1
General Discussion / Re: Unable to import Let's Encrypt certificate
« on: August 02, 2024, 05:13:26 pm »
Try using the fullchain.pem instead of the cert.pem
Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
2
Virtual private networks / Re: problem with openvpn roadwarrior and sip clients
« on: July 04, 2024, 05:04:53 pm »I've seen this sort of behavior when using Freepbx/PBXact with Endpoint Manager to configure remote SIP devices.
If this is your scenario try resetting the SIP device to factory, configure a temporary rule on the firewall to allow insecure access to the configuration address, set the SIP device provisioning to the same address and run the provisioning.
When it restarts it should bring up the VPN and then use the secure address to talk to the PBX. After which you can remove the temporary rule.
3
24.1 Legacy Series / Re: Firewall Rules Help
« on: May 19, 2024, 08:55:14 am »
My bad if this has changed.
The quote was from Franco.
The quote was from Franco.
4
24.1 Legacy Series / Re: Firewall Rules Help
« on: May 19, 2024, 08:34:54 am »From https://forum.opnsense.org/index.php?topic=2790.0
Quote
MAC addresses are not covered by FreeBSD's ipfw(4) and pf(4) packet filters which OPNsense uses. You can, however, use the captive portal functionality to allow access only to specific MAC addresses in the advanced configuration, see "Allowed MAC addresses".
5
24.1 Legacy Series / Re: Migrate from ISC DHCP to Kea
« on: May 06, 2024, 11:10:49 am »
If you search the forum you will find that several people have created migration scripts.
The Kea service has had CSV import and export capability added to it.
The DHCPv4 service does not currently have a CSV export function.
The Kea service has had CSV import and export capability added to it.
The DHCPv4 service does not currently have a CSV export function.
6
Virtual private networks / Re: wireguard peer generator - QR code is invalid
« on: April 21, 2024, 06:46:24 pm »
Could you be missing the end-point port number?
And presuming you have a peer PublicKey value.
And presuming you have a peer PublicKey value.
7
24.1 Legacy Series / Wireguard - Peer Generator
« on: April 11, 2024, 12:51:42 pm »
Would it be worth adding a DNS field to VPN: Wireguard: Peer Generator?
It may resolve an issue where people are configuring road warriors, which can't resolve DNS, which looks to be a common question.
Edit: And possibly an IP address field.
It may resolve an issue where people are configuring road warriors, which can't resolve DNS, which looks to be a common question.
Edit: And possibly an IP address field.
8
24.1 Legacy Series / Re: [Solved]Python script converts Opnsense configuration file into kea reservations
« on: March 09, 2024, 10:16:02 pm »If export/import is added to the ISC DHCPv4/v6 using the same file format as the existing Kea export/import, then migration of reservations between the two becomes trivial.
9
24.1 Legacy Series / Kea testing observations
« on: March 06, 2024, 11:45:10 am »
I've migrated a couple of firewalls to see how Kea behaves. Both have multiple networks which are using DHCP. Both migrations were seamless and Kea is working as expected.
Some of the things I experienced I think could be enhanced if they are possible to deploy.
- When creating a subnet I would find it useful to be able to also define a name/label, or pull-in the interface name for the subnet (from a readability perspective).
- When creating a subnet you can enter a pool (as a /29 in my test) which is not in the subnet.
- When creating a reservation there is a check that the IP address is in the displayed subnet. As all the subnets are already defined this could be reversed such that the subnet is set from the entered IP address. Which is another way of saying I frequently did not have the right subnet when manually migrating reservations. That may have also been less of an issue if the subnet selection was name based rather than IP address based.
For the log file
- I miss seeing the DHCP discover, offer, etc. messages.
- ISC DHCPv4 will log a hostname if available, I've not seen them in the Kea logs yet.
While neither of the log messages are required they make it easier to spot a new device trying to connect to a network and if there is an issue with it.
Some of the things I experienced I think could be enhanced if they are possible to deploy.
- When creating a subnet I would find it useful to be able to also define a name/label, or pull-in the interface name for the subnet (from a readability perspective).
- When creating a subnet you can enter a pool (as a /29 in my test) which is not in the subnet.
- When creating a reservation there is a check that the IP address is in the displayed subnet. As all the subnets are already defined this could be reversed such that the subnet is set from the entered IP address. Which is another way of saying I frequently did not have the right subnet when manually migrating reservations. That may have also been less of an issue if the subnet selection was name based rather than IP address based.
For the log file
- I miss seeing the DHCP discover, offer, etc. messages.
- ISC DHCPv4 will log a hostname if available, I've not seen them in the Kea logs yet.
While neither of the log messages are required they make it easier to spot a new device trying to connect to a network and if there is an issue with it.
10
24.1 Legacy Series / Re: After update OPNsense 24.1.2 and Suricata 7 VoIP is dead
« on: February 26, 2024, 03:40:39 pm »
Just a FYI.
I have two VoIP systems behind almost identical firewall hardware (one has a couple of additional 10GB ports) running 24.1.2_1 and configured in the same way. PBX traffic is over a 1:1 NAT.
I've seen the same issue of IDS needing to be disabled on one of them but not the other.
The major difference between the two looks to be the SIP trunk provider.
I have two VoIP systems behind almost identical firewall hardware (one has a couple of additional 10GB ports) running 24.1.2_1 and configured in the same way. PBX traffic is over a 1:1 NAT.
I've seen the same issue of IDS needing to be disabled on one of them but not the other.
The major difference between the two looks to be the SIP trunk provider.
11
24.1 Legacy Series / Re: [Solved]Python script converts Opnsense configuration file into kea reservations
« on: February 25, 2024, 09:17:10 pm »
I did look at the contents of your merge output.
This will be the first time I've used Kea, so I'm not sure what the final result will need to be.
When I get time I'll run another machine with my firewall config on it and add additional subnets into Kea. Then see what the xml looks like.
I'll also dig out some old bash scripts I wrote which I used to migrate in ISC DHCP configs when I moved some clients from an external ISC DHCP server to OPNsense.
This will be the first time I've used Kea, so I'm not sure what the final result will need to be.
When I get time I'll run another machine with my firewall config on it and add additional subnets into Kea. Then see what the xml looks like.
I'll also dig out some old bash scripts I wrote which I used to migrate in ISC DHCP configs when I moved some clients from an external ISC DHCP server to OPNsense.
12
24.1 Legacy Series / Re: [Solved]Python script converts Opnsense configuration file into kea reservations
« on: February 25, 2024, 06:14:58 pm »
Are you searching the config-OPNsense*.xml for which interfaces use DHCP or are you just converting DHCP for the lan interface?
I have no lan network but I do have a number of Vlans which use DHCP and was unable to get to a merge.xml
I don't code in python and so far my attempts at modifying your script have yet to be successful from my linux workstation.
I have no lan network but I do have a number of Vlans which use DHCP and was unable to get to a merge.xml
I don't code in python and so far my attempts at modifying your script have yet to be successful from my linux workstation.
13
24.1 Legacy Series / Re: Import static dhcp from ISC to kea?
« on: January 31, 2024, 03:43:31 pm »14
General Discussion / Re: OPNSense with UK Vodafone FTTC
« on: January 12, 2024, 11:19:33 pm »
I think you'll find it is all covered in the OPNsense documentation.
I went through it when I was adding an ISP connection over CityFibre, which also required using a vlan.
I went through it when I was adding an ISP connection over CityFibre, which also required using a vlan.
15
General Discussion / Re: OPNSense with UK Vodafone FTTC
« on: January 06, 2024, 12:15:34 pm »
From memory...
Go to Interface , Other Types, VLAN. Create a vlan with the VID you need.
Then Interface, Point-to-Point, Devices, add new device. Link type PPPoE, Use the above vlan for the Link interface. Complete with the rest of the PPoE auth details.
Then Interface , Assignments, create a WAN interface using the pppoe just created.
Go to Interface , Other Types, VLAN. Create a vlan with the VID you need.
Then Interface, Point-to-Point, Devices, add new device. Link type PPPoE, Use the above vlan for the Link interface. Complete with the rest of the PPoE auth details.
Then Interface , Assignments, create a WAN interface using the pppoe just created.