Topics

Have been running 26.1 on a re-purposed Check Point 5800 for some time.

Was using the Firewall (old) Rules which was a blocker to upgrading to 26.7 so finally this evening I did:

1. Back up configuration
2. Run firewall rules migration
   - Exported rules to CSV
   - Reviewed rules
   - Imported to new rules
   - Flushed old rules
   - Saved changes
3. Rebooted system
4. System came back fine, tested networking and rules seemed fine
5. From the Dashboard/lobby did a Check for Updates
6. System upgraded from 26.1.10 to 26.1.11 and said "end of support for 21.1"
7. Manually rebooted
8. System came back and everything working as expected
9. Did Check for Updates again and was offered 26.7 with caveats like "will need multiple reboots"
10. Cancelled and backed up system again (just in case)
11. Resumed upgrade to 26.7
12. System installe new kernel and printed REBOOT surrounded in !!!!!!! and went to reboot but never came back
13. Pluged laptop in to serial console, get message "failed waiting for configd (doesn't seem to be running)" approx every 15 seconds.  Machine wedged.
14. Used long-press on power switch
15. System said uptime 13 min, syncing disks, etc. and shutdown
16. Powered up system again and it booted normally back in to 26.1.11 and is working
17. Check for Updates now broken with tens of error messages about wrong packages and database rebuilds needed

WTF happened?

Mike

I've just installed OPNsense 26.7 on a Sophos XG210 and the installation ran fine.

I assigned:

    igb0 -> WAN
    ibg1 -> LAN

I set the IP address on the LAN to 10.100.1.1/24 and logged in to the UI, set dark mode, ran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28 and it worked. The wizard completes successfully. DNSmasq is configured as a DHCP server.

A laptop connected to the LAN interface (wired Ethernet) obtains an IPv4 address via DHCP and can ping 10.100.1.1.

Going on the VGA console and starting a shell I can ping 1.1.1.1 and 9.9.9.9 okay.

Under Firewall > Rules the deault rule "Default allow LAN to any rule" is present.

Under Firewall > NAT > Source NAT > Automatic Source NAT Rule Generation shows no rules.  Changing to hybrid and adding a Source NAT rule for "LAN Address" to Any with Source NAT to WAN interface address adds the rule to the table but the laptop on the inside still cannot ping my default gateway or 1.1.1.1 or 9.9.9.9.

Am I missing something? I thought that OPNsense given just two interfaces automatically built the NAT from LAN -> WAN without any additional configuration and it worked "out of the box"?

Mike

I am running OPNsense 26.1.1 on a re-purposed Sophox XG230.

With 25.7_11 I had the LCDproc plugin running and had system stats and performance on the 2-line LCD panel.

With 26.1.x System > Firmware > Plugins reports it missing:

os-lcdproc-sdeclcd (missing)   1.1_1   982B   3   OPNsense   LCDProc for SDEC LCD devices[/b]   

Is there a chance that it could make a return?

Regards

Mike

Over the weekend I have upgraded my OPNsense system from 25.7_11 to 26.1_4 and everything is working except inbound port forwarding (aka "Destination NAT").

I am trying to configure Asterisk IAX2 (UDP/4569) from my Work firwall to my home firewall.

I have host aliases for the work firewall (single IPv4) and the home PBX.  I have a port alias "iax2_port" = 4569.

I go to Firewall > NAT > Destination NAT and use "+" to add a new rule:

  Interface:
       Interface: WAN
       Version: IPv4
       Protocol: UDP

  Source (advanced):
       Invert Source:  (unchecked)
       Source Address: thorcom_gate  <- alias with correct IPv4 source
       Source Port: iax_port

   Destination:
       Invert Destination:  (unchecked)
       Destination Address: WAN address  (from drop down)
       Destination Port: iax_port

   Translation:
       Redirect Target IP: tubby_pbs  <- alias with correct host IP for my internal PBX
       Redirect Taget Port: iax_port


When I save the rule I get the error "Danger: Unexpected error, check log for details", but there's nothing visible in the logs accessible from the UI?

It appears that all of my inbound DNATs (formerly "port forwards") have disappeared/failed to be migrated as I have also lost the rules for my NVD/DVR and for my SDR - all of which were working fine under 25.7_11

How do I get inbound DNAT/port forwarding to work again?


Mike

I thought I was going mad so I have done this three times now and get the same result.

Hardware is Sophos XG210 chassis, have installed OPNsense 25.1, in UEFI mode, all boots and works fine.

XG210 has eight Ethernet ports (6 x GbE and 2 x SFP).

Out of the box OPNsense comes up with:

  igb0 -> LAN with 192.168.1.1/24
  igb1 -> WAN (no IP address yet)

I plug igb0 in to my Netgear VLAN enabled GS728TPv2 switch on the same VLAN (VLAN144) as my Win 11 PC. I add a secondary IP address to the network interface on the Win 11 PC (in this case 192.168.1.40) and I can access the OPNsense UI - this works because the PC and XG210 are on the same VLAN.

In OPNsense I add a third interface:

  igb2 -> MGMT and set the IP address to 192.168.2.1/24

I check in System > Settings > Access and it says the admin interface is defaulted to 'all interfaces'.

I have set the UI to be HTTP rather than HTTPS and I have 'Applied Settings'.

I add another secondary IP to my Win 11 PC (192.168.2.40/24) and move the cable on from the Netgear from igb0 to igb2 on teh XG210 and attempt to access http://192.168.2.1 without success (connection timeout).

If I move the cable back to igb0 I can no longer access the UI on 192.168.1.1 either.

I habe now lost UI access to OPNsense so I go to the console and use option (4) Factory reset and start again I can access the UI on 192.168.1.1.

Rinse and repeat ...


Why does adding a management interface break the UI on the LAN interface?


My specific use-case needs me to shoe-horn in OPNsense as a replacement for another firewall that has a WAN interface and where the LAN interface has eight VLANs... adding a management interface was my preference to alow both the WAN and VLANs on the LAN interface to be configured without getting locked out ;-)

Where am I going wrong?


Mike