Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Topics - elektroinside

#21
18.1 Legacy Series / NTPD errors in the log
February 03, 2018, 12:33:32 AM
I have this error in the logs:

# ntpd[34637]: mlockall(): Cannot allocate memory

The sync is working though, the daemon is up and running.

Time is crucial for me. Should I be worried?
#22
18.1 Legacy Series / 18.1.1 & acme client
February 02, 2018, 01:16:14 PM
Think this was fixed, was it a patch that fixed it?

[Fri Feb  2 14:10:45 EET 2018] original='{
  "type": "urn:acme:error:malformed",
  "detail": "Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]",
  "status": 400
}'
#23
18.1 Legacy Series / 18.1 release
January 29, 2018, 08:57:03 PM
I would like to congratulate the OPNsense team (and the community) for this massive achievement.
The world is safer and better because of you guys!

Thank you, truly.
#24
"Move selected rules before this rule" in Firewall: NAT: Port Forward is not working for me.

OPNsense 18.1.r2-amd64
FreeBSD 11.1-RELEASE-p6
OpenSSL 1.0.2n 7 Dec 2017

Didn't used it before, as i created my rules in the right order from the beginning. But i had to delete an older rule so that it could be re-created last in the list in order to modify the "priority". The little "left arrow" icon is not working.
#25
General Discussion / DNS related task
January 25, 2018, 07:23:54 PM
So, I was thinking...
I never heard of something similar, just came up with this idea, but maybe there's a way to do it.

The environment simplified:
So you got two (or more) DNS servers, each with its own records. Both (or all) might resolve the same hostname or only one of them can resolve the hostname, or none of them can resolve the hostname.

The task:
So you need to query a hostname. I would need a solution to get the resolved hostname ONLY if both (or all configured) servers are able to resolve it. If even one fails, do not resolve the hostname, stop querying the rest of the remaining servers and return the specific error "could not find host..."

Imagine the possibility to combine the power of OpenDNS with Adguard. Or other similar services.

Is it possible with OPNsense?


#26
This would be the starting point:
https://suricata.readthedocs.io/en/latest/performance/ignoring-traffic.html

It would be very nice if these could be implemented in the GUI, at least capture filters, as they look like easy to implement :)

Many thanks!
#27
So...

Another issue:

- WAN link is PPPoE (it's known IPS won't work with this, yet, because of the freebsd kernel)
- IDS without IPS will list alerts for WAN (even if PPPoE), LAN and also the VPN interface (if you create one and add it to IDS)
- IDS+IPS is only working on the LAN interface, so the VPN interface is also failing to be scanned

I'm guessing this has something to do with the WAN being PPPoE, but can anybody confirm this, please?

Also attached a screenshot with IDS without IPS...

Thank you.
#28
I use these techniques for my home network and many of my clients. IDS/IPS needs occasional maintenance. Combine these with 'Security through obscurity' philosophies and techniques and you should be safe enough. Obviously, nobody but yourself is responsible for your deployment.

INTRO

IDS/IPS will not block viruses like an AV but rather they are complementary to each other. IDS/IPS will scan network traffic (packets) while the AV scans files. Both work with rules/signatures, both heavily dependent on these (except some newer technologies).

There's always a compromise to be made between speed and security. I prefer obviously both if possible, but this is difficult sometimes.

I prefer IDS/IPS in inline mode as it's lightning fast. The protection it offers is as good as your rules are. Combine this with a good DNS service and you will get a nice and fast security.

Please be aware that IPS rulesets like ET open/emerging-current_events and ET open/emerging-dos - I don't know the exact rule(s) in the ruleset(s), though - can cause issues, in between internal interfaces, like RDP sessions, Windows Updates, Veeam Back-up speed/ sustainability, etc. The most important thing, those issues weren't listed on "Alerts" list. Neither as blocked, neither otherwise. The advise for everyone would be, especially if on a production/ critically available network, to check rulesets and rules on an one-by-one activation/ deactivation approach, especially if network services are crippled without any apparent reason.

Getting ready

1. BACKUP OPNSENSE FIRST (absolutely mandatory and first step): System: Configuration: Backups
In the case something goes wrong, you can always revert using the backup set.
2. Copy-paste this comment in a txt file on your test machine and save it
3. Run a few speedtest.net to verify performance and throughput before and after these techniques are deployed in your environment

Networking

1. Go to System: Settings: Networking
2. Disable all hardware offloading (they are by default, but please verify)

DNS

Some particular public DNS servers will block queries pointing to malicious websites. I use OpenDNS or AdGuard DNS servers. OpenDNS will block no ads but more malware, AdGuard will block ad servers but less malware.

OpenDNS servers: there is a client integrated into OPNsense for this, create an account on OpenDNS.com and just fill in the form in OPNsense:Services:OpenDNS, the GUI will fill in the DNS servers from step 1 below for you. Follow/verify the rest of the steps.
AdGuard: https://adguard.com/en/adguard-dns/overview.html

Let's go with AdGuard as it is easy to verify and this one you need to manually configure:

1. Go to System: Settings: General
2. In the DNS servers field, delete everything and add these (don't configure gateways, leave it on none):
176.103.130.130
176.103.130.131
2a00:5a60::ad1:0ff
2a00:5a60::ad2:0ff
3. Uncheck if not already: 'Allow DNS server list to be overridden by DHCP/PPP on WAN' and 'Do not use the DNS Forwarder/Resolver as a DNS server for the firewall'
SAVE
4. if you use Unbound DNS (OPNsense default), go to Services: Unbound DNS: General
5. Check if not already: 'Enable Forwarding Mode'
6. Uncheck 'Enable DNSSEC Support' (if you use OpenDNS or AdGuard, none of these supports this feature)
SAVE
7. Just to be sure everything works, reboot and check your internet connection on that one machine

IDS/IPS

1. Go to Services: Intrusion Detection: Settings tab
2. Check these:  Enabled,  IPS mode (do not check promiscuous mode unless you have multiple interfaces or VLANs)
3. If you have newer Intel CPU (so not an AMD) in the OPNsense box, most probably you can select as pattern matcher 'Hyperscan'. You will have to dmesg in the console to verify. If no SSE3 (so a newer Intel CPU), leave the default Aho-Corasick
4. Select WAN and LAN in interfaces. If you have a PPPoE link, WAN won't work.
5. Select all Home networks
6. Choose something for log rotation (whatever suits you best).
APPLY
7. Go to Download tab, select all, Enable then Download & Update rules
8. After everything is downloaded and enabled, edit each one, one by one, and select "Change all alerts to drop actions"
9. Select all again, download and update rules
10. Reboot just to be sure
11. Open this website https://www.wicar.org/test-malware.html and click on "EICAR TEST-VIRUS"
12. If nothing downloads, it works. If it doesn't work, a txt file will be downloaded (will not harm your PC in any way, it is a test virus)
13. Go to Services: Intrusion Detection: Schedule tab and configure a cron job so that the rules are automatically refreshed once a day (for 12AM each day, enabled: check, minutes: 0, hours: 0, day month: *, months: *, days week: *, command: update and reload ids rules)

What to do when something is not working (can't open a website, torrents don't work, can't connect to something)

1. Go to Services: Intrusion Detection: Alerts tab
2. In the search box, type blocked
3. If you found a rule you wish to unblock, edit it (click on the pencil icon) and select 'Alert' for 'Configure action', instead of 'Drop'
4. Go back to Services: Intrusion Detection : Rules tab and click 'Apply'

Further debugging

1. Go to to Services: Intrusion Detection and disable IPS mode.
Please verify things are fully working, browse some websites, and also check that you have alerts and all are reported as 'Allowed'.

2. Then, go back to Services: Intrusion Detection and enable IPS mode.
Then, go to 'Download', take each ruleset one by one, and set to 'Alert'.
Then, go to 'Rules' and hit 'Apply'.
Please verify things are fully working, browse some websites, and also check that you have alerts and all are reported as 'Allowed'.

3. Then, go to 'Download', take each ruleset one by one, and set to 'DROP'.
Then, go to 'Rules' and hit 'Apply'.
Please verify things are (at least partially) working, do some wicar tests (please try at least the eicar test file), browse some websites, and also check that you have alerts, some are reported as 'Allowed' and some as 'Blocked'

4. Go to 'Alerts', select a 'blocked' packet (do this with the eicar test file), edit it and set it to 'Alert'.
Go back to 'Rules' and hit 'Apply'.
Try to download the eicar file again, it should work this time. If it does, set it back to 'Drop' and hit. 'Apply' again from the 'Rules' tab.
Please verify things are (at least partially) working, do some wicar tests (please try at least the eicar test file), browse some websites, and also check that you have alerts, some are reported as 'Allowed' and some as 'Blocked'

If still absolutely nothing works, verify each step here, concentrate, read every word, don't skip anything unless you know what you are doing. If still nothing is working, go to System: Configuration: Backups and restore your backup. Then stop reading :)

Verify results:

1. wicar tests should fail (most of them) -> the site with the eicar test virus, there are more tests there
2. if you choose AdGuard dns servers, most of the ads in websites/ games etc will disappear and everything will load faster
3. if everything works, run a few speedtest.net again and compare

With these techniques, you should have a good protection and speed as well. If you wish to tweak these more, you can configure your OpenDNS account and filter out more categories to block. With another set of AdGuard servers, you can block Default + blocking adult websites + safe search (Family protection DNS servers).

Relying also on DNS, you may want to make sure all DNS queries from the clients go to the ones you configured, even if the clients override them locally. So if you wish, you can enforce this with a firewall rule:

Go to Firewall: NAT: Port Forward and click on the plus sign (create new rule)
1. Interface: LAN
2. TCP/IP Version: IPv4
3. Protocol: TCP/UDP
4. Source: any
5. Destination/Invert: checked
6. Destination: LAN address
7. Destination port range: from DNS to DNS
8. Redirect target port: DNS
9. Description: whatever you want
10. NAT reflection: Disabled
SAVE/APPLY

With these settings, I just got these results (from Romania, ISP is RDS with Fiberlink 1000 line, 1Gbit/sec download, 500Mbit/sec upload theoretical link, both are up-to values, with an i3-8100 CPU):
-with Amsterdam: http://www.speedtest.net/result/6972207406
-with Romania: http://www.speedtest.net/result/6972210834

That's it :)


#29
Figured i should not keep this to myself and open a new topic not to flood another.

So, sometimes the PPPoE interface is not loading when it should (18.1.r1, 18.1.r2) and pf restart is required after an OPNsense reboot in order for the interface to work (otherwise, no internet connection for LAN clients, just the OPNsense box).

@Franco, i have sent you a PM with system logs, as you asked me the other day.

Thank you!
#30
Another strange thing i noticed after upgrading to 18.1.r1:

With 18.1.r1, IDS+IPS enabled, download speed decreased to about half ~550Mbit/s. Disabling IDS+IPS i'm back to my full speed ~980Mbit/s
Same IDS+IPS rules, same everything, but with 17.7.11: ~980Mbit/s

IDS+IPS was up and running in both cases, as i could see my own rules being blocked, some other rules being blocked, exceptions being passed and so on...

This https://forum.opnsense.org/index.php?topic=6590.0 actually made things worse for me so i deleted the stuff i added (while i was on 17.7.11)...
#31
Franco, switched to devel, upgraded to rc1  ;D
Just couldn't wait  ::)

But now.. OpenVPN server will not start:


Jan 12 20:46:02 openvpn[56490]: Use --help for more information.
Jan 12 20:46:02 openvpn[56490]: Options error: --verify-client-cert none|optional must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin
Jan 12 20:46:02 openvpn[56490]: DEPRECATED OPTION: --client-cert-not-required, use --verify-client-cert instead
#32
Intrusion Detection and Prevention / Windows Updates
January 12, 2018, 04:01:31 PM
One (or more) of the Suricata rules brakes Windows Updates, but I am unable to find which one since there are no "blocked" alerts in the GUI.

Is there some other way to find out?
#33
Hardware and Performance / Intel Wifi 8265 / 8275
January 10, 2018, 11:05:33 PM
I got this showing up in pciconf:

none4@pci0:6:0:0:       class=0x028000 card=0x10108086 chip=0x24fd8086 rev=0x78 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Wireless 8265 / 8275'
    class      = network

It is, of course, my wifi adapter of the https://www.gigabyte.com/Motherboard/Z370N-WIFI-rev-10 mb.

Is there any way to install it so I can create a guest network, preferably AC (but anything else should be fine in the end)?

Found these:
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220229
https://lists.freebsd.org/pipermail/freebsd-current/2017-October/067155.html

Unfortunately, this is way over my head, I would need some help if possible.

Many thanks!