Topics

Good Day Community !!!!
If I am writing or asking question then the issue pretty sure is close to bug state. I am building networks over 18 years, for me create VTI set is normally takes between 15 to 20 min max, include FRR eBGP.
I ran into issue where latest version OPNsense 26.7.2_2-amd64 FreeBSD 15.1-RELEASE-p2, VTI is not passing any traffic. All traffic 0 in or out in bytes.
Tunnel is in state ESTABLISHED and no retransmissions.
That state before firewall where are I don't see any traffic on tcpdump enc0 interface.
I see that in opnsense bind VTI interface to loopback, but nothing is routed through.


Any hint what else I can check. Really appreciate on hard work of all people who keeping lights on !!!

root@fw01:~ # swanctl --list-sas
no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'
da254f91-ea8e-49ef-b1ba-c1727fa06ec9: #10, ESTABLISHED, IKEv2, e1c7516a937db119_i 30276a85361654fa_r*
  local  'local pub ip' @ local pub ip[500]
  remote 'remote pub ip' @ remote pub ip[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_384/MODP_2048
  established 2319s ago, rekeying in 11528s
  a9d737db-caa5-46a3-abd7-23b4a655c683: #8, reqid 10, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 2319s ago, rekeying in 966s, expires in 1641s
    in  c46dd99b,      0 bytes,     0 packets
    out c56e5526,      0 bytes,     0 packets
    local  0.0.0.0/0
    remote 0.0.0.0/0
bf665be7-7931-4993-9c03-50d54c1f5c6a: #13, ESTABLISHED, IKEv2, b4c20eab1d170db2_i 7e733c1ad763743a_r*
  local  'local pub ip' @ local pub ip[500]
  remote 'remote pub ip' @ remote pub ip[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_521
  established 988s ago, rekeying in 13095s
  2c9e658d-075b-478d-832e-118dfc95d592: #11, reqid 20, INSTALLED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128
    installed 988s ago, rekeying in 2397s, expires in 2972s
    in  c93e99c6,      0 bytes,     0 packets
    out c9a00496,      0 bytes,     0 packets
    local  0.0.0.0/0
    remote 0.0.0.0/0
root@fw01:~ # 

ipsec10: flags=1008051<UP,POINTOPOINT,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1400
        description: IPSECVTI1 (ipsec10)
        options=0
        tunnel inet local pub ip --> remote pub ip
        inet 10.0.31.1 --> 10.0.31.2 netmask 0xfffffffc
        groups: ipsec
        reqid: 10
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

ipsec20: flags=1008051<UP,POINTOPOINT,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1400
        options=0
        tunnel inet local pub ip --> remote pub ip
        inet 192.41.100.1 --> 192.41.100.2 netmask 0xfffffffc
        groups: ipsec
        reqid: 20
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

As side not, please add some warning that will be good visual when "Policies" check mark is set.

Hello Everyone,
I am using haproxy plugin and can't started, based on shell debug limit has wrong arguments  to start haproxy proxy

Code Select Expand


+ _cd=''
+ _doit='/usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pid '
+ [ -n '' ]
+ [ -n '' ]
+ [ -n '' ]
+ _doit=' limits -C daemon  /usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pid '
+ _run_rc_doit ' limits -C daemon  /usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pid '
+ debug 'run_rc_command: doit:  limits -C daemon  /usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pid '
+ eval ' limits -C daemon  /usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pid '
+ limits -C daemon /usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pid
+ _return=1
+ [ 1 -ne 0 ]
+ [ -z '' ]
+ return 1
+ warn 'failed to start haproxy'
+ [ -x /usr/bin/logger ]
+ logger '/usr/local/etc/rc.d/haproxy: WARNING: failed to start haproxy'
+ echo '/usr/local/etc/rc.d/haproxy: WARNING: failed to start haproxy'
/usr/local/etc/rc.d/haproxy: WARNING: failed to start haproxy
+ return 1
root@fw01:~ # usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pidusr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haprox
usr/local/sbin/haproxy: Command not found.
root@fw01:~ # limit -c daemon /usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pid
limit: Too many arguments.
root@fw01:~ # limit -C daemon /usr/local/sbin/haproxy -q -f /usr/local/etc/haproxy.conf -p /var/run/haproxy.pid
limit: Too many arguments.



Hello Everyone,
After upgrade IPsec vpn route based is not coming up properly or going down all the time.

I tried set Opnsense side as responder, but didn't made any difference.

Version 22.7

Ipsec  Version

strongswan   5.9.9_1

In log

Code Select Expand


14[KNL] received invalid PF_ROUTE message


Hello Everyone,
On latest update FRR package BGP section unable write any change to disk.
Getting errors

Code Select Expand


2022-10-04T13:56:18-04:00 Notice frr_carp FRR received carp configuration event.
2022-10-04T13:56:18-04:00 Error bgpd [EC 100663299] buffer_flush_available: write error on fd 2: Bad file descriptor


Any help thank you.
volga629