Topics

Actually I do not know what to look for, but can anyone inform me where I can get a copy of the template used in opnsense? I wish to use this with GoFlow2 to see if I am missing some field(s)

Tks

Aimee

Backup system reolink nics
upgraded no issues (no further tests carried out)
VM no

Operational system intel nics,
nut ups ok after patch
usb gps ok
dns leak test on unbound dot ok
feeds to network & firewall monitoring ok
cold start advert blocking test passed with reservations (register, sky, ispreview appear ok, mailonline not ok)
cpu & temperature no discernible change
VM no


Showtime  :)

I use dns on 853, forwarding port 53 to port 853, blocking other dns servers.
Recently I added Home Assistant, which appears to use 1.1.1.1:853 or 1.0.0.1:853.
There are issue's with Home Assistant and altering its dns, it feels ever so lonely and checks the mothership every 10 minutes or so.

Incidentally, with the log on the rule (used for check internet usage) it when goes beserk, tops up the log,
and the syslog monitor system ramps up with loads of backlogs.

Is there a way to force it to use unbound, as the clone of the port 53 forward didn't seem to work.

Power down router, power led off, interface leds on, router restart.
Power down switch first, Power down router, stays powered down.
Bios is American Megatrends, reseting bios has not fixed the issue.
WOL is not installed
UPS attached

Anybody had this 'feature'?

Versions   OPNsense 22.7.5-amd64
FreeBSD 13.1-RELEASE-p2
OpenSSL 1.1.1q 5 Jul 2022

/local/lib/php/20200930/mongodb.so.so (Cannot open "/usr/local/lib/php/20200930/mongodb.so.so")) in Unknown on line 0
[06-Aug-2022 08:25:45 UTC] PHP Warning:  PHP Startup: Unable to load dynamic library 'mongodb.so' (tried: /usr/local/lib/php/20200930/mongodb.so (Cannot open "/usr/local/lib/php/20200930/mongodb.so"), /usr/local/lib/php/20200930/mongodb.so.so (Cannot open "/usr/local/lib/php/20200930/mongodb.so.so")) in Unknown on line 0

Getting these since upgrade to 22.7_4-amd64 05-Aug-2022.
Report has been raised and sent, also a post in the German section
https://forum.opnsense.org/index.php?topic=29717.msg143542#msg143542
appears to have a similiar issue.
Zenamor was removed a few weeks ago and not reinstalled.
Is mongodb used anywhere else?
All other processes are function correctly as far as I can tell.

Problem with audit

22.1.3 o firmware: improve the connectivity audit

I am on 22.1.4 and I am getting this, despite the fact I can ping from the LAN, and when logged into opnsense the address mirrors.dotsrc.org  and 130.225.254.116.

root@opnsense:~ # ping 130.225.254.116
PING 130.225.254.116 (130.225.254.116): 56 data bytes
64 bytes from 130.225.254.116: icmp_seq=0 ttl=52 time=47.218 ms

root@opnsense:~ # ping mirrors.dotsrc.org
PING mirrors.dotsrc.org (130.225.254.116): 56 data bytes
64 bytes from 130.225.254.116: icmp_seq=0 ttl=52 time=46.910 ms

Also I can access
Welcome to mirrors.dotsrc.org
In addition despite turning all ipv6 off (AFAIK) I see this

Checking connectivity for host: mirrors.dotsrc.org -> 2001:878:346::116

This issue appears to screw up the pligin list, for example all the installed plugins are orphaned, and
there are no uninstalled plugins in the list

Please can someone else check ( I have checked all rules from ICMP, nothing obvious)

Thanks

***GOT REQUEST TO AUDIT CONNECTIVITY***
Currently running OPNsense 22.1.4_1 (amd64/OpenSSL) at Tue Apr  5 10:23:07 BST 2022
Checking connectivity for host: mirrors.dotsrc.org -> 130.225.254.116
PING 130.225.254.116 (130.225.254.116): 1500 data bytes

--- 130.225.254.116 ping statistics ---
4 packets transmitted, 0 packets received, 100.0% packet loss
Checking connectivity for repository (IPv4): https://mirrors.dotsrc.org/opnsense/FreeBSD:13:amd64/22.1
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.txz: .......... done
Processing entries: .......... done
OPNsense repository update completed. 783 packages processed.
Updating SunnyValley repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.txz: .. done
Processing entries: .... done
SunnyValley repository update completed. 32 packages processed.
All repositories are up to date.
Checking connectivity for host: mirrors.dotsrc.org -> 2001:878:346::116
ping6: UDP connect: No route to host
Checking connectivity for repository (IPv6): https://mirrors.dotsrc.org/opnsense/FreeBSD:13:amd64/22.1
Updating OPNsense repository catalogue...
pkg: https://mirrors.dotsrc.org/opnsense/FreeBSD:13:amd64/22.1/latest/meta.txz: Non-recoverable resolver failure
repository OPNsense has no meta file, using default settings
pkg: https://mirrors.dotsrc.org/opnsense/FreeBSD:13:amd64/22.1/latest/packagesite.txz: Non-recoverable resolver failure
Unable to update repository OPNsense
Updating SunnyValley repository catalogue...
pkg: https://updates.sunnyvalley.io/opnsense/FreeBSD:13:amd64/22.1/OpenSSL/latest/meta.txz: Non-recoverable resolver failure
repository SunnyValley has no meta file, using default settings
pkg: https://updates.sunnyvalley.io/opnsense/FreeBSD:13:amd64/22.1/OpenSSL/latest/packagesite.txz: Non-recoverable resolver failure
Unable to update repository SunnyValley
Error updating repositories!
***DONE***

I enabled a dns over tls entry (which has worked, but was disabled to identify sputios lets encrypt messages) and applied, unbound then halted and had to be manually restarted.

Only log entry shows (all log options on)
2022-03-11T17:49:27   Informational   unbound   [88990:0] info: start of service (unbound 1.15.0).   
2022-03-11T17:49:27   Notice   unbound   daemonize unbound dhcpd watcher.   
2022-03-11T17:48:58   Informational   unbound   [88349:0] info: service stopped (unbound 1.15.0).

This will occur if I disable the entry, and apply

Versions   OPNsense 22.1.2_1-amd64
FreeBSD 13.0-STABLE
OpenSSL 1.1.1m 14 Dec 2021

Health Audit
>>> Check for missing package dependencies
Checking all packages: .......... done
py37-markupsafe has a missing dependency: python37
py37-markupsafe has a missing dependency: py37-setuptools
py37-markupsafe is missing a required shared library: libpython3.7m.so.1.0
py37-pymongo has a missing dependency: python37
py37-pymongo has a missing dependency: py37-setuptools
py37-pymongo is missing a required shared library: libpython3.7m.so.1.0
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" has 65 dependencies to check.
Checking packages: ................................................................... done
***DONE***

Security Audit
vulnxml file up-to-date
cyrus-sasl-2.1.27_2 is vulnerable:
  cyrus-sasl -- Fix off by one error
  CVE: CVE-2019-19906
  WWW: https://vuxml.freebsd.org/freebsd/a80c6273-988c-11ec-83ac-080027415d17.html

1 problem(s) in 1 installed package(s) found.

Started suricata in ids mode, interface em0 wan.

On the console (direct connection) got a lot of
arpresolver: cannot allocate llinfo for xxx.xxx.xxx.xxx on em0
link state went down then up twice before I disabled suricata.

Messages were not found in gui syslog, despite the syslog option enabled in suricata administration

NIC's on the system are Intel.
Hardware options CRC/TSO/LRO are not disabled. (ie enabled)

I am getting these, every six minutes

2022-01-31T10:04:00   Notice   /update_tables.py   resolving 1 hostnames (1 addresses) for Google took 0.01 seconds

I disconnected the lan input and waited to see if opnsense was the source, and I do believe it is.

Can someone advise why this is occurring.
Only Google is in the log, no other entity has been seen.

Thanks

I am attempting to setup this combination following the instructions here,
https://www.influxdata.com/blog/network-security-monitoring-with-suricata-and-telegraf/

I added
- eve-log:
    enabled: yes
    filetype: unix_stream
    filename: /tmp/suricata-stats.sock
    types:
      - stats:
         threads: yes

to /usr/local/etc/suricata/custom.yaml

%YAML 1.1
---
# empty stub for custom modifications, add custom persistent config below

Note the word persistent.
This file is overwritten on an upgrade.(and possibly on other events?)

Why is this, and event it was not overwitten, will a subsequent directive overwrite the previous directive in suricata.yaml?

For telegraf a file /usr/local/etc/telegraf.d/suricata.conf was created.

[[input.suricata]]
  ## Data sink for Suricata stats log.
  # This is expected to be a filename of a
  # unix socket to be created for listening.
  source = "/var/run/suricata-stats.sock"

  # Delimiter for flattening field keys, e.g. subitem "alert" of "detect"
  # becomes "detect_alert" when delimiter is "_".
  delimiter = "_"

Despite telegraf being updated, this file survived.

To access the files in telegraf.d, (the recommended approach I believe, and works perfectly in debian)
the configdir values is required, or the files in telegraf.d will be ignored.
Here is one on a debian system (which works)

/usr/bin/telegraf -config /etc/telegraf/telegraf.conf -config-directory /etc/telegraf/telegraf.d

Here is the confdir variable in the telegraf service file

: ${telegraf_confdir:=""}

I am unsure if the configdir is passed as a ps -aux | grep telegraf results in

daemon: /usr/local/bin/telegraf[91692] (daemon)

I am unsure if this is the intended processing of suricata & telegraf, or its an oversite.

Prior to raising a bug/enhancement, I would appreciate the communities views.

Thanks

Dashboard shows

OPNsense 21.7.3_3-amd64
FreeBSD 12.1-RELEASE-p20-HBSD
OpenSSL 1.1.1l 24 Aug 2021


Firmware shows

21.7.3 (installed)
2021-09-22


Health Audit shows

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 21.7.3_3 (amd64/OpenSSL) at Sat Oct  9 19:06:24 BST 2021
>>> Check installed kernel version
Version 21.7.2 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 21.7.2 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" has 66 dependencies to check.
Checking packages: .................................................................... done
***DONE***

Why the discrepancy in the kernel and base versions?

Two installations, one a VM for test purposes,  the other on a 16Gb Intel(R) Celeron(R) CPU 3955U @ 2.00GHz (2 cores) system (live)
Both systems used SSD's
Time approx 20-30 minutes.
No apparent issues

Request that fields to set entry/exit nodes be added to the TOR service page.
Modifying the torrc file is not persistent when the TOR gui is saved.
As an aside, if opnsense is going to adopt the policy of removing the ability to add extra parameters to a service via a free text panel, then to ensure opnsenses' obvious superiority over other products, a means to add important parameters via defined fields should be provided as an alternative.
Or to put it another way, don't dumb down the product!!

For operational reasons I would like to install a softflow deamon on the opnsense server.
Is this possible.
If not has anybody any experience with converting netflow into softflow.
Thanks
Aimee

Update sorted.

As opnsense is on 24/7, and is on a UPS capable of supporting more server's, it would be helpful to make netserver option available to inform other NUT netclient's that the power is failing, and to initiate a shutdown.

Netserver Mode is essentially identical to Standalone Mode but with the additional benefit of offering NUT services to other machines on the network by way of those machines running NUT client software

I have a LAN rule, using an alias, which contains the ports I allow out.
This works, and I see the traffic in the firewall  log.
However, I wish to see any attempts to bypass the rule with ports not in the alias.
Is this possible as a following rule will not see for example port 22 (not on the alias list) due to the previous rule.
Whats required is an inverse logging option I believe..

Having migrated from 20.1 to 20.7 with no real issues, I took a backup.
I have noticed that since initially installing opnsense vers 19, the disk usage has been creeping up.
The disk is a 442Gb SSD, and the usage was about 70% of the disk.
I then had issue with the flowed-aggregate service not starting, remote syslog also a non starter (and its not used anyway).
A reset and recover from the earlier backup did not improve matters.
I then took the decision to reinstall from scratch using a fresh 20.7 download.
Then I restored, installed sensei and the other missing plugins such as smartd.
The current disk usage is now 2.5G (1%)!!
Hopefully the system will run a bit cooler (its a fanless device) and all the services will stay up.

Never managed to get NUT working with my APC Backup UPS, so I did this

pkg install apcupsd

pkg install nano (easier to edit files)

edit /usr/local/etc/apcupsd/apcupsd.conf for your ups model

edit more /etc/rc.conf.d/apcupsd

apcupsd_enable="YES"

run apctest , select test alarm, listen for a beep.

service apcupsd start

service apcupsd status

Don't use an apcupsd from free bsd, it wont work, use the one from opnsense's repository.

Did the reboot test, still running, not sure if an update will remove any changes?

Hi
Trying to debug my firewall, and I cannot disable via the gui the automatically generated rules logging.
This is making my debugging quite difficult.
Any advice constructive would be appreciated.
Thanks