Messages

I don't think proxy has anything to do with the issue. That proxy you are referring to - by default - only works for port 80/443 (and maybe ftp and socks) and it is for browsing only, nothing to do with your db ports.

Actually, this is how it should work, i'm not entirely sure with OPNsense though as I don't use proxy, but i highly doubt it's set up to proxy any other ports.

Ah, ok.

But if the clients are all on the lan side, you don't have to create port forwards in OPNsense to connect to the other clients.
I think the problem lies elsewhere.
You should verify that you do not block the local subnet / bogon networks on the LAN interface in OPNsense.
You should verify your firewall rules as well.

You are blocking something on the LAN side with OPNsense. By default, you should be able to connect from the LAN to the LAN without any other setting.

1. The clients are all on the same local subnet?
2. Or, would you like to connect from the internet to that database?

Are you absolutely positive, 100% sure that you would like to open ~5500+ ports and expose those ports to the internet (if this is the case)?

As phoenix said, it would be helpful for us to know what are you trying to do.
Nevertheless, for any port forward, you should follow this guideline (take it step by step, and verify each one if possible):

1. Start the process on a PC that you would like to connect to (with the port forward) and verify it's config, make sure you got the port right
2. Create a local firewall rule (e.g. in Windows Firewall / Inbound rule) for that port (allow it) and pay attention to the selected profile (domain, private, public)
3. Verify that you can connect from another PC in the same subnet to that machine and port (easiest is with telnet, install it if not already installed)
4. If it works, move forward, if not, check that the process you are trying to connect to is up and running (not suspended or something) and that it uses the port you configured in the local firewall
5. Go to OPNsense and allocate a static IP for the machine you are trying to connect to (if you would like to make this port forward permanent, you cannot skip this step, you have to make sure that the exact same IP is always allocated to that same machine even when leases expire).
6. Next, make sure the IP you configured is allocated to the machine; if not, go to network settings on your machine and renew your ip (you can do that easily by disabling/enabling the network interface). Re-verify!
7. Next, go to OPNsense Firewall:NAT:Port Forward and set as source IP the WAN address, source port: any, destination IP: your machine IP, destination PORT: the port you are trying top connect to. Apply.
8. Verify, from the internet, that you can connect from the internet to your WAN IP : PORT you configured in your port forward
9. You should harden your firewall rules by various techniques in order to secure your exposed IP:PORT

You can't create one port forward rule for 35 pcs. You have to tell OPNsense (or any other firewall for that matter) which source IP/port to forward to which destination IP/port. You can't do that by a collection of IPs in one alias as destination, as there will be [source] IP(s)/port(s) to [destination] 35IPs/port(s). You need [source] IPs/port(s) to [destination] 1IP/port(s).

In other words, you can only have 1 IP as your destination IP for the forward to work correctly.

I can't imagine one (and the same) TCP/UDP stream to be forwarded to 35PCs at once at the same time.

You have to allocate IPs and create rules for each machine in your lan. If you need to forward the same destination port, choose different ones for each machines as source ports.

First, if you need this to be permanent, allocate static IPs for those machines on the LAN side from Services:DHCP Server. Restart the network interface(s) on those machines to make sure the IPs are allocated (verify on local machine).

Then, go to Firewall:NAT:Port Forward and according to your network setup, create a port forwarding rule for your machines.

Also, do not forget to edit your local firewall rules on your machines (eg. Windows Firewall) to allow inbound connections to those ports.

Can't collect the logs, I forgot to apply the aliases patch, can't connect to my box (remotely).

Hi Franco,

Unfortunately the pf restart issue happened again. I'm on my way to a client so logs later, also i got a feeling that i accidentally updated to r1. I'll report back once i'm done with the client.

Thanks

Ok, this made me think, the CPU usage... for some reason i missed that promiscuous mode was enabled. This was the cause. Disabling it obviously fixed it :)

Apologies.

Maybe it has something to do with dhcp leases? have you tried restarting the service to renew them?
Services -> Diagnostics -> dhcpd -> restart icon

Nope.. this didn't help either.
Further more, i just noticed suricata eats a lot of CPU now, while speedtesting. Didn't noticed this before.
Take a look at the attached image.

I think, for some reason, the quad core 3.6Ghz i3-8100 is maxed out now, at least on one core, as 25% CPU corresponds to 1 core maxing out.

I think for some reason it worked with multi-core CPUs before, multiple threads maybe, but not anymore. Is this possible?

Nope.. same thing unfortunately...

Sure thing Franco, whenever you feel like it.
Well, so far so good, 5+ reboots, no failures as of yet. I'll stick with this version until r2, unless you want me to try out something else.
I'll build a vm as well later, but that will not help as much with the pppoe issue, as access to my rack is a bit difficult (to change cables and stuff).

Thanks again for everything!

I think it worked Franco! I am unable to reproduce the issue!

Awesome job! :)

Can i switch back to LibreSSL? I think i can't just yet :)

Personally, i have one more remaining issue, maybe you could also shed some light there:
https://forum.opnsense.org/index.php?topic=6855.0


Many thanks!