Messages

1

19.1 Production Series / openvpn working but connection status shows unable to contact daemon

« on: February 19, 2019, 06:13:29 pm »

Hi there,

since the update to 19.1.1 I have a weird issue.
Openvpn works. I can connect to my lan and browse the web from an external wlan.
But the status under vpn / openvpn / connection status shows this:

Code: [Select]

OpenVPN Status
OpenVPN Privat UDP:1194 Client connections
Common Name Real Address Virtual Address Connected Since Bytes Sent Bytes Received
[error] Unable to contact daemon Service not running? 0 0 bytes 0 bytes


System: Diagnostics: Services also shows that openvpn isnt running, although it works. Restarting the firewall or just the service doesnt solve the issue.

This is the openvpn log

Code: [Select]

Date Message
Feb 19 17:51:49 openvpn[3190]: Exiting due to fatal error
Feb 19 17:51:49 openvpn[3190]: Cannot open TUN/TAP dev /dev/tun1: Device busy (errno=16)
Feb 19 17:51:49 openvpn[3190]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 19 17:51:49 openvpn[3190]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 19 17:51:49 openvpn[22887]: library versions: OpenSSL 1.0.2q 20 Nov 2018, LZO 2.10
Feb 19 17:51:49 openvpn[22887]: OpenVPN 2.4.6 amd64-portbld-freebsd11.2 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Feb 4 2019
Feb 19 17:13:06 openvpn[52155]: MULTI_sva: pool returned IPv4=10.10.0.6, IPv6=(Not enabled)
Feb 19 17:13:06 openvpn[52155]: 46.xxx.xx.49:56646 [stefan] Peer Connection Initiated with [AF_INET]46.xxx.28.49:56646
Feb 19 17:13:06 openvpn: user 'stefan' authenticated using 'TOTP VPN Access Server'
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5180_3.7.8__build_5180)"
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_TCPNL=1
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_COMP_STUBv2=1
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_COMP_STUB=1
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_LZO=1
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_LZ4v2=1
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_LZ4=1
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_NCP=2
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_PROTO=2
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_PLAT=mac
Feb 19 17:13:06 openvpn[52155]: 46.189.28.49:56646 peer info: IV_VER=2.4.6
Feb 19 16:13:07 openvpn[52155]: stefan/46.xxx.xx.xx:53468 MULTI_sva: pool returned IPv4=10.10.0.6, IPv6=(Not enabled)
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 [stefan] Peer Connection Initiated with [AF_INET]46.xxx.xx.xx:53468
Feb 19 16:13:07 openvpn: user 'stefan' authenticated using 'TOTP VPN Access Server'
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5180_3.7.8__build_5180)"
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_TCPNL=1
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_COMP_STUBv2=1
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_COMP_STUB=1
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_LZO=1
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_LZ4v2=1
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_LZ4=1
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_NCP=2
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_PROTO=2
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_PLAT=mac
Feb 19 16:13:07 openvpn[52155]: 46.xxx.xx.xx:53468 peer info: IV_VER=2.4.6
Feb 19 13:57:15 openvpn[97551]: Exiting due to fatal error
Feb 19 13:57:15 openvpn[97551]: Cannot open TUN/TAP dev /dev/tun1: Device busy (errno=16)
Feb 19 13:57:15 openvpn[97551]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 19 13:57:15 openvpn[97551]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 19 13:57:15 openvpn[92632]: library versions: OpenSSL 1.0.2q 20 Nov 2018, LZO 2.10
Feb 19 13:57:15 openvpn[92632]: OpenVPN 2.4.6 amd64-portbld-freebsd11.2 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Feb 4 2019
Feb 19 13:57:13 openvpn[93621]: Exiting due to fatal error
Feb 19 13:57:13 openvpn[93621]: Cannot open TUN/TAP dev /dev/tun1: Device busy (errno=16)
Feb 19 13:57:13 openvpn[93621]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 19 13:57:13 openvpn[93621]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 19 13:57:13 openvpn[28853]: library versions: OpenSSL 1.0.2q 20 Nov 2018, LZO 2.10
Feb 19 13:57:13 openvpn[28853]: OpenVPN 2.4.6 amd64-portbld-freebsd11.2 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Feb 4 2019
Feb 18 22:21:32 openvpn[52155]: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]185.200.118.66:53610
Feb 18 13:27:13 openvpn[15599]: Exiting due to fatal error
Feb 18 13:27:13 openvpn[15599]: Cannot open TUN/TAP dev /dev/tun1: Device busy (errno=16)
Feb 18 13:27:13 openvpn[15599]: TUN/TAP device ovpns1 exists previously, keep at program end

Looking forward to your replies.
Thx.

PS
what does this mean
TLS Error: cannot locate HMAC in incoming packet from [AF_INET]185.200.118.66:53610

I get this from time to time from ip of the 185.200.118.xx range?
Is someone trying to connect to my openvpn using a port scan?

2

German - Deutsch / Re: Wie dyndns für openvpn auf opnsene als exposed host hinter fritzbox

« on: January 11, 2019, 06:34:50 pm »

so habe ich es auch gemacht.
bei client export muss unter other aber die url von duckdns anders eingetragen werden:
Nur mit www.deinesubdomain.duckdns.org ging es dann.

Und in der Fritzbox muss man folgende Einstellungen setzen damit die Fritzbox auch von außen erreichbar ist:
https://avm.de/service/fritzbox/fritzbox-5490/wissensdatenbank/publication/show/35_Ueber-Dynamic-DNS-auf-die-FRITZ-Box-zugreifen/

3

18.7 Legacy Series / Re: ntopng data directory migration notice since last update

« on: January 08, 2019, 07:28:49 pm »

So I can just ignore the notice in ntopng and it will keep working like before?

4

18.7 Legacy Series / ntopng data directory migration notice since last update

« on: January 08, 2019, 06:50:40 pm »

Hi there,

with the recent update ntopng wants a data migration

https://www.ntop.org/support/faq/migrate-the-data-directory-in-ntopng/

How can this guide from ntop be used the change the settings on opnsense via console / ssh?

Thank you.

5

German - Deutsch / [gelöst] Wie dyndns für openvpn auf opnsene als exposed host hinter fritzbox

« on: January 06, 2019, 06:30:49 pm »

Hi,

Anschluss ist von Netcologe mit einer Fritzbox 7590 mit der internen IP 192.168.178.1       
Opnsense ist als Exposed host hinter der Fritzbox geschaltet mit 192.168.178.42
DynDNS ist in der Fritzbox mit duckdns erfolgreich eingerichtet und die IPv4 Adresse kennt duckdns.
Port 80 und 443 und 1194 (UDP für OpenVPN) sind zusätzlich forwarded in der Fritzbox.

Internet und alles im Lan funktionieren auch wunderbar. Lan hat subnet 192.168.1.1 auf der Opnsense.
Openvpn wurde auf der OpnSense wie im guide eingerichtet, inkl. 2fa und cert.

Wie teile ich den clients nun in VPN / CLIENT EXPORT die DynDns Adresse mit, damit ich von außen auf meinen OpenVPN Server auf der Opnsense zugreifen kann?


Hatte schon einmal mit einer festen Ip und nur der Opnsense als Router erfolgreich OpenVPN betrieben.
Mit dem neuen Anschluss bekomme ich dies noch nicht hin.

Vielen Dank.

6

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: September 07, 2018, 05:49:57 pm »

@mb Thank you for your support.
The system only uses that much cpu power when I'm fully saturating my internet connection (150mbit).
Apart from using sensei I haven't experienced any issues. But this explains the drop in my throughput for sure.

I tried stopping it by using the stop button first. Which didnt work. I was able to stop the elastic search engine using the stop button though. Then I disabled start on boot and rebooted the machine. Unfortunately this didnt disable sensei after the reboot and somehow I was able to stop it and uninstall it after a few tries.
After that I tried the install sensei on the same machine again, which resulted in an crash after the final installation. The PC wasnt accessible via gui or shell anymore and I had to reinstall opnsense.

So it seams that a machine with underpowered resources might not be able to be stoped using sensei 0.6 right now.

Cheers

7

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: September 05, 2018, 06:02:06 pm »

A couple of questions:

Is this CPU usage (60-70%) for the configuration Sensei is not running? (e.g. IPS+Proxy+AV) ?

Yes

When you launch Sensei, how much did you see it changed? Does it top to 100%?
 It goes up to 95% and drops to ~50%. It also drops and peaks way more often

Furthermore I couldnt disable Sensei and I was only able to uninstall it right after a reboot. 
After a new try to install it again over the current system opnsense crashed and it had to reinstall Opnsense.
I guess some old settings made a clean reinstallation of Sensei impossible.
Lets hope that a new Sensei version will fix the option to stop it.

Looking forward to an update and will give it a try another time.

8

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: September 03, 2018, 10:12:19 am »

Great plugin so far.

On my machine running with 8GB RAM and an Intel I5 5250U (2x 1,6GHZ) the WAN throughput is at approx. 85 Mbps using IPS, Proxy + AV and around 8 active users.
Without Sensei my box can use the full 150 Mbps line (Cpu load is around 60 - 70%).
It takes a while to load on the first time and for some reason I cannot disable Sensei.
Due to the reduced internet speed I had to uninstall it and will give it another try once I have a faster router.

9

18.7 Legacy Series / Re: [Solved] firehole level 1 lan rule blocks internet on windows 10 - use level 2

« on: September 03, 2018, 09:45:19 am »

Thank you!
Firehol level 2 works with Windows 10.

https://iplists.firehol.org/?ipset=firehol_level2


https://iplists.firehol.org/files/firehol_level2.netset

10

18.7 Legacy Series / [Solved] firehole level 1 lan rule blocks internet on windows 10 - use level 2

« on: August 31, 2018, 08:05:46 pm »

Hey there,

has anyone else experienced this too?
My Lan Rule with firehol level 1 blocks internet for windows 10.
The rule does not block it on linux, android or ios when active and set before the default allow lan to any rule.
If set after the defaul allow lan rule winodows 10 will connect to the internet of course but this wont help me in blocking those ips in the list as the allow rule overwrite the firehol rule.

Alias is set like this:
firehol    URL Table (IPs)    firehol    https://iplists.firehol.org/files/firehol_level1.netset  expiration 0 days + 12hours

See attachment for the rule setting.

Thank you!

Using Firehol level 2 works with Windows