Topics

What I tried as a backup recovery plan is to use a drive that's the same size as the one in the firewall in a usb adapter and have zfs mirror the install partion onto the usb drive.

The usb drive has a clean install of OPNsense with zfs and that's it.

Plug the usb drive into the firewall and do the following

# gpart show
=>        40  2000409184  ada0  GPT  (954G)
          40      532480     1  efi  (260M)
      532520        1024     2  freebsd-boot  (512K)
      533544         984        - free -  (492K)
      534528    16777216     3  freebsd-swap  (8.0G)
    17311744  1983096832     4  freebsd-zfs  (946G)
  2000408576         648        - free -  (324K)

=>        40  2000409184  da0  GPT  (954G)
          40      532480    1  efi  (260M)
      532520        1024    2  freebsd-boot  (512K)
      533544         984       - free -  (492K)
      534528    16777216    3  freebsd-swap  (8.0G)
    17311744  1983096832    4  freebsd-zfs  (946G)
  2000408576         648       - free -  (324K)

The usb drive is da0 and partition 4 is the clean install of OPNsense.

# gpart delete -i 4 da0
# gpart add -i 4 -a 1m -t freebsd-zfs da0

Then attach the new partition. (had to use -f since it complains that /dev/da0p4 is part of potentially active pool 'zroot' from the clean install,
if the usb drive is from a prior attach then issue # zpool labelclear -f /dev/da0p4)

# zpool attach -f zroot ada0p4 da0p4

Let it resilver then shutdown and unplug the usb drive and power the firewall back up and detach the now missing usb drive.

# zpool detach zroot da0p4

After this verify the usb drive works by booting off of the usb drive in a test system. If you don't have a test system you will need to temporaraly disconnect the drive in the firewall in order to boot off the usb drive.

To clean up the cloned drive in the usb adapter.

# zpool detach zroot ada0p4

Login through the web interface and verify everything looks good.

If the drive in the firewall goes I can boot off the usb drive untill I get around to replacing the failed drive.
If the hardware goes I have a drive in the usb adapter I can use in a new firewall to get back up and running.

...and this works for me, YMMV.

On a system that has been running just fine with 24.7 and 25.1 prior to the latest update.

I applied the latest updates and it throws an error when booting now:

CPU0:<ACPI CPU> on acpi0

The system uses DDR5 so it's relatively new hardware.

I reinstalled 25.1 and applied the update with the same result.

Also tried installing the latest FreeBSD on this system and applied updates and it boots fine.

Any hint at how I could track this issue down?

I'm going to try installing 25.1 and apply the updates on a different system and see what happens.

8  )

What protocols, ports and ip addresses do I need to allow on an upstream edge firewall that blocks all outbound traffic unless a specific rule allows it?

So far I've identified UDP 5355 and ICMP to any of these IP addresses:

104.155.129.221
104.198.6.78
34.74.12.235
35.198.172.108
34.65.117.157
34.92.15.156
35.244.50.89
35.189.37.160

Greetings,

I was following Zenarmor instructions to setup proxy. https://www.zenarmor.com/docs/network-security-tutorials/how-to-set-up-caching-proxy-in-opnsense#3-enable-transparent-http-and-ssl-mode and I noticed "Add a new firewall rule".

Well, that didn't go so well, 80/443 access blocked now. I tried to remove those two rules and that hosed the system.

I've put the system aside until I can look at it in depth so it's not a priority. What I was wondering is if anyone else tried those links to add rules and have them work?

Thanks.

New to OPNsense here.

Is there a howto on configuring web GUI access on only LAN segment? Following any of the search results and docs do not work as expected.

On the actual OPNsense system using the diagnostics DNS lookup I get the LAN IP only which is what I want to see returned on any system on the LAN segment. (Do not register system A/AAAA records checked)

Issuing "dig <opnsense fqdn>" on any system on the LAN segment returns all Internal IPs?


For now I've brute forced it in the hosts file on all the systems, there has to be a better way.

Any pointers?

Thanks!