Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Topics - stif

#1
General Discussion / How to use API with payload
April 25, 2024, 05:30:59 PM
Hi folks,
I am able to use the API in order to fetch information, but i am failing to add new items and i think my problem is how to add the payload to POST requests..

Here is my Code, wich just gets a `{'result': 'failed'}` back, but i have no idea why it fails. do i need another Content-Type Header?

import requests
import json
from requests.auth import HTTPBasicAuth
import os

# OPNsense API
#https://opnsense.local/api/<module>/<controller>/<command>/[<param1>/[<param2>/...]]

# Globale Konfiguration

API_KEY = os.getenv('API_KEY')
API_SECRET = os.getenv('API_SECRET')
OPNSENSE_URL = "https://10.1.1.11:8443"

INIT_DATA = {
    'vlan': {
        "vlanTag": "211",
        "interface": "lagg0",
        "description": "newVLAN"
    }
}

def send_request(url, data=None, method='POST'):
    headers = {}
    auth = HTTPBasicAuth(API_KEY, API_SECRET)
    verify_ssl = False  # Für Produktionscode sollten Sie SSL-Zertifikatsprüfung aktivieren

    if method in ['POST', 'PUT', 'PATCH']:
        headers['Content-Type'] = 'application/xml'
        response = requests.post(url, headers=headers, data=json.dumps(data), auth=auth, verify=verify_ssl)
    else:
        response = requests.get(url, headers=headers, auth=auth, verify=verify_ssl)

    if response.ok:
        return response.json()
    else:
        response.raise_for_status()

def add_vlan(vlan_data):
    """Adds a new VLAN."""
    url = f"{OPNSENSE_URL}/api/interfaces/vlan_settings/addItem"
   
    # Erstellen der XML-Payload mit den übergebenen Werten
    xml_payload = f"""
    <vlan>
        <if>{vlan_data['interface']}</if>
        <tag>{vlan_data['vlanTag']}</tag>
        <pcp>0</pcp>
        <proto></proto>
        <descr>{vlan_data['description']}</descr>
        <vlanif>vlan0{vlan_data['vlanTag']}</vlanif>
    </vlan>
    """
    print(xml_payload)
    # Senden des Requests mit der XML-Payload
    response = send_request(url, xml_payload)
    return response

# Main function to organize operations
def main():
    response = add_vlan(INIT_DATA['vlan'])
    print (response)

if __name__ == "__main__":
    main()
#2
Hi Folks,

I had a project where i needed over 80 VLANs and CARP IPs and all the corresponding things like DHCP, manual NAT rules, Firewall Rules and Radius Users.

Since i did not want to create all of it via WebUI, i had another idea: i created a backup config.xml file via WebUI, injected all the VLANs etc by processing the config.xml with some python scripts, and then imported the config.xml file again. Works!

If you have similar plans, you might find my collection of scripts useful, so i created a github repo:
https://github.com/nett-media/opnsense-config-generator

Cheers,
Stif
#3
Hi folks,

I enabled the freeradius plugin and use WPA2 Enterprise to authenticate the WLAN users (this is already working).
With some Printers and IoT Devices i have no possibility to enter credentials, so i would like get them into the right vlan via MAC Address "authentication".

Accourding to https://forum.opnsense.org/index.php?topic=16282.msg74418#msg74418 i just need to create a User and Password with the MAC Adress of the Device.
The thing is: i get a "text validation error" when entering a MAC Adress as user/password..

Wow can i assign the right vlan to these printers and IoT devices?

Thanks,
#4
Hello Guys,

I need some advise regarding Firewall Hardware:

I am looking for a new firewall in a HA setup for approx. 200 Users.
It should be able to handle a 10Gbit backbone network and do some IDS/IPS as well as maybe 10+ simultan IPsec VPN Connections.
Here is a picture of the planned topology .
Since the firewall should also be able to utilize a future 10Gbit uplink, at least 3x 10Gbit SFP+ Interfaces should be possible (eg with extension cards).

I am not aware if upgrading the DEC3850 with more 10Gbit Interfaces is possible, but i guess it is not..

My first idea was to buy two Netgate D1537 as i am a long time pfSense User. But then i found out the CPU is already 8 years old and so i started to look around some alternatives.

This C3958 Platform for example has 4x 10Gbit Interfaces, but only a CPU Mark of 4281 which is maybe not beefy enough for IDS/IPS, what do you think?

The Xeon D-1700 CPUs, like on the Supermicro SYS-510D-8C-FN6P, are more power hungry than the D1500, and the SFP28 ports are not supported with pfsense 2.6 i read somewhere (this way i came across OPNsense)
And as far as i understand, the D17xxNT CPUs support Intels Quick Assist (QAT), which is mainly useful for faster VPN bandwidth, correct?
And since VPN is not our main goal, it is maybe also feasible to use a cheaper model without QAT, like the Supermicro SYS-510D-4C-FN6P with a D-1718T CPU?

I created a list of features with the Hardware from the tile for comparison, but i still dont know which hardware i should buy..

Another Question: is it possible to buy a Desico Support for the mentioned hardware?

Any insights to my questions would be highly appreciated,
Kind Regards,
Stif