Topics

1

Web Proxy Filtering and Caching / Urgent Prod system - OPNWAF + SURICATA Logs went full and Everything is blocked

« on: November 22, 2024, 08:55:49 am »

Dear OPNSense community,

we have a Business license, that's normally to receive a stable version after every update / upgrade, but it's not the case. Last Upgrade from the 24.4.3 to the version 24.10_7 (amd)
os-OPNWAF Version 1.6 - os-crowdsec 1.0.8_1 and Intrusion Detection is activated
After the upgrade the Logs from Suricata went full (and the disk too) -> Resource limit succeeded Service RootFs

Topology:
we have a bridge the firewall is in our DMZ behind the 1. HOP where there is an another router./firewall The OPNSense is there for his WAF / PROXY functions (OPNWAF / SURICATA / Crowdsec)

We have some Nextcloud and we are securing the traffic to Nextcloud with OPNSense.
Since the last upgrade the logs went full with Suricata. I've deleted some logs they were bigger than 100GB.

Now the Firewall is simply blocking the traffic from the Nextcloud to everything, event if I've made some rules like Nextcloud to everything with any ports.

All the services are green.

I cannot explain what is happen, but for a Business license, I think this version has a bug!

I've restarted already nothing is working and I don't where to beginning with this kind of Stuff. In the OPNWAF the logs won't show any problem. It seems to be a problem with the firewall!

example:
__timestamp__   2024-11-22T08:31:43
ack   3809070810
action    [block]
anchorname   
datalen   0
dir    [in]
dst   XX.X.XXX.XXX (OPNSense Firewall/PROXY)
dstport   48012
ecn   
id   4409
interface   bridge0
interface_name   BRG
ipflags   DF
ipversion   4
label   Default deny / state violation rule
length   52
offset   0
protoname   tcp
protonum   6
reason   match
rid   02f4bab031b57d1e30553ce08e0ec131
rulenr   4
seq   
src   XX.X.XXX.XXX (Nextcloud)
srcport   443
subrulenr   
tcpflags   A
tcpopts   
tos   0x0
ttl   64
urp   506

The worst I've change nothing. Everything is going wrong after the ugprade of the version 24.10_7

Could please help me

Thank you in advance!

Regards,

Joel.

2

General Discussion / OPNWAF / Web Application Business with Nextcloud - enabled we cannot upload

« on: September 11, 2024, 04:29:30 pm »

Dear OPNsense community,

We bought the 3-year package to have business capabilities on our firewall in our company. But as soon as we started configuring OPNWAF (Web Application) Business, it didn't work as expected. We can't upload any documents or photos, regardless of file size (error 413). Some nextcloud applications generate errors (such as “photos”, or we lose the ability to change profile status). On the firewall, in the Web Protection tab, I've configured Nextcloud-specific rule exclusions, but that doesn't seem to do anything...

We have found that there's is a limitation in the modsecurity on the OPNWAF. The info is in the Web Error Log.
ModSecurity: Request body no files data length is larger than the configured limit (131072).. Deny with code (413) [hostname "xxxxxxxxx"] [uri "/remote.php/dav/files/

The problem with this plugin is that we couldn't find any documentation of the plugin paths on the hard disk. We have no idea how to set up this plugin, and there's no way of changing anything in the user interface. That's sad for a Business tool.

If someone with experience on this plugin can explain to me where I can change the configured limit, I'd be very happy not loose my time with this kind of stuffs.

Thank you ahead.

Regards,

Joel. T

3

General Discussion / OPNWAF with Nextcloud, wildcard Letsencrypt only A rating in ssl labs

« on: August 14, 2024, 08:01:08 pm »

Dear community,

I've setup a web application firewall with OPNWAF (Business) and ACME Letsencrypt. It works well, but I cannot obtain on SSL Labs the A+ because there's an invalid HSTS policy.
I don't want to deploy the certificates on every Nextcloud and we are using the service ACME Client on the OPNsense firewall with a wildcard. Is there a possibility to setup Nextcloud and OPNWAF to act as reverse proxy to solve this problem? I would like that SSL Labs check the HSTS from the OPNWAF and not from the Nextcloud to keep the easy aspect of the self-signed on every system.
Is there any other possibility with OPNsense?
I've no clue anymore.

Thanks an advance for your help.

Regards,

Joel T.

4

German - Deutsch / Naxsi/Nginx Custom Rules funktionieren nicht

« on: February 08, 2024, 04:19:41 pm »

Liebe OPNSense Community,
wir haben für einen Webserver eine WAF in der OPNSense mit Nginx und Naxsi aufgesetzt.
Derzeit erstellen wir die Regeln hierfür.
Jedoch scheinen die Regeln nicht übernommen/angewendet zu werden.
Gibt es die Möglichkeit die Regeln auf der Maschine einzusehen (im Terminal)?
Unsere Regeln sind gleichermaßen geschrieben (in der Weboberfläche) wie die voreingestellten Regeln die bereitgestellt werden.
Ich würde mich um jede Unterstützung freuen!
Mit freundlichen Grüßen
T.B.

5

General Discussion / Someone could help please with the OPNWAF-Plugin

« on: July 19, 2023, 10:03:59 am »

Dear OPNSense community,
I'm missing some information about the OPNWAF-Plugin. It's not clear with the certificate management where NGINX + NAXSI it's clear and explained. When I try to activate this plugin the service doesn't start and the settings are the same with a functional NGNIX+NAXSI. The problem with NAXSI is that this block the Apple devices with Safari and without a disabling of a base Ruleset, it won't work. It's not really safe like that.

OPNWAF seems to be easier but it simply doesn't work with our certificates. (no let's encrypt here)
here some info from the log: pass request body failed, AH00898: Error during SSL Handshake with remote server
The Set-UP is simple: Der HTTPS Port für den Virtual Server is not standard, SSL Proxy check peer is enable and the URI matches the CN, the certificate field in the Virtual Server is the same as in HTTP Server from NGNIX in the field TLS Certificate. The Location>Remote destinations in OPNWAF is the https://XX.XX.XX.XX (X = IP) of our Webserver.
With the same certificate-setting with NGNIX + NAXSI it will work, that's why I don't understand.

I hope with these information you can help me.

I was thinking that with the business license it would be easier for us.

Thank you ahead.

Joel T.

6

General Discussion / Rspamd MX Check Expiration not applying

« on: August 30, 2022, 10:30:15 am »

Hello there,
when we set a Expiration in the MX Check Option of Rspamd in our OPNSense, and click Apply and afterwards switch to another Register the parameter is not applied and the field is empty.
Could this be a communication problem between Rspamd and Redis?
We would hope to find a solution so we can set this parameter.
Thanks in advance
T. Beyer

7

High availability / High availability with rspamd - no synchronization

« on: August 26, 2022, 02:38:01 pm »

Hi there,
we currently have two new opnsense DEC3860 with the enterprise edition which we want to use as e-mail appliance.
We implemented rspamd in High availability with the help of this documentation:
https://docs.opnsense.org/development/backend/legacy.html#xmlrpc-ha-sync
(the same goes for clamav and redis)
We manually set the synchronization for rspamd.
Most plugins we can use in high availability, but with rspamd we cant get a synchronization.
We really need this synchronization since we use it for a failover.
If someone has any idea, why it isnt synchronizing then please share your experience with us.
Thanks in Advance
WAG Admin

8

High availability / [SOLVED] about the automatic replication Cron Job (website)

« on: August 11, 2022, 10:49:06 am »

Dear community,

we are new in the world of Opnsense and Deciso Firewall appliances.
We have two DEC3860 (22.4.2), we have configured the both in failover, even with the Cron Job HA update and reconfigure backup to sync automatically. But it doesn't work.
We've tried to understand the meaning of the note about the automatic replication:
https://docs.opnsense.org/manual/hacarp.html
To prevent a non functional primary machine updating the active master, the HA update and reconfigure backup will only execute if all carp interfaces are in MASTER mode.

As it's for us really new technologies, could you please say to us how we can configure all interfaces in Master mode? because it's not explicit in the help.

Thank you ahead.

Joel T.