Topics

I've tried this now on an off for over a year through various versions and it still doesn't work for me.

• I've created a OTP server within Opnsense, i've tried with different token lengths and so on.
• I've added a user and configured it to use OTP and imported the token QR code into Google Authenticator and other OTP apps (including Yubico and a windows one too).
• I've tried the 'tester' and trying to log in too (user is configured as admin rights)  but neither work.
• I've verified time, date and timezone and all is correct.
• I've tried using the OTP followed by the password and the other way around.
• I've tried a user name of gibbon and also gibbon@opnsensefw (which is what its listed as in the authenticator app... not sure which you're suppose to use, but neither seem to work).

please can anyone help troubleshoot this with me or at least offer some suggestions.  i've read through the guide on the wiki page and i'm positive i've done all thats needed (i've set it up from scratch a few times now) 
I don't fancy factory defaulting the whole box to see if that helps though.

Hi,

I need to run a specific script on a schedule.  From what I can make out from the documentation i need to add a custom actions_somethingoranother.conf file to /usr/local/opnsense/service/conf/actions.d

I have done so and I now see the item I created within the dropdown list in the CRON section of the GUI.
But I am getting a error 127 in the logs when it tries to run the cron on its schedule.

I've tried a couple of locations to put the actual script file, and afaik it as the same permissions and ownership as other script files which are ran currently by cron.

content of my actions_custom.conf are

Code Select Expand


[vpnsquidinterface]
command:/usr/local/opnsense/scripts/proxy/vpnscript.sh
parameters:
type:script
message: reload proxy with vpn interface
description: VPN Proxy script


I've tried to work out https://docs.opnsense.org/development/backend/configd.html but I'm still not hugely clear on if/why it needs a 'name' in the [] brackets at the top. 

error i get is

Code Select Expand

2022-03-15T16:21:00 Informational configd.py message f66b3eb5-d5e3-47cf-a595-3565daeca9ce [custom.vpnsquidinterface] returned Error (127)
2022-03-15T16:21:00 Error configd.py [f66b3eb5-d5e3-47cf-a595-3565daeca9ce] returned exit status 127
2022-03-15T16:21:00 Notice configd.py [f66b3eb5-d5e3-47cf-a595-3565daeca9ce] reload proxy with vpn interface
which as far as i can tell , means that the file isn't found.   the file is there, and as I say, its got correct ownership/permissions and i've tried a few places and get the same sort of error.  despite following the same convention as existing cron actions. 

thanks in advance

as title says really.  any changes to /usr/local/etc/squid/squid.conf get overwritten on system updates/changes in the GUI.  I want to add something (specifically tcp_outgoing_address) that needs to be persistently in there. (doesn't appear to be a GUI option to set this).

I've read something about pre-auth and post-auth folders but from looking at whats in them currently, the contents of such doesn't seem to appear in the squid.conf file so i dont think it works like that.   Plus those folders seem to be very specifically relating to opnsense and I cannot find any documentation on them.

Please advise.

Thanks

was connecting fine before. now it never connects.

log files say

Code Select Expand


2022-03-08T12:22:17 Notice openvpn UDP link remote: [AF_INET]1xx.1xx.6x.98:8888
2022-03-08T12:22:17 Notice openvpn UDP link local (bound): [AF_INET]86.x.x.24:0
2022-03-08T12:22:17 Notice openvpn TCP/UDP: Preserving recently used remote address: [AF_INET]1xx.1xx.6x.98:8888
2022-03-08T12:22:17 Warning openvpn NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2022-03-08T12:22:17 Warning openvpn WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2022-03-08T12:22:17 Notice openvpn library versions: OpenSSL 1.1.1m 14 Dec 2021, LZO 2.10
2022-03-08T12:22:17 Notice openvpn OpenVPN 2.5.5 amd64-portbld-freebsd13.0 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jan 24 2022
2022-03-08T12:22:17 Warning openvpn WARNING: file '/var/etc/openvpn/client1.up' is group or others accessible
2022-03-08T12:22:17 Warning openvpn DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2022-03-08T12:22:17 Notice openvpn SIGTERM[hard,] received, process exiting
2022-03-08T12:22:17 Error openvpn event_wait : Interrupted system call (code=4)

nothing has changed config-wise.

any ideas?

Hi all,
Not sure what else I can put really, i've been using DNSMasq for my DNS for the last week or two

I'm finding that in this time, a disconcerting number of times it seems, randomly, all internet stops. 
Trying to troubleshoot exactly what has happened I worked out it was DNS that was the fault.   I restarted DNSMasq and everything starts working again.

Log files show nothing that i can make out (from what I can see it was still receiving a lot of DNS requests, just wasn't doing anything with them (supposed to upstream to my pihole).

Anyone else having issues? or is there anything i can tweak/change to make it less prone to these sort of issues?

Hi,

I've set up the TOTP server, created a user and generated a TOTP which I've added to google authenticator using the QR code. 
If i go to the tester, select TOTP and login with

<username>
<password><OTP>
ie
thefunkygibbon
password789412

it always says i've gotten the creds wrong.  (also tried the OTP in front of the password... makes no difference)

Is there some other setting to use to ensure it works?

Both my firewall/phone/laptop are all using the correct time/timezone/date

Hi
I've gone through the process of creating the client openvpn to my vpn provider the tunnel is up. Great.

The next step is to only send everything via the VPN if I am using the opnsense Web Proxy.   
But I can't seem to work out how to do that, or if it is indeed possible (feels like it should be something that is)
There doesn't appear to be a way of  assigning an outbound interface for the proxy. 
I thought I could create a rule with the source being the firewalls IP.  But that didn't work as there is already an implied rule which supersedes it which allows traffic outbound from the FW normally through the default gateway.  :-(

Any pointers for the best ways to do this would be appriciated.
Thank you

Hi

I've gone through the process of setting up a ovpn client vpn to my provider.  This is connecting fine (apparently.. haven't manage to actually test it yet).    But i'm at a point in the guides I have found that I should be creating an interface 'ovpnc0' (so, presumably I can route certain traffic down that interface) but when I go to interface assignments and try to create a new interface, there isn't one there with that name.  Has something changed in the latest builds of OPNsense or is something just broken on my setup somehow?

thanks

Hi,

I turned on netflow to try to troubleshoot some traffic flows earlier on but I cannot see a way of stopping it.. the 'cache' page has packet counts still going up and up and it was about half hour ago when i turned it on.   
Obviously I don't want it to run forever...  any pointers?

Cheers

Hi all,

New to OPNSense, but not new to Firewalls and UTM's etc. (although it's been some years since I did any web proxy/filtering jobs... things have moved on it seems in the last 10odd years!)

I'm a little confused about a bunch of things and I would really appreciate some advise.

Here are my take on things.  I'm assuming that I can't / shouldn't run most of these concurrently but i'd love to hear what everyone else is doing.

What I want -  Malicious/phishing/spam blocking, AV scanning, adblocking, Geoblocking.  Blocking on a per user/IP basis. Transparent rather than setting an explicit proxy.

• Web Proxy - Can do URL blocking and block all the above categories (dependant on having a URL blacklist... which i'm struggling to find other than 1 which doesn't appear to have many items in each category). 
  
  
• ClamAV - Can do AV obviously - relies on web proxy/caching to be in place.  so presumably can't work with zenarmor
  
  
• ZenArmor - Has most of the functionality I'd desire (except AV) but I'm not going to pay $100 a year for it)
  
  
• PiHole - Already run this on a docker image.  Working fine for the most part.
  
  
• OpenDNS - Used to use this, useful except it was a little slow to use and no way of differentiating between users.
  

So my question is, what would be the best/least expensive product/combination to get as much functionality as possible from my requirements above?  I am assuming that using multiples of the above is going to a) cause conflicts  b) cause confusion where you don't know what is blocking. 

Thanks in advance for your thoughts .

Was thinking of sticking some kind of log server on a docker container on my server... something maybe that has a decent presentation of the logs rather than just a plain old table of logs.
Maybe some fancy analytics?   Not sure if such things exist or if i'm going to have to just use something like plain ol syslog-ng ?

thanks in advance.

Hi,

I've just replaced my fan on my Caswell CAF-0260 (smoothwall s2) as the existing one was very loud.  The paranoia in me is now concerned that it might not be cooling as well as the previous one was. 

Is there any way of monitoring the temperature on OPNsense?  is it hardware dependant? 
I've searched forums and reading that you can find the temps out by running

Code Select Expand

sysctl -a | grep temperature
or sysctl -a | grep thermal


but i don't see much in there
other than
hw.acpi.thermal.tz0.temperature: 0.1C
hw.acpi.thermal.tz0._CRT: 94.1C
(bit concerned about the latter one, but the number doesn't seem to change, so i'm guessing its not an accurate readout of the actual temps)

any advice?

Thanks in advance

Hi, new to opnsense, but not new to firewalls in general.

My situation is that I have a bunch of things I need to access using the external addresses.  This was working fine with my previous mesh system with basic port forwarding.

example

I have a single IP address which the modem gives to the WAN interface of my firewall ([home.domain.com](https://home.domain.com) in this example).

I have some nat/access rules to allow the traffic as per:

server is on [home.domain.com:1234](https://home.domain.com:1234)

nats to [192.168.0.1:80](https://192.168.0.1:80)

server is on [home.domain.com:2345](https://home.domain.com:2345)

firewall nats to [192.168.0.2:443](https://192.168.0.2:443)

and so on.

​

The NAT rules I've created work fine externally, I've put the interfaces to be both LAN and WAN and the auto created rule has created a 'floating' rule that seems correct.

I've enabled nat reflection too.  no dice.

​

I know I can create local DNS to get around it , but it only would work for the single IP address.

​

Any pointers?  I'm sure that Opnsense should be able to do this... but i am positive i must be doing something dumb.

​

Thanks in advance.

​

edit:

also if it is relevant i see this in the state tables

all tcp  192.168.0.23:53368 86.11.11.1:10443 192.168.0.2:8123 CLOSED:SYN\_SENT 
(192.168.0.23 is my device i'm testing from and the 86 IP is my obfuscated external IP and 192.168.0.2 is my server

Seems to be a horrible experience browsing these forums from a mobile device as literally every page you have to zoom in loads before anything is usable.

Is there a specific theme or url to access it by to make it more usable?