Topics

Here is a real mystery. Need advice.
For the past few days the internet has been going down for one minute at exactly 57-58 minutes after the hour. Not every hour, but about 15 times a day.
Internet is fine at full speed when working. All logs show nothing. I use an outside monitor to ping my IP and the gateway IP every minute. The IP goes down but the gateway is still ok.
The only indication of an issue in OPNsense is the Reporting Quality report which shows high loss during these outages. Not sure if the loss is reporting an issue or just the connection drop itself. The ISP says there are no issues on their end, but did slip once to admit some packet loss to me.
I have replaced the complete firewall, with all network hardware. There are no cron jobs running at this time and I do have DynamicDNS updating the DNS provider, but that doesn't have indications it is running at that time. This is a basic WAN/LAN setup with no plugins or Suricata running. No VLAN's
The fact that it happens at a consistent time does not seem like a hardware issue.

Any suggestions on what I can look at to try and pin this down?

Whenever I set the LAN  IPv6 Configuration Type to Track Interface I get the following log errors.

2023-03-25T16:29:59-07:00   Error   configd.py   [8652173a-ab02-4b61-b2bd-158d148350a9] returned exit status 1   
2023-03-25T16:29:59-07:00   Notice   configd.py   [8652173a-ab02-4b61-b2bd-158d148350a9] update IPv6 prefixes

I have the prefix set to 56, which is what the ISP told me. I also tried 64 and 60 and enabling the Request only an IPv6 prefix and prefix hit.
Is there another setting I need to do, or is this maybe caused by the ISP?
By the way, I do get an IPv6 address on the clients.

Hi all,
I want to add WiFi phones that are getting their IP via DHCP on the Access Point via a predefined separate IP 192.168.3.1/24. This AP also has WiFi connected computers on a separate network which is the LAN subnet on OPNsense (192.168.1.1/24). I am doing this because the phones require DHCP option 160 and I want them isolated from the LAN.
The phones only need Internet access and never need to bridge to the LAN, obviously.
Should I use a Virtual IP setup? If so, are there any guides?
I suppose I could just add another AP, but then I would lose the advantage of the AP mesh that is setup around the building.

What is the best way to go about this so the phones can access the internet but not the LAN from the same OPNsense firewall.
Thanking all in advance.

After weeks of testing with still a few unanswered areas, I finally have a stable 24/7 setup guide that has been testing for days now. Thought I would share with all the users who have helped me. Here is the setup guide.

These are the complete settings I used for a working 24/7 VPN connection to a Native Windows 10 client.
Any setting not mentioned here is the default. Variations may work, use at your own risk.
For this example. My firewall LAN is 192.168.150.0/24, remote LAN is 192.168.1.0/24, FQDN is firewall.opnsense.com, hostname is firewall.
Substitute my firewall subnet and FQDN with yours
The firewall LAN will be providing the data to the remote VPN users. I assume you know how to setup shares.
Best to have firewall and remote on different subnets, which is why I chose a rarely used local subnet for the firewall

Install Certificate Trust>Authoritties
  Descriptive Name: VPN-ca (name can be anything)
  Method: Create internal Certificate Authority
  Digest Algorithm: SHA256
  Lifetime: 3650 (I used 10 years, can be any length)
  Country Code: (Fill in this and the rest with your info)
  Common Name: VPN-ca
This is the cert to be exported for import to the Windows client

Install Certificate Trust>Certificates
  Method: Create internal Certificate Authority
  Descriptive Name: VPN
  Certificate Authority: VPN-ca
  Type: Server Certificate
  Digest Algorithm: SHA256
  Lifetime: 3650
  Common Name: firewall (use your hostname)
  Alternative Names: Type: DNS Value: firewall.opnsense.com (Use your FQDN)
 
Go to VPN>IPsec>Mobile Clients
  Enable - checked - check to enable mobile clients
  User Authentication - Local Database
  Group Authentication - none
  Virtual Address Pool - (Enter the IP range for the remote VPN clients, ie 10.4.4.0/24)
  DNS Default Domain - checked - firewall.opnsense.com (Use your FQDN)
  DNS Servers - 1.1.1.1 - 8.8.8.8 (plus any from your ISP)
  Phase 2 PFS Group - 14 (2048 bits)
  Login Banner - Welcome users (Can be anything, Optional)
Save

Create Phase1

Phase 1 Mobile Clients
  Phase 1 General information
    Connection method - default
    Key Exchange version - V2
    Internet Protocol - IPv4
    Interface - WAN
    Description - MobileIPsec
  Phase 1 proposal (Authentication)
    Authentication method - EAP-MSCHAPv2
    My identifier - Distinguished Name - firewall.opnsense.com (Use your FQDN)
    My Certificate - VPN
   Phase 1 proposal (Algorithms)
    Encryption algorithm - AES-256
    Hash algoritm - SHA256
    DH key group - 14(2048 bits)
    Lifetime - 28800
  Advanced Options
    Install policy - checked
    NAT Transversal - Enable
    Close Action - None
    Unique - Replace
    Dead Peer Detection - 45 seconds - 5 Retries - Restart the tunnel
    Keyingtries - 10
Save your settings.

Phase 2 Mobile Clients
Press the button + in front of the phase 1 entry to add a new phase 2.
  General information
    Mode - Tunnel IPv4
    Description - MobileIPsecP2
  Local Network
    Local Network - Address - 192.168.150.0/24
  Phase 2 proposal (SA/Key Exchange)
    Protocol - ESP
    Encryption algorithms - AES256
    Hash algorithms - SHA256
    PFS Key group - off
    Lifetime - 3000 sec
Create 2nd Phase 2 same as previous Phase 2 except
    Local Network - Network - (same as Virtual Address Pool above, ie. 10.4.4.0/24)
  Enable IPsec and Save
Restart IPsec Service

Advanced Settings
  Disable Auto-added VPN Rules - Disable (Checked) - Optional, if disabled, use rules below
    Rules to add if Auto-added rules are disabled -  add to WAN (Firewall>Rules>WAN)
      1. Protocol: ESP  Destination: WAN address (IPsec ESP)
      2. Protocol: UDP  Destination: WAN address  Dest Port: 500 (IPsec ISAKMP)
      3. Protocol: UDP  Destination: WAN address  Dest Port: 4500 (IPsec NAT-T)
  Passthrough networks - (Add all local and remote/peer LAN networks here)

Add this rule in Firewall>Rules>IPsec
IPV4*    *   *   LAN.net  *    *   *

Add IPsec Users
Go to VPN>IPsec>Pre-Shared Keys and press Add.
  local Identifier - (VPN Username to use in client)
  Remote Identifier - (VPN Username to use in client)
  Pre-Shared Key -  (VPN password to use in client)
   Type - EAP
Save to apply.

Setup Windows Client
Get exported CA cert (VPN-ca.crt) from OPNsense and copy to Temp folder
Run Powershell as admin on the Windows client
cd /temp
run the following (Use your FQDN instead of firewall.opnsense.com and your VPN Name instead of VPN)

Code Select Expand


Import-Certificate -FilePath "VPN-ca.crt" -CertStoreLocation Cert:\LocalMachine\Root\
Add-VpnConnection -Name "VPN" -TunnelType "Ikev2" -RememberCredential -EncryptionLevel Required `
-ServerAddress firewall.opnsense.com -DnsSuffix "firewall.opnsense.com" -PassThru
Set-VpnConnectionIPsecConfiguration -ConnectionName "VPN" `
-EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -DHGroup Group14 `
-CipherTransformConstants AES256 -AuthenticationTransformConstants SHA256128 -PfsGroup PFS2048 `
-PassThru -Force
Set-VpnConnection -Name "VPN" -SplitTunneling $True
Add-VpnConnectionRoute -Name "VPN" -DestinationPrefix 192.168.150.0/24


To view existing routes run in PS - (Get-VpnConnection -ConnectionName 'VPN').Routes
To view the configuration run in PS - Get-VpnConnection -ConnectionName 'VPN'

When starting Windows VPN client, Username and Password (above) will be required only for the first time you connect.
Of course you need to setup shares on the firewall side that the remote peers can get to.
If you want to share entire disks, make sure that the server allows direct paths, C$,D$ etc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
DWORD(32 bit): LocalAccountTokenFilterPolicy = 1

Read many posts over the past week on this with a lot of different answers. Some say use DPD, some not use.
I noticed, when DPD enabled, it is polled every 30 seconds in the VPN log.

Question
What is the optimal setting for DPD Delay, Retries, Action, and Keyingtries for a 24/7 tunnel?

One more thing to clarify. I am using Windows 10 native client and IPsec IKEv2

Thanks for looking.

This list may be controversial, but I feel it is greatly needed. Personally I use both but prefer OPNsense.

PFsense has the following that OPNsense does not
1. pfblocker - easier setup of GeoIP rules, can do similar manually with OPN
2. Create a rule direct from Firewall Normal View log
3. Has more GUI Widgets
4. Move rule position by dragging
5. Auto Configuration Backup
6. More console widget options
7. Change Boot Environments - useful when downgrading version - workaround mentioned below.
8. States shown on Rules page - useful to see if rule was used
9. Access shell within WebGUI
10. Easier to get answers in the forum. More users.
11. More logs available

OPNsense has the following that PFsense does not
1. Quicker upgrade implementations
2. Image files available online - Not available with PFS Plus
3. Monit
4. Enable logging from Rules page
5. Disable Auto-added VPN rules
6. Backup configuration to Google Drive
7. Restore configuration from Shell
8. More plugins Available
9. View Hidden rules in WebGUI
10. Better Advanced firewall log filter
11. Friendlier, but less likely to get results in the community forum
12. More dedicated to open-source - There are signs that PFS will end their free community edition someday

I am sure there are many other item specific differences. I just mentioned the major ones obvious to me. Feel free to add to this list. I am hoping some of the items from the first list can be eventually added to OPN
This list may help others decide which to use
Thanks for looking

I just setup a new 23.1.2 OPNsense firewall and trying to establish a remote Ipsec VPN connection. I can connect fine, just not getting any remote data from the client. I made sure all the IPsec rules were in place, but what botheres me was to see all these automatic rules in the IPsec Firewall rules. below is what I have. Is this correct?

I just install a new OPNsense and updated to 23.1.1_2
After setting the interface and testing the intenet, everything seems to be working.
Next step was to add my Dynamic DNS so I install the dd-client plugin and added my Cloudflare info.
It appears to update the DNS in Clouflare ok, which is good, but the current IP and Updated fields do not populate and there are no logs generated for the update event.

I have tried using both ddclient and OPNsense for the backend. Not really sure what this means.

Am I missing something , or this a bug?

Did some tweaking with my Intel X710's because I was having Internet connectivity issues. Updated firmware, added some tunables such as
dev.ixl.0.eee.enable=0
dev.ixl.0.fc=0    
dev.ixl.0.fw_lldp=0

Maybe disabling LLDP does this. It was recommended to do this when using LACP
Using lagg with 2 ports on the X710's. Upon bootup, I get these errors. Still having Internet drop outs. Works fine for a while then hangs and then comes back. Only happens using LACP.
Is this something I need to look at. Help point me in the right direction. Thanks

I have posted this question in older boards and I have to assume they just aren't looked at.

Is anyone successfully using ddclient with DNS Made Easy? If so, please post the settings you are using. I tried everything I could find in other threads. Nothing works. I am still using the legacy dyndns and that works fine, but it is going away and is no longer supported.
Thanks

Hi,
I have 2 internet connections. One static and one dynamic. The static one is being used now and all internet traffic passes to my servers and LAN. I want to add a dynamic WAN and have all the LAN traffic and media servers use the dynamic interface and my email and web servers use the static interface. When I setup a second WAN interface, a new gateway appears and I lose all internet traffic.

What I want to do is have the faster dynamic WAN for my media servers and LAN and use the static WAN for my web and email servers. How do I separate them?

I do not want load balancing, I just want to control which devices uses which WAN. Is this even possible or do I need to run two firewalls?

I noticed that OPNsense-App-detect/social-networking rules does not include TikTok. Where can I put in a request to add Tiktok to the rules?
Thanks

Noticed in the logs this critical error 'rebooted by root'
Happening at least once a day. What does this mean, and how do I research it further?
I included other events near the same time from the log.

Hi all,
I have two internet modems. The faster one, 1GB down/50 up is a residential dynamic address and the slow one, 40G down/10g up, has a business static IP. The ISP on the residential service blocks port 25 and 80. I need help in figuring out best way to forward or redirect these incoming ports from the static IP's to the faster dynamic service. I currently have a web and email server running on the static IP. The goal is to get as much performance as I can using the faster service. I already use SSL with ports 465, 993, 443 and restrict all email clients to these ports. It just the incoming port 25 and 80 that I am not sure the best way to deal with. I know I can easily NAT incoming 465, 993, 443 from the dynamic service, but what is the best way to handle the restricted ports.
Thanks to all.
Dan

I am using v22.7.7_1
It all started when I could not open websites from my servers locally. They open fine on the outside internet. So I tried some rules and made sure NAT reflection was enabled. All didn't work. Then I added those website domains to Unbound DNS Overrides. They worked locally now. But I later realized that my other servers were no longer getting emails and some websites no longer worked outside my local network. These domains were not added to the overrides since they had no issues. All these servers are on different subnets within the OPNsense firewall.  Also the WiFi access point DHCP devices could not connect to the internet. I disabled the overrides and everything is back to the way it was when I started.

Do I need to add all domains to the overrides, or did I need to do something else? I did not add any new rules, just the overrides. Why would overrides for specific domains affect other operations? Any suggestions are greatly appreciated.
Thanks

I did some searching around and could not find an answer to this.
I have a website on 192.168.1.101 and can access it on that server and remotely, but cannot access it from other subnets on the same network. ie, 192.168.100.5. I have NAT Reflection turned on. I have another webserver @ 192.168.20.5 that I can get to from any subnet or remotely. Both servers use IIS 10 and have their own WAN IP.
I don't have any special rules for the server that works. Any Help would be appreciated.
Thanks for looking.

I can log into OPNsense via the console of GUI just fine, but I cannot use that same password in WinSCP. It says 'incorrect password'.
What do I need to do to get SFTP access?

Didn't receive any help on my Outbound NAT questions so I am taking a different approach to not do a group gateway.
I have a working OPNsense firewall with web and email servers. My goal is to add another WAN for use only by the LAN interface on the firewall.
So what I did was change the LAN gateway to the new WAN service and add the corresponding Outbound NAT. I have connectivity to the new WAN on the LAN now, but now there is no access to the servers on the firewall. Not sure what rules to add to gain access to the servers from the LAN now that both are running on different gateways. The servers run on different interfaces on the same firewall.

I am not trying to do Multi-WAN. Just want the LAN to use it's own gateway.

Can anyone help with this?

I am trying to setup load balancing with two WAN's for my LAN network. I followed the guide, but have issues with connectivity and I think it may be because of the outbound NAT settings. I have Outbound NAT set to manual and have a rule that sets the LAN network to one WAN interface and NAT'ing to a virtual IP on one of the primary WAN interface.

One WAN (primary) has static virtual IP's, the other WAN is DHCP.

Do I need to add another Outbound NAT rule for the DHCP WAN?

The other option is to not use multi-WAN group gateways and put the DHCP WAN as the LAN gateway, but how would The Outbound NAT be configured?

To complicated matters, two computers on the LAN must have some ports accessible on the primary WAN.

I can't access local websites anymore. I know I use to do it, but there have been many updates since then.
Websites are all accessible externally, just not within my local LAN network.
I have NAT 1:1, reflection enabled, and Port Forwards enabled.
Local subnet is 192.168.100.1/24. For example, one webserver is @ 192.168.20.34 and the other 192.168.1.101
Can't use one rule because there are different webservers on different IP's. Can't get to any of them from the local network. All the webservers are on different external IP's via IP alias'es.
All webservers do have a second NIC going to the 192.168.100 subnet so I can access the files. But IIS is not tied to those IP's
Any assistance is helpful. Thanks