Topics

Hey today i noticed that my LAN kea based dhcp is giving gateway 0.0.0.0
ipconfig looks like this

Ethernet adapter Ethernet:

  Connection-specific DNS Suffix  . : localdomain
  IPv4 Address. . . . . . . . . . . : 192.168.1.21
  Subnet Mask . . . . . . . . . . . : 255.255.255.0
  Default Gateway . . . . . . . . . : 0.0.0.0
                                      192.168.1.1


*** quick edit after reboot of the laptop , all fixed. Mark for achive.
Sorry :)

Hey gentlemens i found in old thread that someone asked about coraza, then i found guide for deb/ubn for integration with HaProxy here.
Can you help me to add it to haproxy for testing purposes , and later add it to HaProxy itself :)

Code Select Expand

root@wall:~/coraza # git clone https://github.com/corazawaf/coraza-spoa.git
Cloning into 'coraza-spoa'...
remote: Enumerating objects: 965, done.
remote: Counting objects: 100% (451/451), done.
remote: Compressing objects: 100% (178/178), done.
remote: Total 965 (delta 315), reused 311 (delta 265), pack-reused 514
Receiving objects: 100% (965/965), 288.82 KiB | 999.00 KiB/s, done.
Resolving deltas: 100% (497/497), done.
root@firewall:~/coraza # cd ./coraza-spoa
root@firewall:~/coraza/coraza-spoa # make
make: "/root/coraza/coraza-spoa/Makefile" line 22: Invalid line type
make: "/root/coraza/coraza-spoa/Makefile" line 24: Invalid line type
make: "/root/coraza/coraza-spoa/Makefile" line 28: Invalid line type
make: "/root/coraza/coraza-spoa/Makefile" line 29: warning: duplicate script for target "ifeq" ignored
make: "Makefile" line 23: warning: using previous script for "ifeq" defined here
make: "/root/coraza/coraza-spoa/Makefile" line 29: warning: duplicate script for target "(,)" ignored
make: "Makefile" line 23: warning: using previous script for "(,)" defined here
make: "/root/coraza/coraza-spoa/Makefile" line 30: Invalid line type
make: Fatal errors encountered -- cannot continue
make: stopped in /root/coraza/coraza-spoa

~ few hundred years later managed to build and run the coraza in opnsense, but i stumble few hickups that i don't understand yet,
- first how to create easy configctl service for it / or maybe just run at startup time of opnsense
- second as i search in forums or inside opnsense files i dont see haproxy.conf that i can edit (and it's not automatic generated) - i guess php handles the generation of it, and in my case is in /usr/local/etc/haproxy.conf and edit will not help, if i click apply from UI because maybe will delete my additions.

Is there a way to add in example bellow few options ?

Code Select Expand

defaults
    log global
    option httplog
    timeout client 1m
timeout server 1m
timeout connect 10s
timeout http-keep-alive 2m
timeout queue 15s
timeout tunnel 4h  # for websocket

frontend test
    mode http
    bind *:80
   
    unique-id-format %[uuid()]
    unique-id-header X-Unique-ID
    filter spoe engine coraza config /etc/haproxy/coraza.cfg
   
    # Currently haproxy cannot use variables to set the code or deny_status, so this needs to be manually configured here
    http-request redirect code 302 location %[var(txn.coraza.data)] if { var(txn.coraza.action) -m str redirect }
    http-response redirect code 302 location %[var(txn.coraza.data)] if { var(txn.coraza.action) -m str redirect }

    http-request deny deny_status 403 hdr waf-block "request"  if { var(txn.coraza.action) -m str deny }
    http-response deny deny_status 403 hdr waf-block "response" if { var(txn.coraza.action) -m str deny }

    http-request silent-drop if { var(txn.coraza.action) -m str drop }
    http-response silent-drop if { var(txn.coraza.action) -m str drop }

    # Deny in case of an error, when processing with the Coraza SPOA
    http-request deny deny_status 504 if { var(txn.coraza.error) -m int gt 0 }
    http-response deny deny_status 504 if { var(txn.coraza.error) -m int gt 0 }

    use_backend test_backend

backend test_backend
    mode http
    http-request return status 200 content-type "text/plain" string "Welcome!\n"

backend coraza-spoa
    mode tcp
    balance roundrobin
    timeout connect 5s # greater than hello timeout
    timeout server 3m  # greater than idle timeout
    server s1 127.0.0.1:9000

OPNsense 24.1.7-amd64

As description says i find it strange it is wrong time when firewall logs shows it right.
Is there a file that need to be edited to show it right, or this is expected behaviour?

Hellow gentlemen, I have a small network with 4 static WAN addresses, we are currently using one but I decided to add the others so that they can be used productively. The GATEWAY is statically set and working at x.x.x.233 and the WAN interface works with it without a problem, but when I tried to activate the second WAN_HA interface it does not show me the statically entered GATEWAY, what could be the problem?
Thank you for your time!

I got 4 static ip's  and single gateway is it possible to use failover/load balance for them?
Router have wan/lan ports only and it's virtualized in proxmox with added few virtual nics (attached to actuall WAN interface).
Problem is that when i create like 2/3 WAN interfaces with static ip , gateway is already used from the first one.
Can you give me some tips how ot achieve this ?
Thanks in advance

Hellow gentlemens, still learning here need some help, because I think i saw something strange in watching my logs.
First is is possible somehow to disable rules that are hardcoded for ipv6 somehow and is it a good idea? ( also can i remove ipv6 from loopback routes ?)
Second i follow a guide to disable ipv6 for firewall but i still see it sometimes in loopback in example even i'am sure i disable it right.
And also on rules picture isn't this duplicating?
Thanks in advance.

Hellow, i'am using proxmox and opnsense as VM. I have few vlans but one in particular is giving me strange error screenshoted bellow.
Network setup ::::> Proxmox *vmbr0-for proxmox static ip*, vmbr1 WAN(opnsnse) , vmbr2 (LAN opnsnse).
Opnsense have few vlans ( 10,20,30,40 ) where 40 is for VM's
One of VM's is AdguardHome as DNS and additionally i set this dns (192.168.40.2) on all interfaces LAN,Guests,IOT,etc.

Also i have setup STATIC ip's for specific VM's on vlan40


FIXed with:
Manually set 192.168.40.2/32 and gateway 192.168.40.1 on VM's..

Hellow gentlemens, what is the best way to disable NTPD in freebsd so it doesn't auto load when [machine] is booted/rebooted, so i can just enable Chrony and put it on 123 port?
Can i just delete/move /etc/rc.d/ntpd or this is not the way?

Opnsense-devel   /usr/local/etc/rc.bootup: The command '/usr/local/etc/rc.d/strongswan onestop' returned exit code '1', the output was 'strongswan not running? (check /var/run/daemon-charon.pid).'

System is upgraded from stable to devel

Hello gentlemens/ladies, still newbie here.

Configuration:
* Removed all DNS by ISP and cleared all possible places, then i set DoT Quad9 in Unbound.
* DNSBL list - https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/master/doh-domains.txt
* DNSBL whitelist added dns.quad9.net
* DNSBL blacklist with checked NXDOMAIN option, then applied & restarted Unbound server.

Result:
* DOHs are blocked.

Okey, but when i try to open BraveBrowser and connect to internet website is blocked.
Then try to make NAT Port Forwarding rule for 53,853 and redirect to 127.0.0.1;53;853.
But again didn't worked and all websites was blocked.

Did i missed something, and is it possible or if not, maybe with one of these options?
* Suricata and RuleList,
* Firewall-Alias rule add (if list is domain names they are resolved to ip)
* Unbound Override
* Unbound RPZ - https://forum.netgate.com/topic/171887/unbound-dns-rpz/2
* SSL-Split - https://laskowski-tech.com/2020/03/29/opnsense-and-ssl-decryption-using-sslsplit/

( I'am thinking its way better to block on DNS level instead of rule ?)
( Also even if i manage to somehow bypass and get it working , Is it right that i'am just redirecting the request through quad9 and will still arrive at the doh server used by Brave in example ?

Video for information about "Best New" - loss of visibility by managed private networks : https://www.youtube.com/watch?v=04Wugl7yb-k [ Going Dark: catastrophic security and privacy losses...]

Excuse me!