Topics

Hello all
Since a few hours, I cannot access insight.synology.com anymore from my network. It does work from mobile or from other locations. I haven't changed anything in OPNsense and when I check the firewall log files, I see a lot of entries like:

Code Select Expand

wan 2022-11-02T10:44:05 *.*.*.*:63385 159.100.4.210:443 tcp let out anything from firewall host itself (force gw)

and when using curl, I get:

Code Select Expand

curl -v insight.synology.com
*   Trying 159.100.4.210:80...
* connect to 159.100.4.210 port 80 failed: Timed out
* Failed to connect to insight.synology.com port 80 after 21052 ms: Timed out
* Closing connection 0
curl: (28) Failed to connect to insight.synology.com port 80 after 21052 ms: Timed out

How can I further debug the situation? Many thanks for your help!

Hello all

I am trying to setup VPN where I want to have a site-2-site connection between two networks (between an OPNsense box (192.168.x.0/24) and an Asus Router (192.168.y.0/24) where the OPNSense box is the server and the Asus router the client) and also to support additional vpn clients like mobile phones or laptops when externally.

So a few questionas arrive:
1. Should I create separate VPN servers? One for the external clients and one for the site-2-site or can this be just one VPN server?
2. How do I configure the VPN server for the site-2-site? I have a pretty default config and the Asus router can connect and can access the resources on the VPN servers network via ip (for example a 192.168.x.50). But how do I get it the other way around so that I can also access resources on the client's network (for example 192.168.y.60)? I tried with setting the "IPv4 Remote Network" to the address range of the clients network (192.168.y.0/24) but that didn't help.

If you need more info I will gladly provide them.

Many thanks for your hints.
Roman

Edit: Added Server Settings

Hello

I have a fairly standard OPNSense box. I use quite some services which are available from the internet like "myservice.mydomain.com" which goes to an nginx-container which forwards to the right service. From external this works perfectly. Now to use the same while in the LAN, I use a custom DNS Server which translates "myservice.mydomain.com" into the LAN IP of the nginx-container.
For this, I added my LAN-DNS-IP into Services -> DHCPv4 -> [LAN] -> DNS servers
This actually worked now for almost a week somehow (but seemed strange as some custom entries from my DNS didn't work) but now it stopped working at all. When I now use "myservice.mydomain.com" from the LAN, I get "A potential DNS Rebind attack has been detected." Also if I ping "myservice.mydomain.com" from LAN, I get my WAN address. It seems as if my custom DNS is entirely skipped.

What could be the issue? What am I missing? I read about "Reflection for port forwards" and "Reflection for 1:1" which in the end would lead my connection to WAN and back so I don't want that, I want to directly go to the correct LAN address instead of doing a round trip to WAN.

Many thanks for your help.

Hello all

First time poster and first time opnsense user.

I am planning to redo my whole home network setup. I am currently just using a customer grade router as main router and I want to switch to opnsense in order to be able to use VLANS.

I have actually prepared a small image on how I imagine the network looks like (physically) and added it to the attachments.

Hardware summary:
- Cable modem, well as fiber modem
- IPU445 with opensense (has 4 ports)
- Various switches, all capable of VLAN tagging I hope
- Two Asus routers as Switches / Access points. They will use FreshTomato or ddr-wrtto use VLANs.

Connection summary:
- Cable modem is connected to one port on the pfsense box which is declared as WAN
- One? port from the opnsense box to the next switch
- One trunk per switch so all have a trunk.
- Devices are normally connected to the switches or via wifi.

My main question/insecurity is that my opnsense box has 4 ports, 1 is used for WAN so I have 3 free. Should I have only one of them as trunk port to the next switch (so multiple vlans and data go thru that port) or should I have multiple ports, maybe even with port aggregation? Or should I use multiple and maybe assign each of them a few vlans?

Also is something bad practice in this setup and should be changed?

Many thanks for you input! I will probably come back later with more questions but those are the most important ones so I can start.

Cheers,
Roman