
23:40:52.515232 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:40:53.522040 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:40:54.518741 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:40:55.522016 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:40:56.520736 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:40:57.524009 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:40:58.515659 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:40:59.529032 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:41:00.524156 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46
23:41:01.524248 00:0c:29:80:28:1c > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.0.64.35 tell 10.0.64.49, length 46

Anything I'm missing or haven't configured ?!

Thank You

[Alias > Host (IP)]

Hi,

I have been trying to find how to block just some URLs but can't seem to find how. I tried by using Alias > Host (IP) and applied it to Destination in a rule but that was ineffective. The only way I see is by using the Web Filtering and downloading the list file as shown here https://docs.opnsense.org/manual/how-tos/proxywebfilter.html that uses Category based blocking.

Any other way I can block some URL's, by manually entering them, or via some custom txt file that can be uploaded to the firewall ?!

firewall

Thank You