Messages

I prefer IDS/IPS + custom DNS services like OpenDNS or AdGuard as a protection layer (with enforced rules for DNS queries), instead of proxy, in "office" environments.
But this is just me.

I know the headaches a proxy server can give to you in such environments if it's not properly maintained. IDS/IPS needs some attention as well in the beginning, a few days to see what's being blocked (and to allow stuff if necessary). General performance is just poor and waste of resources with proxy, this is how it works. "Unrestricting" ips sounds like making the proxy server almost useless...

It has its own applications, no doubt about it, maybe you really need it, but also maybe you can try protecting your network is some other ways and would be good enough. I'm not trying to make you change your mind here, just consider other stuff as well.

This is a good article describing various protection techniques, many of them available in OPNsense as well:
http://resources.infosecinstitute.com/network-design-firewall-idsips/

Otherwise, you need to debug your proxy setup. Since it has been a long time since i didn't use proxy, i forgot many details about it. What i do remember, is that you need proper security certificates to make it work in https as well, not just http (without the need to trust CAs and other stuff with every client), a powerful box if you have many proxy clients, caching properly configured, and many other aspects...

So let us recap:

- you have at your workplace a 35 clients LAN
- you have deployed an OPNsense box and you are the sole administrator of that box
- for some reason you enabled the proxy server on the OPNsense box
- without properly (and manually) configuring LAN clients you cannot make your app work
- also, you cannot access a polish government login website and you cannot debug the reasons

Am i correct up until this point?

Ah, i know what solarwinds is, just didn't know what is the connection between opnsense and solarwinds. Ok, thank you :)

Solarwinds?? What? Where did you see this please? Wireshark? Can you please define what do you mean by "Solarwinds"?
Thank you.

Nope, not working. I can confirm this as well (same build).

Of course, any time.

Yes, well documentation is important, of course, but testing these particular changes i guess will require just a few vms and some time. I'll build a few vms myself very soon, so i will be able to test the upgrade/update, and i'll report if i find something.

Franco, i think it worked! Very well done!!  :)

Thank you!

Here you go:

Filesystem         Size    Used   Avail Capacity  Mounted on
/dev/gpt/rootfs     38G    7.2G     28G    21%    /
devfs              1.0K    1.0K      0B   100%    /dev
tmpfs               22G    194M     22G     1%    /var
tmpfs               22G    360K     22G     0%    /tmp
devfs              1.0K    1.0K      0B   100%    /var/dhcpd/dev

I don't have a wsus server at home :)
But after 18.1 stable is out and after some testing, I'm seriously considering to migrate one of my clients to opnsense, where i do have wsus and also a pretty big AD.

I'm still yet to find out what is causing this behavior. At home, i have only 12 clients, but randomly some are failing to even check for updates.

I'll investigate more these days and report back  :)

Just upgraded to 18.1.r2  ;D

Didn't need to restart pf, OpenVPN working, but aliases still don't work, unfortunately.. There's no /var/db/aliastables until manually refreshed from the console..

Once manually refreshed, even though i had a cron job to refresh them every minute, they still didn't, i had to manually refresh again.

Well, that's the thing... You add "exceptions" to something related to Windows (probably proxy, as the location of settings you described is related to proxy) and then it works.
This is what I don't understand, why is it OPNsense at fault here.

If you are proxy-ing http and https traffic, that's done for ports 80/443 and 2 others on the local machine, and any other (the configured proxy ports) in OPNsense. If you are not allowing http/s traffic except through the proxy server on your LAN, it would make sense to force the client to use a specific proxy server, if you did not configure PAC (proxy auto-config) on OPNsense. In this case, clients do not automatically collect proxy server and manually configured proxy server needs to be added.

But, if proxy is involved, on the client, only 80/443 and two others are proxied (usually). This is what confuses me, why you app works if you configure a proxy, unless your app uses 80/443 to connect to the db as well. In this case, it is proxied.

But maybe your app connects to the server on at least two different ports, the db on the server on port 3306 and the webserver on the server on port 80/443. 3306 most probably is not proxied and should work from the client, and port 80/443 which is proxied only if the client is configured. Isn't this your case?

I'm not the best to explain stuff, but i'll try anyway.
Sure thing, you're very welcome.

Try this:

PC1-the client, with the java app
PC2-the server, with the database

Temporarily TURN OFF windows (or whatever OS) firewall on PC2
Go back to PC1 and type this from the command line:

telnet PC2IP 3306 (eg: telnet 192.168.0.199 3306)

Is it working?

kinda found solution, in internet settings > connections > LAN settings > advanced Ive added exception for server address and application is working now.

phoenix
I cant connect with telnet command - it says failed connect to host on port 3306. Connection failed.
Ping command is working also i can browse local network

You lost me here (again)...
So your app is working after adding a local firewall rule (so not in OPNsense, but in Windows Firewall) as i told you before, but still telnet isn't working?

Ok, this AV (the proxy actually) will not use the ports you want to use for your db (pls somebody correct me if i'm wrong).
Again, i don't think the proxy has anything to do with your problem unless your clients connect from the port (source port) 80 or 443.

I think you should (re)verify your firewall rules on the LAN side.

What AV are you referring to? Where is it installed?