Messages

Unplug port 2 and use this link to get GUI access to Draytek https://forum.opnsense.org/index.php?topic=36936.msg180650#msg180650

It solves a few of my problems but not for external access to my server.

Check out tailscale funnel or cloudflared

Yes! :-)

Also think about setting up NTP across your network which in itself is an important security measure against replay attacks and to correlate security events in various logs.

Did you approve the subnet route in your tailnet admin console? It's under edit route settings for the firewall node.

Try testing with a client that thas more and better tools - e.g. a laptop tethered to your phone or connected to a phone hotspot.

Can you resolve names from Unbound? What about your domain name?

Also consider setting a floating rule to allow ICMP everywhere while you are testing

Open your Tailscale admin console, click the DNS tab, Add nameserver, Custom, enter the Tailscale IP address of your firewall, toggle 'Restrict to domain' and enter your domain.uk DNS domain.

BTW, if you install a reverse proxy on your server (Traefik, Caddy, NPM, etc.) you can configure it so your clients will not have to add the 30032 port.

Beware of shotgun debugging. http://www.catb.org/jargon/html/S/shotgun-debugging.html

Install Wireshark and find out what is happening on Windows. You can also use it to visualise packet traces from OPNsense, should the need arise. https://www.wireshark.org/

Bart...

The PPPoE log used to be separate but in 25.1 it is under System: Log Files: General

I tried reaching out to my NUC manufacturer

Intel sold the NUC product line to Asus. Most NUC's have a header that mirrors the power switch. https://www.intel.com/content/www/us/en/support/articles/000007309/intel-nuc.html which is what I use for remote power control.

USB keyboards are handled by the BIOS while BT usually need OS support, thus making them less suitable for emergency reboots.

Bart...

Bin all smartphones in the house. This is not a joke; you can only completely fix this at the client end. https://www.amazon.co.uk/dp/B0B6WLBKKR

You will obviously have to discuss your reasons for wanting to ban social media but that goes for any solution you propose.

Can you post to a site that doesn't require a Google account please?

Why are the cameras outside the NVR subnet? If you are keeping the NVR as a router, you need a static route on OPNsense for 192.168.254.0/24 via 192.168.22.123.

It would be much simpler if the NVR and the cameras were all on a flat VLAN.

port forward from the incomming port of 1234 to port 80 on 192.168.10.5

Modern browsers will warn sternly about unencrypted HTTP and force users to click twice before accessing your site. If you are using port 80 for ACME, you may be better off with cloudflared which avoids opening ports and includes a PKI certificate.

There are many YT videos to help you, such as this one from Chris Sherwood https://youtu.be/ZvIdFs3M5ic

Run a memory test https://www.memtest86.com/

Can you try with a Linux client such as WSL on Win 10? You can then run the OpenVPN binary with the client .ovpn in the foreground and get more diagnostics with:

openvpn --verb 4 myconfig.ovpn