Topics

Long story short: when changing the challenge type for a previously configured challenge the original values are still stored and interfere with the configuration we desire to apply.

In my case, I had updated a "Gandi LiveDNS" Challenge to a DNS-01 challenge for OVH.


I determined that an old token was used after setting the acme debug level to debug3 and checking the authentication value.


Based on this Forum reply , I checked the files under
/var/etc/acme-client/accounts/*/account.conf .

In one of these files I did indeed file the old token that was wrongfully used. 

Code Select Expand

SAVED_OVH_AK='<some_ak>'
SAVED_OVH_AS='<some_as>'
SAVED_OVH_CK='<some_ck>'
GANDI_LIVEDNS_TOKEN='<oldtoken>'
After removing that last line (GANDI_LIVEDNS_TOKEN=) I finally could regenerate the token.


The better solution would be that only the required configuration is loaded for acme.sh of course.

I have OPNsense running on a Proxmox server where its WAN port has the WAN_IP directly (datacenter).

On the LAN network it's connected to a bridge where several containers and VMs are connected.

I have several NAT rules which allow a connection from the publlic network to a internal TCP Servirce I'll call LANIP2:LANPORT .  The NAT rule works for WANIP:WANPORT to LANIP2:LANPORT .



However when I try to connect from a machine on the internal network to WANIP:WANPORT, the NAT rule does not seem to apply - I can not connect.  I can connect if I map the domain name to the internal IP, either in /etc/hosts or by mapping it to the local IP in unbound DNS running on OPNsense.

I would like to do properly though.

From time to time I lost internet connectivity "from my internal network" - and I found that OPNsense could not connet to the internet either.
The internet box was connected to the internet though and as far as I remember, I could connect to the internet box from my internal network.  And connect to the internet through a direct connection through the internet box (without the OPNsense firewall).

It turned out that i was not alone and a script already existed.
I have ajusted that to my needs, made it a bit more self-containing with regards to its installation.

It's available as a gist: https://gist.github.com/035129a6f90979ba39ec8377e99922f5 .

This script will ping the internally defined servers on every execution.  When the ping fails, it will bring the igb0 interface down and up to try to restore the connection and ping again.  If that fails, OPNsense is rebooted.

I find that my OPNsense server reboots from time to time and that I not have to intervene unless the internet connection is really down.

I would like to define at least two subnets on my OPNsense LAN interface.

This is not for security reasons, but because some devices need to be on a predefined subnet.
I want to communicate from one subnet to the other.

I thought that I could configure the firewall to listen on multiple IPs, set it up as the gateway on all IPs and a DHCP server for each one of them.
The DHCP server is not really a requirement.  One would be configured to accept only certain MAC Addresses, and they other one may be set up to deny them.

I can define a Virtual IP on the firewall and ping it.

My switch is not VLAN capable.

Is it possible to add some kind of virtual interface operating on the physical LAN interface?



I've already looked around on the forum:

Closest topic - but I do not have another Laptop to configure for ensure the forwarding:
https://forum.opnsense.org/index.php?topic=18381.0
Suggests the Virtual IP, but that's not the complete solution, and no solution was provided in the end:
https://forum.opnsense.org/index.php?topic=17655.0
Other topic, but more about VMs, and no OPNSense solution:
https://forum.opnsense.org/index.php?topic=5429.0
Regarding access points:
https://forum.opnsense.org/index.php?topic=15168.0
Pretty close: two neighbours that want a subnet:
https://forum.opnsense.org/index.php?topic=14224.0