Topics

Hi all,

I incorrectly posted this in 25.1 section and so am hoping someone might see it here who can assist.

I can configure OPNSense for Tailscale using the new plug and is working as expected.
Ether configured as an exit node or to expose whatever is behind it via subnet router option works etc etc.

Massive shout out to Sheridan Computers for writing the plugin too.
https://www.youtube.com/watch?v=VD2oMin_V3M is what I followed along to.

I have a linode linux VPS box already configured as a TS exit point which has been working nicely for a while now, but only being used by a single client behind the OPNSense router.
I would like to "transfer" from a single client using the exit point to my OPNSense router to use the Linode/Tailscale exit point.

So, I don't think the plugin is mature enough for this, but am curious if anyone has done this prior to the plugin release via the command line and are willing to share their success?

There's chatter around having two wan connections:
https://forum.opnsense.org/index.php?topic=36817.msg204377#msg204377

or

modifying outbound NAT with the additional of FW rules
https://forum.opnsense.org/index.php?topic=45530.msg227721#msg227721

but both haven't succeeded.

And so am wondering if anyone has successfully done this and are willing to share.

ta

Hi all,

I can configure OPNSense for Tailscale perfectly fine.
Can also configure as an exit node or to expose whatever is behind it via subnet router option.

Massive shout out to Sheridan Computers for writing the plugin too.
https://www.youtube.com/watch?v=VD2oMin_V3M is what I followed along to.

I have a linode linux already configured as an exit point which has been working nicely for a while now, but only with a single client.
I would like to "transfer" my entire home setup to use this exit point now.

So, I don't think the plugin is mature enough for this, but am curious if anyone has done this prior to the plugin release and are willing to share their success?

There's chatter around having two wan connections:
https://forum.opnsense.org/index.php?topic=36817.msg204377#msg204377

or

modifying outbound NAT with the additional of FW rules
https://forum.opnsense.org/index.php?topic=45530.msg227721#msg227721

but both haven't succeeded.

And so am wondering if anyone has successfully done this and are willing to share.

ta.

Hello,


Am new to OPNSense (and also UniFi hardware) and have been learning a lot when it comes to bridges, vlan networks, physical networks and vlans bridged with physical networks.



Anyway, it has been fun to tinker, reset, tinker again, reset again and have now come to the point of asking for advice before I continue.
I've attached a PNG of my ideal setup and I'm getting stuck on the management side of things.


What I'm seeing is that if I include the physical ports in the MGMT bridge, the U6Pro WAPs can no longer issue respective IP addresses for any of the vlans/SSIDs. Clients connect to the SSID, give up and self assign. Attempting to statically assign an IP address does not work either and so there is no route/plumbing for any of the vlans back to the OPNSense router.


What I don't understand though, is that I'm able to ping both WAPS (192.168.1.249 & 192.168.1.251) from the Mac Mini, they just don't seem to parse the VLANs onto any WiFi clients. Any endpoint directly patched into the router (TV, MacMini, AppleTV etc etc) all work fine, and so this tells me that the vlans are not able to extend past/through the flex mini switches for some reason?


If I remove the physical ports from the MGMT vlan, everything works!
WiFi devices receive the correct IP on the respective SSID and able to route out to internet fine.


But


All UniFi hardware is no longer able to talk to the controller (192.168.1.1) and the UniFi controller shows them all as offline. They're clearly working though.


And so here I am with the situation of either a), having a working network with no way to manage the UniFi hardware.
Or
b), a broken network where the Waps don't see the vlans and thus don't assign IPs, but I can see all the UniFi hardware in the Controller.


I hope the above makes sense.

Because the Flex Mini switches are somewhat less configurable, I was wanting to use the Primary VLAN ID 1 to manage all the UniFi hardware. The reason for this is that using VLAN ID 1 enables me to choose ports on the Flex Mini switches to be individually tagged or not.
If I choose not to use the primary VLAN ID 1 and use a different VLAN to manage all the UniFi hardware, I loose this ability and can only allow all Vlans or only Allow none per port which will deny me tagging ports as IPCAM vlan and IoT vlan only for endpoint devices.


The reason for using bridges with OPNSense in the first place was to save some money on having to purchase another 10Gb switch. After tinkering with this setup, I'm not honestly sure if this will even make a difference with respect to the issue I'm seeing, because note that ix0 is running out to the shed (to a UniFi switch), and also igb0 is running to the rest of the house (i.e. another UniFi switch).
The OPNSense Router is in the living room behaving as another 10Gb switch.
The router is  a PC with:
Intel i5 7500 @3.40GHz
16GB RAM
ZFS Mirror SSD Boot
1 x 1GB onboard (em0) onboard
4 x 1GB Intel PCIe (igb)
2 x 10GB Intel PCIe (ix)
2 x 10GB SFP+ Chelsio PCIe  (cxgb) ← yet to install


As for firewalls, every bridge is "wide open", in that I've created a rule that says pass on each bridge interface while setting this up:

Code Select Expand


Action: Pass
Interface: Bridge_xyz
Direction: In
TCP/IP: IPv4
Protocol: Any
Source: Any
Destination/Invert: unchecked
Destination: Any


No firewall rules exist nor ip addresses assigned to any vlan or physical interfaces. (i.e. all done on the bridges)
The LAN interface is not presently assigned to anything (it was on interface re0 and assigned)
No IPv6 configured.


Well, I think that is everything, everything that I can think of in terms of information for anyone to explain to me what I'm doing wrong with the MGMT bridge.
All the other bridges work wonderfully well with vlans and physical networks ports and so I'm just not sure why I'm seeing the issue I'm seeing.
I'm fairly sure it's got something to do with how UniFi uses that VLAN ID 1 as I understand it to be somewhat a unique approach compared to other smart switches.


Anyway, if anyone is able to assist, I'd be very grateful to learn more. ;)


(updated: changed attachment to vector so is clearer to read)

Hi
Anyone else using vlans and bridges and have successfully got unifi installed via mimugmail plugin?

I had it working fine with 24.1 but only had LAN and WAN setup and so no vlans/bridges setup.
It was time to segregate my network and so given mimugmail has green-lighted compatibility for 24.7, I gave it a go and divided up my network into 5 vlans, but also wanted to use bridges to take advantage for spare ports in the router. ← Another Unifi 10GB switch isn't exactly cheap for home use.

I've since erased my router boot SSD, started fresh with 24.7 install, and configured the vlans/bridges from scratch in case there was something going on in the upgrade. (turns out: both upgrading and setting up from scratch yielded the same outcome, hence I'm asking for bigger brains).

I've installed unifi and the logs show it running, but I'm not able to get to the web interface on 8080 on any IP address for setup.

Here's my router setup in an old HPTC Antec case:

Code Select Expand

Gigabyte B250M-D3H Motherboard Micro ATX
   i5-7500 CPU @ 3.40GHz
   16GB RAM
   256GB SATA SSD Boot
    4 PCIe network adapters installed (ordered from CPU outwards)
       1 x Chelsio 2 x 10GB copper
       1 x Intel 2 x 1GB copper
       1 x Intel 2 x 1GB copper
       1 x Chelsio 2 x 10GB Fibre

I have 5 vlans:

Code Select Expand

192.1680.140.0/24 ← untagged/mgmt (LAN)
192.1680.141.0/24 ← IoT
192.1680.142.0/24 ← Guest
192.1680.143.0/24 ← Neighbours
192.1680.144.0/24 ← IPCAM
192.1680.145.0/24 ← Raywood/Trusted

and because I'm using the 10GB and 1GB spare copper ports in the router instead of buying another 10Gb switch, here is what the interfaces look like after creating two bridges:

Code Select Expand

Intertaces
[Bridged_141_grpl]
  [em0_opt4]
  [em1_opt5]
  [em2_opt6]
  [em3_opt7]
  [vlan141_ix0_opt8]
[Bridged_145_grp2]
  [ix1_opt1]
  [vlan145_ix0_opt12]
[Bridge_141]
[Bridge_145]
[cxl0_opt2]
[cxll_opt3]
[em4_WAN]
[ixo_MGMT]
[vlan142_ixO_opt9]
[vlan143_ixo__opt10]
[Vlan144_ix0_opt11]


Bridges are:

Code Select Expand

bridge0 em0_opt4, em1_opt5, em2_opt6, em3_opt7, vlan141_ix0_opt8
bridge1 ix1_opt1, vlan145_ix0_opt12



Installing unifi via gui seems to go smoothly.
looking at /usr/local/share/java/unifi/logs/server.log, here's what I see:

Code Select Expand

[2024-07-28 00:06:33,945] <launcher> INFO  startup - Initiating startup
[2024-07-28 00:06:34,435] <launcher> INFO  system - ======================================================================
[2024-07-28 00:06:34,435] <launcher> INFO  system - UniFi 8.2.93 (build atag_8.2.93_25939 - release/release) is started
[2024-07-28 00:06:34,436] <launcher> INFO  system - Environment: UniFi-OS[false], UniFi-Cloud[false], UniFi-MongoService[false]
[2024-07-28 00:06:34,436] <launcher> INFO  system - ======================================================================
[2024-07-28 00:06:34,436] <launcher> INFO  system - BASE dir:/usr/local/share/java/unifi
[2024-07-28 00:06:34,442] <launcher> INFO  system - Current System IP: 192.168.145.1
[2024-07-28 00:06:34,442] <launcher> INFO  system - Hostname: router.hoondi.io
[2024-07-28 00:06:34,443] <launcher> INFO  system - ubic.env: prod
[2024-07-28 00:06:34,443] <launcher> INFO  system - System loaded
[2024-07-28 00:06:34,485] <launcher> INFO  mongo  - Checking if database needs to be shut down
[2024-07-28 00:06:35,594] <launcher> INFO  mongo  - Database was not running
[2024-07-28 00:06:35,594] <launcher> INFO  mongo  - Starting database process...
[2024-07-28 00:06:36,639] <launcher> INFO  mongo  - Database process is started
[2024-07-28 00:06:36,648] <launcher> INFO  mongo  - Connected to database (v6.0.15@mongodb://localhost:27117, journal enabled)
[2024-07-28 00:06:36,651] <launcher> WARN  startup -   component[mongoRuntimeService] initialization took 2166ms
[2024-07-28 00:06:36,759] <launcher> INFO  db     - Starting database service initialization...
[2024-07-28 00:06:36,770] <launcher> INFO  db     - *** Factory Default *** Database exists. Clean it
[2024-07-28 00:06:36,986] <launcher> INFO  db     - Database service initialized...
[2024-07-28 00:06:36,986] <launcher> WARN  startup -   component[configDbService] initialization took 227ms
[2024-07-28 00:06:36,989] <launcher> INFO  stat   - *** Factory Default *** Stat Database exists. Clean it
[2024-07-28 00:06:37,385] <launcher> INFO  tomcat - Adding basic REST API support during the startup
[2024-07-28 00:06:37,932] <launcher> INFO  system - Tomcat startup took 3973ms
[2024-07-28 00:06:46,954] <launcher> WARN  system - cannot load native lib - ubnt_webrtc_jni
[2024-07-28 00:06:47,825] <launcher> WARN  system - Country Code is not configured for Site with ID=66a4feecd7accd35e6249d40
[2024-07-28 00:06:47,826] <launcher> WARN  system - Country Code is not configured for Site with ID=66a4feecd7accd35e6249d40
[2024-07-28 00:06:47,849] <launcher> INFO  state  - Creating Default Local Area Network for Site[66a4feecd7accd35e6249d40]
[2024-07-28 00:06:48,052] <launcher> WARN  startup -   component[dbSeeder] initialization took 318ms
[2024-07-28 00:06:49,285] <launcher> WARN  startup -   component[mcLagGroupRepositoryFactoryBean] initialization took 1140ms
[2024-07-28 00:06:50,269] <launcher> WARN  startup -   component[requestMappingHandlerMapping] initialization took 124ms
[2024-07-28 00:06:50,438] <launcher> INFO  startup - Context ready
[2024-07-28 00:06:50,473] <launcher> INFO  startup - Calling context ready handlers
[2024-07-28 00:06:50,484] <launcher> INFO  productinfo - [UIDB] Local UI DB file [/usr/local/share/java/unifi/data/uidb.json] does not exist
[2024-07-28 00:06:50,977] <launcher> WARN  discover - unable to join multicast group 233.89.188.1 on 0.0.0.0 (0.0.0.0/0.0.0.0)
[2024-07-28 00:06:50,990] <launcher> INFO  productinfo - Using controller channel=RELEASE, firmware channel=RELEASE. Available controller channels=[RELEASE], available firmware

So looking at unifi log, am I understanding that the unifi service has latched onto the last vlan? which is 192.168.145.1:8080?
I've obviously tried that ip:port to no avail (I have a Mac Mini with all vlans setup and have systematically moved each vlan to the top priority to test and am not able to reach unifi on any of the vlans.

Right now, I have firewall rules blocking some vlans access to the wan (i.e. vlan141) but untagged 192.168.140.0//24 has no restrictions atm and can "look/get" into all other vlans fine.

I just don't know what to do right now other than open up all vlans so there's no limitation across any of them and see if I can detect where unify is listening (i.e. 192.168.x.1:8080 for set up), or whether there is something else going on that's broken. 

I'm also fairly new to opnsense and bridges (big thanks to Patrick for putting me on the right path) and so I also don't have a huge amount of confidence that I'm even asking the right question here.

Anyway, I do have a spare USFF Dell box that I could solely use for Unifi and AdGuard, but  ideally having all 3 on the same box feels much better to me.

As always, thank heaps to the community and always grateful for the knowledge I learn here.

Hi All,
Have read a couple posts from a couple of years ago (Mainly Patrick's responses) about this but I'm afraid I'm just too dumb to understand and need bigger brains to help me if anyone's willing.

So far, I've got OPNSense running beautifully using a single port for WAN and a single Port for LAN that includes 4 VLANs. What I've since learnt is that TrueNAS is an absolute *&%^*$ if you want to spin up services with it on your desired VLANs.

Anyway, Rather than buy another Ubiquity Flex 10 Gig switch in such lovely economic times, to in order to bash TrueNAS over the head and comply, I'm wondering if I can utilise the existing ports on the router (i5-7500 CPU @ 3.40GHz, 32GB RAM) to have a few house bound devices hang off it so I can move the Flex switch to the shed.

I know, I know, I shouldn't be switching on a router. and yes, if throughput turns to crap, I'll starve the family for a month and get another Flex 10GB switch.

Anyway, I spent fifty-hundred hours putting the following diagram together which is an example of what I'm after, but simplified with just 2 VLANs ← hopefully am not too dumb and can scale out the rest things click for me.

The grouping of opt ports on the router symbolise installed PCIe NICs and the thicker lines for opt5/opt6 ports = 10 gig NIC.

I've already created a bridge with all the ports, but the VLANs are still configured to only use opt1 as their parent, which is how I had it originally configued before attempting this. I can tear down the router and start again no probs if need be, but it would ideally be nice to preserve it since I've got Unify and Arguard up and running on the router via plugins.

Obviously can provide more info if needed, but figured the diagram below is what a lot of home-lab users would like to try/test when physical/locality issues come into play.

If anyone is able to tackle a howto to achieve the diagram below, I'm sure I wouldn't be the only appreciative one.

Thanks,

(edit: I tried to include the diagram inline using asci art but it was too wide and crapped out... soz)