Topics

Trying to figure out the correct way to do this coming from ISC DHCPv4.  In ISC I had the dynamic range set to 192.168.0.200-192.168.0.254 and all of my statics below that.  They all got the same domain name lan.mydomain.com.  All worked great.  The issue I am running into is trying to replicate that.  It seems like in DNSMasq you generally place the statics within the range and DHCP just assigned things to the unassigned addresses.  I don't really want that....

I somewhat have it working by just assigning the statics NOT within the range, but the issue is that doesn't set the domain name.  I don't really want to manually set the domain name for each static host, but I cannot seem to figure out how to set a range that is ONLY used for setting the domain name. .... My thought was to have two ranges... one that basically just sets the domain and the other is used for dynamic.  Didn't seem to work.

Any help?

So I followed the instructions at https://tailscale.com/kb/1097/install-opnsense#connect, but I'm having an issue with filtering.  When I setup the interface I just have an empty interface with no ip settings.  The filter doesn't seem to do anything though.  If have no filters or a default deny I can still ping everything from the tailscale client on the other side.  Am I missing something?

I have a 1000Mbps/20Mbps cable connection.  When I connect directly to the modem I am able to get the full speed, so I know the line works.  When I run the speed test with my current codel config I max out download at 750Mbps and I can't seem to figure out why.

I have a Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz w/ 16 GB RAM and the following setup....

Everything not marked below is either blank/unchecked/default etc

Pipes:
  1) Speed=1000, Units=Mbps, Scheduler=FlowQueue-CoDel "Downstream Pipe"
  2) Speed=20, Units=Mbps, Scheduler=FlowQueue-CoDel "Upstream Pipe"

Queues:
  1) Pipe=Downstream Pipe, Weight=100, "Downstream Queue - Regular"
  2) Pipe=Upstream Pipe, Weight=1, "Upstream Queue - Regular"
  3) Pipe=Upstream Pipe, Weight=10, "Upstream Queue - DNS and ACK"

Rules:
  1) Sequence=1, Interface=WAN, Proto=IP, Source=Any, Dest=<Private IPS>, Src/Dest Port=ANY, Direction=Both, Target=Downstream Regular
  2) Sequence=10, Interface=WAN, Proto=TCP ACK ONLY, Source=<Private IPs>, Dest=ANY, Src/Dest Port=ANY
Direction=Both, Target=Upstream Queue - DNS and ACK
  3) Sequence=11, Interface=WAN, Proto=TCP, Source=<Private IPs>, Dest=ANY, Src Port=Any, Dest Port=53
Direction=Both, Target=Upstream Queue - DNS and ACK
  1) Sequence=12, Interface=WAN, Proto=IP, Source=<Private IPS>, Dest=Any, Src/Dest Port=ANY, Direction=Both, Target=Upstream Regular

My goal is to have codel setup to stop buffer bloat issues, and also to prioritize ACK and DNS.  But I can't figure out why when these are enabled my connection maxes out at 750

Title says it all.  Just updated and now when I go to the updates tab under firmware it just spins.  JQuery is calling "updatestatus" over and over again, with no response.  Thoughts?  Did updates from the console and it says all is good.

So I have been reading up on how to setup Scuricata on my OpnSense box at my house.  From what I have read I need to put my WAN IP into the "Home Networks" section.  The issue is that mine is a DHCP given address.  I can't put a hostname into the field either.  Is there an easy way to automatically keep my WAN ip in that list?  Thanks.

Also is there rule set for port scans?  I have looked through ET Telemetry, Snort VRT, etc.  I can't seem to find a pre-made one to detect port scans?  Thanks!

Edit: I found that ET Pro has a "scan" but not ET Telemetry, but there is emerging-telemetry

Anyone know what they are?  They seem to be internal aliases, but I can delete them?

Thoughts?

So I figured I would try to get IDS/IPS setup on my home router for fun.  Currently I have NO rule sets setup and my network configuration has a cable modem going to the WAN interface and uses NAT to have a single LAN interface with a VLAN 100 (for guests) and untagged for local traffic.   A few questions came up....

I followed (https://homenetworkguy.com/how-to/configure-intrusion-detection-opnsense/)

1) Do I use LAN or WAN in my interface list?  If I use the WAN and NAT do I need to add my WAN IP to the list of IPs? If so how can I automate that on changes.

2) It seems like whenever I enable on any of the interfaces that interface becomes completely unresponsive and won't pass any traffic.  Thoughts?

Thanks!

Hey Everyone,

I'm struggling to get FQ-Codel working correctly and could use some suggestions.  I have been using

https://www.lullabot.com/articles/eliminating-robots-and-voip-glitches-with-active-queue-management
and
https://forum.opnsense.org/index.php?topic=7423.0

as a guide, but my numbers are not what I think they should be.  Mostly on my download I seem to be loosing about 50 Mbps, but I'm not sure why.  My connection is a 300/30 Mbps cable line.  Here is what I have setup so far.

Pipes:
  Downstream Pipe -
   Bandwidth => 290 (300 Mbps minus about 3% for overhead)
   Metric => Mbps
   Mask => None, Codel Off, Pie Off
   Advanced Options -
     Scheduler Type => FlowQueue-Codel
     FQ-Codel ECN Checked
     All others default/blank

Upstream Pipe
   Bandwidth => 29 (29 Mbps minus about 3% for overhead)
   Metric => Mbps
   Mask => None, Codel Off, Pie Off
   Advanced Options -
     Scheduler Type => FlowQueue-Codel
     FQ-Codel ECN Checked
     All others default/blank

Queues:
  Upstream High Priority Queue (From lullabot link, for TCP ACK and DNS)
    Weight 10
    Pipe - Upstream Pipe
    All Others Default

  Upstream Regular Priority Queue
    Weight 1
    Pipe - Upstream Pipe
    All Others Default

  Downstream Regular Priority Queue
    Weight 1
    Pipe - Downstream Pipe
    All Others Default

Rules

#1, Interface WAN, Source Any, Destination 10.0.0.0/24 (LAN Network), Direction Both, Queue Downstream Regular

#10, Interface WAN, Proto TCP ACK Only, Source 10.0.0.0/24 (LAN Network), Destination Any , Direction Both, Queue Upstream High Priority

#11, Interface WAN, Proto TCP, Source 10.0.0.0/24 (LAN Network), Destination Any, Destination Port 53, Direction Both, Queue Upstream High Priority

#20, Interface WAN, Source 10.0.0.0/24 (LAN Network), Destination Any, Direction Both, Queue Upstream Regular Priority


With these settings I get an A on bufferbloat and my upstream seems to be great, but I seem to loose about 50 mbps on my downstream.

Any thoughts?  Suggestions?

Thanks

Hey,

So I am going to be converting my MikroTik routers over to OPNSense.  I currently have two sites that I am using EOIP (Ethernet Over IP, basically MikroTik's version of GRE) over IPSec setup between these two sites.  Trouble is that both sites have dynamic IPs (don't change often, but they can).  The way I am currently handling it is with Dynamic DNS and a script running on each router to see if there is a new IP for the other side of the tunnel every 10 minutes and then it updates it and forces the tunnel to restart. 

I am curious how I would go about setting this up in OPNSense.  Thanks in advance.

-Eric