Topics

Hi all,

I'm actually not sure if this is expected hence the question here:

I have created a new Letsencrypt certificate with the key-length ec-384. Before I always used RSA-4096.
The older certificates have been listed with the type "Server Certificate". The new one is listed as "Client Certificate".

Hope the picture will help to understand my point.

Let me know if you need more information. Also happy to file a ticket on github if wanted.

Best regards
Tmmmi

Hi all,

I have updated our OPNsense to 26.1.2 yesterday.
Today it went into a crash and a automatic reboot.

I would like to share the crash report but there are some sensitive information inside that dump.
So would like to understand who will have access to the information which are shared via the report function.

In any case I would like to understand why the crash / reboot happened.

Code Select Expand

db:0:kdb.enter.default>  bt
Tracing pid 0 tid 100229 td 0xfffff800020e8740
kdb_enter() at kdb_enter+0x33/frame 0xfffffe0035f40e00
panic() at panic+0x43/frame 0xfffffe0035f40e60
dblfault_handler() at dblfault_handler+0x1ce/frame 0xfffffe0035f40f20
Xdblfault() at Xdblfault+0xd7/frame 0xfffffe0035f40f20
--- trap 0x17, rip = 0xffffffff80fbaaa9, rsp = 0xfffffe0106df0fd0, rbp = 0xfffffe0106df10a0 ---
AES_GCM_decrypt() at AES_GCM_decrypt+0x1959/frame 0xfffffe0106df10a0
aesni_cipher_crypt() at aesni_cipher_crypt+0x30f/frame 0xfffffe0106df1170
aesni_process() at aesni_process+0xc6/frame 0xfffffe0106df11a0
crypto_dispatch_one() at crypto_dispatch_one+0xde/frame 0xfffffe0106df11c0
ovpn_udp_input() at ovpn_udp_input+0x492/frame 0xfffffe0106df1270
udp_append() at udp_append+0x67/frame 0xfffffe0106df12f0
udp_input() at udp_input+0x8bb/frame 0xfffffe0106df13e0
ip_input() at ip_input+0x26f/frame 0xfffffe0106df1440
netisr_dispatch_src() at netisr_dispatch_src+0x9f/frame 0xfffffe0106df1490
ovpn_finish_rx() at ovpn_finish_rx+0x405/frame 0xfffffe0106df14e0
ovpn_decrypt_rx_cb() at ovpn_decrypt_rx_cb+0x1a1/frame 0xfffffe0106df1590
aesni_process() at aesni_process+0xea/frame 0xfffffe0106df15c0
crypto_dispatch_one() at crypto_dispatch_one+0xde/frame 0xfffffe0106df15e0
ovpn_udp_input() at ovpn_udp_input+0x492/frame 0xfffffe0106df1690
From the backtrace it looks like that something in OpenVPN got messed up.
Could it be that the OpenVPN daemon did not get restarted after the update?
I'm using DCO so maybe the kernel driver and the binary did not match.
It is just an idea.

Best regards
Timmi

Hi all,

just starting to enjoy the nginx plugin.
Currently performing some tests with one sample web app.
I also configured a remote syslog target but I'm only receiving the access log.
What about the error log?

Is this a bug or do I miss some configuration?

Best regards
Timmi

Hi All,

since a few weeks I noticed that the Crowdsec daemon is stopping / crashing at 1am (which should be UTC midnight).
I don't see anything in the crowdsec logs.

I'm not sure if this is happening since OPNsense 24 or if my IPv6 changes added additional load on the server. I would say the LAPI server is gone as I can see that the bounce is still trying to communicate.

Could it be that the local LAPI server is at the capacity limit?
Service is looking normal after starting it again.

Thank for your help
Timmi

Hi all,

please note that I'm currently trying to enable IPv6 on my OPNsense.

I received a IPv6 /48 and a GW from my ISP.

GW is ::0000::1
OPNSense is ::0000:2/64

The OPNsense is able to reach services in the Internet via IPv6.

I have create add static IPv6 to an existing interface.
OPNSense is ::0001:1/64
client is ::0001:546f:78ff:fe58:21/64 via SLAAC

The client is able to reach the OPNsense via ::0001:1 but I'm not able to reach something in the internet nor the GW of the ISP (::0000::1).

WAN Interface:
IPv6:  ::0000:2/64
GW: ::0000::1
Router Advertisements: Router Only

LAN Interface
IPv6: :0001:1/64
GW: auto
Router Advertisements: Unmanaged
Advertise Default Gateway: true

For me it looks like that this is not getting answered:

19:56:30.191565 IP6 fe80::21f:9eff:feff:2f41 > ff02::1:ff58:21: ICMP6, neighbor solicitation, who has ::0001:546f:78ff:fe58:21, length 32

I guess this is what I'm missing?

Note that you need to create and set a gateway address for this mode to connect to your next gateway hop which your ISP should provide to you as well.

from https://docs.opnsense.org/manual/ipv6.html#static-ipv6

But I don't understand what is needed.

Would be great if you could give me any point to look into.

Thank you

Hi all,

not sure if I missed something but I'm not able to find these multi select switches on the log files anymore.
Is this a bug or wanted?

Any possibility so select all severities now?

Best regards
Timmi

Hi community,

I'm looking for a possibility to get the crowdsec log forwarded to my central logging platform.

I already opened a ticket to enhance it as the log file is currently not available in the selection.
https://github.com/opnsense/plugins/issues/3666

Just wondering if there is maybe a workaround until this might be enhanced inside the GUI.

Best regards
Timmi

Hi guys,

I'm currently trying to reduce the amount of DNS requests hitting my OPNsense (Unbound).
All my networks are IPv4 based.

The client is caching IPv4 IPs correctly but still requests IPv6 IPs for the host name.
I guess the answer from the OPNsense does not keep him happy to he is requesting the IPv6 IP again next time.
Means I'm seeing only AAAA requests from that client.

Happy to get your ideas.

Best regards and thank you
Timmi

Hi OPNsense,

I'm looking into the migration of my IPsec configuration to the new IPsec Connection interface.

Tunnel connection looks OK but I don't get any traffic through it. I remembered that the "Tunnel Isolation" was required in the past but I don't find a way to configure this on the new interface.

Any advice?

Best regards
Christoph

Hi,

I'm registering DHCP host names to the Unbound daemon to be able to resolve the host via their dhcp name.

Since the update to 23.1.7 I notice that I can see that the new dhcp names inside the leases but there are not able to get resolved by the unbound daemon.
A restart of Unbound is solving the issue.

Should I create a ticket in github directly or would this forum be sufficient?

Best regards
Christoph

Hi Community,

another question for my new setup.

I'm using Reflection for 1:1 for my external services which is working as expected.
But it is not working for the users which are connecting through OpenVPN and which are redirecting all traffic into the tunnel.

I was not able to find a corresponding setting on the OpenVPN server not how to configure a rule or similar for that.

Any good advice?

Best regards and thank you
Christoph

Hi OPNsense community,

I have configured a OPNsense with multiple IP interfaces.
Per default the unbound is responding with all IPs if I lookup for the hostname.

It is possible to configure that the the response is only for the IP of the subnet the request is coming from?

Example:
Host: 192.168.100.100
OPNsense: 192.168.100.1

Hostname should only resolve the 192.168.100.1 and not also the external or other internal interfaces.

Hope someone is able to help.

Thanks in advance
Christoph