Topics

My Firewall rules with alias is not working.
This is what I am getting:

Code Select Expand


2023-07-06T15:15:03 Error firewall alias resolve error Group_30_IPs (error fetching alias url 10.0.30.53)
2023-07-06T15:15:03 Error firewall error fetching alias url 10.0.30.53
2023-07-06T13:04:30 Error firewall alias resolve error Group_20_IPs (error fetching alias url 10.0.20.51:55)
2023-07-06T13:04:30 Error firewall error fetching alias url 10.0.20.51:55


- VLAN 30 I am using DNSmasq,
- VLAN 20 I am using Unbound.
- Running Opnsense Version 23.1.11   


Otherwise I specifically have to type in every IP address as a "Single host" in the firewall rules for VLAN 30 for it to work. That's a lot of firewall rules...

[How can I preconfigured the box AND connect it to the internet, while not replacing my existing router?]

I want to preconfigure the OPNsense router first, without replacing my main router at the moment while I work on it. And I would like to go have internet access. 

On the WAN interface:
- have already unchecked block Private Networks.
- have checked allow DNS/PP to be overridden by WAN (or smthg along those lines)

On my WAN port, I get assigned an IP address (192.168.1.30) from my existing router, but I can't access the internet.

How can I preconfigured the box AND connect it to the internet, while not replacing my existing router?

Is it possible to have 2 VLANs (55&66) use Unbound DNS though a VPN Gateway, AND have another 2 VLANs (77&88) use Unbound DNS but through the WAN as normal?

How do I set this up? via FW rules or via the Unbound settings page?
(I could only find listen interfaces on the Unbound settings page, with a place to specify the gateway)

Is it possible to add the admin lan, and therefore the gui access to the router (https://192.168.1.1) to a lag (e.g. lagg0)?

Because when Lagg is being setup, most of us are looking at the gui right? So how can I add the LAN that I am literally accessing now to use the GUI as it cannot be deleted? The firewall admin GUI LAN interface is already assigned... it cannot be re-assigned to lagg0 unless deleted, if I delete then the GUI I'm on disappears... is there a way?

Also when I used the CLI on initial startup to create a lagg I assigned:
eth0 --> WAN
eth1, eth2 --> lagg0
eth3 --> OPT1
lagg0 --> LAN

but when I connected my cable to the eth1 port, I could not reach the LAN via https://192.168.1.1 at all. I wonder if this is because I cannot connect BOTH 2 cables to eth1 & eth2 ?

I thought if I can just connect one cable to eth1 it should be fine, I can still access the firewall

[If unbound is now the DNS resolver in 23.1, do Firewall rules need to be made, or are they already made by OPnsense by default?A lot of the guides I am reading adds firewall rules to redirect dns requests to internal DNS (127.0.0.1) but I gather this was before the Unbound was the default resolver?]

If unbound is now the DNS resolver in 23.1, do Firewall rules need to be made, or are they already made by OPnsense by default?

A lot of the guides I am reading adds firewall rules to redirect dns requests to internal DNS (127.0.0.1) but I gather this was before the Unbound was the default resolver?

Also, is this the correct way to think about the DNS processing order/hierarchy in OPNsense?
The most overriding one being on the left hand side.



If not, what changes should be made?

Part A: I would like 2 VLANs (VLAN 1 & VLAN 2) to use OPNsense's own Unbound. VLAN 1&2 are using a VPN gateway. 
Part B: I would like 2 other non-VPN VLANs (VLAN 3 & VLAN 4) to use another external DNS, for example, Cloudflare. Or whatever is set on the client's device.

I would also like optionally in both Part A & B if any of the clients set its own DNS on their device, for that external DNS to be honoured. If it is not possible in Part A, then definitely in Part B.

Can anyone point me in the right direction to do this?

[uncheck]

Sorry couldn't google foo find an answer anywhere...

For OpenVPN & Wireguard, what if the connection fails or stops (for any reason), is there any auto reconnect feature in OPNsense?

Is it possible to create a monit script that is called when pings fail, that will restart the VPN connections?

Btw, I have in System: Gateways: Single, in each interface:
- Disable Gateway Monitoring -- uncheck

[still]

I have 2 VLANs routed through Wireguard & OpenVPN connection to a VPN provider. But now all other non-VPN VLANs now don't have internet access anymore. I want internet access.

I've basically followed the Wireguard Selective routing Guide to T!

Confusing! I don't think in the firewall rules for each non-VPN VLAN, I need to specify the WAN gateway do I? Well, I've done it anyway, and even for the non-VPN VLANs, there is *still* no internet access.

Sorry I'm new here, I don't know if people post configs or whatever. This is what I've done so far.

I have:
- Created a FW rule in the FW Group with VLAN_20 + VLAN_30 called FGVPN_VLANS. These are to be routed through the VPN
- Created a Gateway Group called GG_VPN_Gateways with WRGD as Tier 1, OVPM as Tier 2

- Created a FW rule in the FW Group that is:
Interface: FGVPN_VLANS
direction: in
Source: FGVPN_VLANS
Destination invert: checked
Destination: RFC1918_Networks
Gateway: GG_VPN_Gateways
Tag: NO_WAN_EGRESS

- Created NAT Outbound rule:
Interface: GGVPN_Gateway
TCP/IP: IPv4
Protocol: any
Source: FGVPN_VLANs net
Destination: any


- DNS
Settings: General no DNS listed (so it's blank)

- Fixed DNS leaks
In Services → DNS Resolver
Network Interfaces Interfaces: LAN, VLAN_20,  VLAN_30
Outgoing Network Interfaces: OVPN, WRGD (both checked)

Is there something I need to do or check?