Messages

Im not sure if i have something misconfigured but it appears when my lease expires for my ip on my wan opnsense is not requesting for a new ip address. If i manually request a new ip under the interfaces tab all is good. Any ideas?

Where and how do you manually request a new ip for your OPNsense WAN interface? I just don't see this in the GUI...

Hi,

I fancy a physical button at home, which would kill certain devices network connectivity. Think of kid not stopping playing after several mentions about dinner.... :)

So I could use my BT button which controls rules in my OpenHAB home automation box. That could then call API of OPNSense to toggle certain FW group on/off.

Is there such API, or any samples doing it e.g. using curl? I didn't find API in docs.

Have you looked at the Firewall->Settings->Schedule config? Maybe a different way to accomplish your objective, but of course would require that you eat dinner at the same time  :)

Having recently decided to make the switch to opnsense due to the 'dramas' I wanted a quick way to achieve this.

I run a PCEngines APU2 4gb, although doubt that will make any difference.

For some reason I had got it into my head I could just import a pfsense config to opnsense, and as it mainly worked off I went.

I'm also a former pfSense user, and wondered if I could import my pfSense backup file to OPNsense. Unlike you, I was fortunate in that my OPNsense install clearly communicated this was not a good idea!

But the real reason for my reply here is to ask you a question :)   What is your impression of the new PCEngines  APU2? I used its predecessor for years, and I loved the hardware.

~S

Are you trying to block traffic coming into your WAN - or from leaving your WAN?

... The first is I'd like to use the unbound dns service from outside of my LAN, so when I am trying to get to a service on a subdomain I can access it from anywhere not just my home. Is this possible or do I have to setup a seperate DNS machine?

Where is the subdomain? Is it in your LAN?

second, I am trying to get it so all http and https requests come through the firewall, yet I can't seem to be able to do this either?

"... come through..." - as in come from the outside/WAN to the inside/LAN?

and lastly I have setup the openvpn with the setup wizard, but trying to connect to it from outside my network results in a timeout, and no connection, any ideas as to why this would happen and what I can do to fix it? Many thanks in advance!

You should take a look at the How-To page for this: https://docs.opnsense.org/manual/how-tos/sslvpn_client.html
My experience with the setup wizard was that it wasn't extremely helpful - it seems to basically just present the configuration page with not much filled out, and no "what are you trying to do" questions that would allow it to make recommendations. Not very "wizard-y", IMHO, but I'm sure others will disagree. In any case, you'll benefit by working through the How-To, and generally perusing the Docs for items of interest.

One final comment: For those that prefer getting their OTPs on their laptop instead of on their phone, Google also has you covered: the "GAuth Authenticator" may be added as an 'extension' to Chrome. After adding the extension, simply copy and paste the "OTP Seed" from your User page into the Authenticator, give it a descriptive title, and it just goes on and on and on....

Your WAN interface is the client. As I understand the DHCP process, the client must know when his lease expires as it's the client's responsibility to reach out to the server before lease expiration, and request a renewal. But as the lease expiration time isn't shown in the WAN interface page, I don't think this is something that's provided in the GUI. But it's gotta' be in the system somewhere -  I'd hazard a guess that it's in the dhclient.leases database.

And FWIW, there is an "Advanced" tab for DHCP Client configuration under the Interfaces->WAN menu, but it doesn't seem to offer an answer to your question. You might want to have a look at it though - may give you some ideas.

Have you set up a second VPN Server instance using a different port?

OK... I get it... the port number should be set (to 1194 in this case) in the VPN server, and then it will appear in the list in the firewall rules form. That makes sense.

Unfortunately, I can't actually confirm that now as I had to rip out my prototype bridging VPN server after I discovered I had broken something in my other (tun) VPN. Still not sorted that flaw, but my current setup only allows a single firewall to connect to the cable modem, and I had other things to do.

Anyway - I'm sure it's as you suggested, so I'll mark this thread 'SOLVED'. And thanks again for your help!

~S

It seems the form for adding a firewall rule limits one to the ports that are in the drop-down list. Is there a reason for this??

I'm setting up a 'backup' VPN server. I'd like to use port 1195 so I can run both VPN servers at the same time, but the form won't allow it. Is there a work-around, or is this a weird browser-specific thing, or... ??

~S

I've installed the vga-amd64 version of the current OPNsense distro. However, I do not get a login prompt on my console monitor after the system finishes booting. Otherwise, the installation works perfectly in all respects (afaik), I can access the GUI, etc. When I connect to the serial port however, I do see the login prompt there (and it does work).

Is this by design?

This seems to clarify things nicely; thank you.

The proxy is independent of the tunnel device, but maybe not so useful on taps ;-)

OK, so I am trying to figure out how to configure the os-igmp-proxy plugin, but struggling with it. While researching this topic, I ran across an interesting (?) website, in which the author states that multicast is not "built in" to the FreeBSD kernel by default, but can be added as follows:

http://troglobit.com/howto/mrouting-in-freebsd/

Just out of curiosity, is the kernel used in OPNsense built with multicasting capability?

And finally, I'd appreciate an informed opinion: Might I be better off (as in have an easier go of it) skipping this multicast can of worms, and using bridging instead of routing in my OpenVPN server?

I'm afraid quotes would only make this more confusing, so I'll address your points this way:

1. Which image, and what do you expect - I cannot follow you.

Ans: The image I was referring to was the QR image that was displayed on the configuration page for the OTP. This image only appeared if the Help link was clicked. But, contrary to the information in the How-To guide at the time, clicking that image took you nowhere.

I am talking about that one - maybe we are not talking about the same thing:
https://docs.opnsense.org/manual/how-tos/two_factor.html

Ans: And what I tried to give you was detailed information - a detailed description for the How-To guide that could be used in lieu of the one that's there now. I think the only point I got wrong was incorrectly calling the QR code an Aztec code. Other than that, I feel the description reflects the way the OTP configuration page is implemented.

Can you provide the URL please?

Yes - this is the same URL that I put in my OP: https://docs.opnsense.org/manual/how-tos/sslvpn_client.html

And again, the passage I am referring to is the paragraph just above "Step 1 - Add SSL Server"

Hope that helps, and again, please let me know if I can do anything to help progress. I wonder if it might be "better" to link the "2 FA Auth How-To" to the SSL VPN How-To?... rather than maintaining the information in 2 places?

~S

I'm afraid quotes would only make this more confusing, so I'll address your points this way:

1. Which image, and what do you expect - I cannot follow you.

Ans: The image I was referring to was the QR image that was displayed on the configuration page for the OTP. This image only appeared if the Help link was clicked. But, contrary to the information in the How-To guide at the time, clicking that image took you nowhere.

2. This is the behaviour of very old OPNsense boxes - I patched the link out of it so I don't think you are referring to a 17.x or 18.x version.

Ans: This was not an "old box"; this is what I saw on the OTP configuration page while following the How-To guide. The OPNsense version was the current one: OPNsense 18.1.2_2-amd64

3. We do NOT provide an Aztec code - it is a standard QR code. An that information is exactly what I have added in the pull request (adding the phone side).

Ans: My mistake - a thousand pardons, please... yes, a QR code, not an Aztec code.

4. Incorrect stuff should be fixed but we need detailed information.

Ans: And what I tried to give you was detailed information - a detailed description for the How-To guide that could be used in lieu of the one that's there now. I think the only point I got wrong was incorrectly calling the QR code an Aztec code. Other than that, I feel the description reflects the way the OTP configuration page is implemented.

~S

OK, now you have it manually working, make some notes, backup the config with a name that tells you what it is then delete the VPN  and  use the wizard to create a new one. Note any differences.

As I said, I use the wizard then tweak.

Thank you again. I think that is an excellent suggestion, and I shall follow it.