Messages

1

Hardware and Performance / Re: Optimized performance of my PC Engines APU2c4

« on: September 12, 2019, 10:57:52 pm »

With the recommended settings I noticed that the frequency jumped from 1000 MHz to 1400 MHz just by clicking "Check for updates". The frequency then went back to 1000 MHz.

2

Hardware and Performance / Re: PCENGINES APU[1-5] Coreboot SeaBIOS Open Firmware

« on: September 12, 2019, 11:53:49 am »

The most recent BIOS versions for the APU1 trough APU5 platforms are out.

v4.10.0.1/v4.0.28

https://pcengines.github.io

3

General Discussion / Re: Firefox directs by default DoH queries to Cloudflare

« on: September 11, 2019, 11:08:42 pm »

Thank you both.

I'm just curious as to why, Merlin the developer of Asuswrt-Merlin, would go to such length, as to contemplating a switch in his firmware to "Block Firefox automatic DoH usage"?

4

General Discussion / Firefox directs by default DoH queries to Cloudflare

« on: September 11, 2019, 10:15:29 pm »

I came across this discussion and I wonder if or how this change to Mozilla/Firefox could impact on OPNsense?

https://support.mozilla.org/en-US/kb/firefox-dns-over-https

"In the US, Firefox by default directs DoH queries to DNS servers that are operated by CloudFlare, meaning that CloudFlare has the ability to see users' queries."

Disabling Firefox's automatic switch to DoH
https://www.snbforums.com/threads/disabling-firefoxs-automatic-switch-to-doh.58910/

5

General Discussion / Re: watch bbc iplayer using openvpn

« on: September 10, 2019, 12:46:49 pm »

Whether I connect my iPhone to my home WiFi network or use mobile data, I get the same dns using Openvpn - that of my OpnSense box. Since you are using an android device, it's maybe working differently in that regard. Perhaps it's caching the dns, in this case, your work dns.

How to flush the dns on an android phone

https://buffered.com/tutorials/how-to-flush-dns-cache/

I assume that the 10.100.1.254 address is the ip of your Opnsense box.

6

General Discussion / Re: watch bbc iplayer using openvpn

« on: September 09, 2019, 07:02:18 pm »

Assign localhost; 127.0.0.1, or the network address of your opnsense box "192.168.1.1" as dns server in your openvpn server configuration.

7

General Discussion / Re: watch bbc iplayer using openvpn

« on: September 07, 2019, 02:08:24 pm »

Hi Rob,

Have you made a DNS leak tests? Do you get the same DNS making the test on your computer at home, as making it over OpenVPN with your android device on for instance a public WiFi hotspot?

Make sure that your OpenVPN Server uses your OPNsense as DNS-server.

Maybe the BBC uses another technology to flush out those trying to access their content abroad, but it's worth a try.

https://www.dnsleaktest.com/

miroco

8

Hardware and Performance / Re: OPNsense Varia AMD APU2C4 broke - Replace with APU2D2?

« on: September 02, 2019, 02:07:19 pm »

A difference between the apu2c and apu2d revisions.

Update apu2d: Reduce leakage current between V3 and V3A power rails (can cause problems with SD cards). Add options for better compatibility with LTE modem modules.

https://www.pcengines.ch/apu2d4.htm

miroco

9

19.1 Legacy Series / [SOLVED] TIME_ERROR: 0x2041: Clock Unsynchronized

« on: July 18, 2019, 10:12:05 pm »

I noticed this today. I don't know when this began, or if it's only me who is affected. Time in Dashboard seems to correspond to time on my Mac though.

root@xxxxxxxx:~ # ntptime
ntp_gettime() returns code 0 (OK)
  time e0db421d.293293d0  Thu, Jul 18 2019 21:08:13.160, (.160928974),
  maximum error 230285 us, estimated error 153 us, TAI offset 0
ntp_adjtime() returns code 0 (OK)
  modes 0x0 (),
  offset -204.688 us, frequency 53.608 ppm, interval 4 s,
  maximum error 230285 us, estimated error 153 us,
  status 0x2001 (PLL,NANO),
  time constant 6, precision 1.000 us, tolerance 496 ppm,
  pps frequency 53.609 ppm, stability 0.000 ppm, jitter 0.000 us,
  intervals 0, jitter exceeded 0, stability exceeded 0, errors 0.


https://www.linuxquestions.org/questions/slackware-14/ntpd-kernel-reports-time_error-0x2041-clock-unsynchronized-4175636606/

Edit.

I made a new search and found out that the issue has been covered.

https://forum.opnsense.org/index.php?topic=9967.msg45447#msg45447

10

Hardware and Performance / Re: PCENGINES APU[1-5] Bios

« on: May 10, 2019, 08:41:53 pm »

The most recent mainline BIOS versions for the APU1 trough APU5 platforms are out.

v4.9.0.5

https://pcengines.github.io

11

19.1 Legacy Series / Re: Revert unbound to 18.7.7 - not possible?

« on: March 06, 2019, 10:22:05 pm »

How and for what reasons your OPNsense box is deployed, dictates your freedom of action of cause. In my case, I'm the only user.

I started with a fresh backup of the configuration file. With it you can always return to the previous known good state. However, it will take longer than 5 min. Don't let anyone rush you.

Useful tools:
Putty
WinSCP
Notepad++


Then you can ask your boss for a raise :-)


miroco

12

19.1 Legacy Series / Re: Revert unbound to 18.7.7 - not possible?

« on: March 04, 2019, 10:33:11 pm »

It's working for me. These following notes are an extract of the "directnupe" guide. They helped me get a better overview of the process. However I do strongly advise you to read up on his guide prior to making the installation/configuration.

miroco


GetDNS and Stubby

# pkg add https://pkg.opnsense.org/FreeBSD:11:amd64/19.1/MINT/19.1.2/LibreSSL/All/libidn-1.34_1.txz
# pkg add https://pkg.opnsense.org/FreeBSD:11:amd64/19.1/MINT/19.1.2/LibreSSL/All/libuv-1.26.0.txz
# pkg add https://pkg.opnsense.org/FreeBSD:11:amd64/19.1/MINT/19.1.2/LibreSSL/All/libev-4.24,1.txz
# pkg add https://pkg.opnsense.org/FreeBSD:11:amd64/19.1/MINT/19.1.2/LibreSSL/All/getdns-1.5.1.txz

# su -m unbound -c /usr/local/sbin/unbound-anchor

# mv /usr/local/etc/rc.d/stubby /usr/local/etc/rc.d/stubby.sh

Make it executable - I run two commands - it works for me:
# chmod 744 /usr/local/etc/rc.d/stubby.sh
# chmod a+x /usr/local/etc/rc.d/stubby.sh

Yes must enable Stubby Daemon in the file -  open file by: nano /usr/local/etc/rc.d/stubby.sh
go to line 27  -

: ${stubby_enable="NO"}  change the setting to  : ${stubby_enable="YES"}

That is all you have to do to this file. It comes pre-configured. Save and exit.

Now you must configure Stubby to resolve DNS OVER TLS - nano /usr/local/etc/stubby/stubby.yml

resolution_type: GETDNS_RESOLUTION_STUB

dns_transport_list:
  - GETDNS_TRANSPORT_TLS

tls_authentication: GETDNS_AUTHENTICATION_REQUIRED

tls_query_padding_blocksize: 128

edns_client_subnet_private : 1

round_robin_upstreams: 1

idle_timeout: 60000 # keep-alive for 1 min, for better performance

listen_addresses:
  - 127.0.0.1@8053   ## Stubby / Unbound ## Default Address/Port

https://raw.githubusercontent.com/getdnsapi/stubby/develop/stubby.yml.example

upstream_recursive_servers:
# IPV4 Servers
# The getdnsapi.net Server
  - address_data: 185.49.141.37
    tls_port: 853
    tls_auth_name: "getdnsapi.net"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q=
# The Fondation RESTENA Server
  - address_data: 158.64.1.29
    tls_auth_name: "kaitain.restena.lu"
    tls_port: 853
    tls_pubkey_pinset:
      - digest: "sha256"
        value: 7ftvIkA+UeN/ktVkovd/7rPZ6mbkhVI7/8HnFJIiLa4=
### Test servers ###
## Surfnet/Sinodun Servers
  - address_data: 145.100.185.17
    tls_port: 853
    tls_auth_name: "dnsovertls2.sinodun.com"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: NAXBESvpjZMnPWQcrxa2KFIkHV/pDEIjRkA3hLWogSg=
# The securedns.eu Server
  - address_data: 146.185.167.43
    tls_auth_name: "dot.securedns.eu"
    tls_port: 443
    tls_pubkey_pinset:
      - digest: "sha256"
        value: h3mufC43MEqRD6uE4lz6gAgULZ5/riqH/E+U+jE3H8g=
# The dns.cmrg.net Server
  - address_data: 199.58.81.218
    tls_port: 443
    tls_auth_name: "dns.cmrg.net"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: 3IOHSS48KOc/zlkKGtI46a9TY9PPKDVGhE3W2ZS4JZo=
# DNSPRIVACY.at Primary DNS TLS Server
  - address_data: 94.130.110.185
    tls_port: 853
    tls_auth_name: "ns1.dnsprivacy.at"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: vqVQ9TcoR9RDY3TpO0MTXw1YQLjF44zdN3/4PkLwtEY=
# DNSPRIVACY.at Secondary DNS TLS Server
  - address_data: 94.130.110.178
    tls_port: 853
    tls_auth_name: "ns2.dnsprivacy.at"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: s5Em89o0kigwfBF1gcXWd8zlATSWVXsJ6ecZfmBDTKg=
# The dns.neutopia.org Server
  - address_data: 89.234.186.112
    tls_port: 443
    tls_auth_name: "dns.neutopia.org"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: wTeXHM8aczvhRSi0cv2qOXkXInoDU+2C+M8MpRyT3OI=
### Anycast services ###
#Tenta ICANN DNS TLS Primary Server
  - address_data: 99.192.182.200
    tls_auth_name: "iana.tenta.io"
    tls_port: 853
    tls_pubkey_pinset:
      - digest: "sha256"
        value: nPzhfahBmQOFKbShlLBymTqPtZY31bPpKFnh0A86ys0=

## End of Sample File  /

Save and Exit


In order to have Opnsense use default start up script (  /usr/local/etc/rc.d/stubby.sh ) at boot time,
you will have to create a boot time start up script for it in /etc/rc.conf.d/. Not to prolong this - do the following :
# nano /etc/rc.conf.d/stubby   -   in the new file enter the following two lines:

stubby_enable="YES" 
stubby_bootup_run="/usr/local/etc/rc.d/stubby.sh"

Save and exit

Then make the file executable - once again - works for me:

# chmod 744 /etc/rc.conf.d/stubby
# chmod a+x /etc/rc.conf.d/stubby

----

Now you must configure your  Unbound DNS Server to use Stubby for DNS Over TLS.

UNBOUND GENERAL SETTINGS
Network Interfaces =   WAN LAN ( all of your LAN interfaces if you have more than one )
And You Must Select  Localhost - repeat -  You Must Select  Localhost!

Under Custom options enter the following :

server:
do-not-query-localhost: no
forward-zone:
name: "." # Allow all DNS queries
forward-addr:127.0.0.1@8053

## END OF ENTRY

Outgoing Network Interfaces  =  Localhost

Make Sure to NOT CHECK - DO NOT CHECK -  the box for DNS Query Forwarding.

Save and Apply Settings

Next -Under System > Settings  > General Settings

Set the first DNS Server to 127.0.0.1   with no gateway selected  /   
Make sure that DNS server option:

A - Allow DNS server list to be overridden by DHCP/PPP on WAN -  Is Not I repeat - Is Not Checked !

and DNS server option

B -  Do not use the DNS Forwarder/Resolver as a DNS server for the firewall Is Not  - I repeat - Is Not Checked !

I now only run  127.0.0.1  ( Localhost ) configured as the only DNS SERVER on my WAN interface.
If others were added to WAN, when I ran dig or drill commands /etc/resolv.conf allowed those addresses to be queried.
I  only want to use Stubby yml Name Servers for DNS TLS , so this was the determinative factor in my reasoning and decision.

13

19.1 Legacy Series / Re: Revert unbound to 18.7.7 - not possible?

« on: March 04, 2019, 09:54:52 pm »

@chemlud

I've experienced your exact predicament and I took the "Stubby" rout after the 19.1 release following the "directnupe" guide. As far as I can tell it's working very well. I'm on 19.1.2 LibreSSL flavour.

https://forum.opnsense.org/index.php?topic=10062.0

miroco

14

Hardware and Performance / Re: PCENGINES APU[1-5] Bios

« on: February 13, 2019, 09:08:01 pm »

Hi till,

As far as I can tell, 3mdeb is a company specialized in embedded systems, particular firmwares. The lightly scenario is that PCengines contracted 3mdeb for the development of firmares for their APU series products.

http://www.pcengines.info/forums/?page=post&id=4C472C95-E846-42BF-BC41-43D1C54DFBEA&fid=6D8DBBA4-9D40-4C87-B471-80CB5D9BD945&pageindex=2

https://calendly.com/3mdeb


miroco

15

Hardware and Performance / Re: PCENGINES APU[1-5] Bios

« on: February 13, 2019, 01:03:19 pm »

It was perhaps a glich or an outage of some sort. However, all five BIOS-versions are/was accessable as of 13:00 CET.


miroco