Messages

31

20.7 Legacy Series / Re: Swap used to 70%?

« on: November 29, 2020, 02:04:17 pm »

Since 20.7.4 it is better again. Still more swap is used than before. But no service is stopping any more.

32

German - Deutsch / Re: mehrere Subdomains via Port 80/443

« on: November 29, 2020, 02:01:23 pm »

Not hidden - it is on almost every page on the bottom.

Vielen Dank!
Ich habe den Knopf gefunden, hatte aber niemals diese Funktion damit verbunden.

33

German - Deutsch / Re: mehrere Subdomains via Port 80/443

« on: November 22, 2020, 01:44:17 pm »

Muss man nicht. Reload button klicken reicht.

" Reload button"?

Thank you. I found the "reload" function in the console menu and will try out the next time.
But button? Somewhere hidden in the GUI?

34

German - Deutsch / Re: mehrere Subdomains via Port 80/443

« on: November 21, 2020, 02:31:47 am »

Die Config kann weniger und wird daher vielfach als einfacher angesehen.

HAProxy ist in OPNsense mehr oder weniger ein Load Balancer und der nginx kommt mit zusätzlichen Funktionen wie WAF, UDP Lastverteilung, Web Server, ...

Danke.

Bei Regentagen werden ich mal wieder HAProxy für den reinen Zweck des Reverse Proxy (Thema dieses Threads) testen. Ich hatte damit gestartet und bin verzweifelt.

Nginx läuft bei mir. Mich ärgert nur, dass ich OPNsense jedes Mal neu starten muss, wenn ich etwas an der nignx-Konfiguration ändere. Ohne Neustart der gesamten Firewall werden die Änderungen nicht aktiv, auch ein Neustart von nginx hilft nicht.

35

German - Deutsch / Re: mehrere Subdomains via Port 80/443

« on: November 18, 2020, 01:28:24 pm »

HaProxy ist dein Freund.

HAProxy wird als reverse proxy unter OPNsense meist empfohlen, nginx seltener.
Mal die Funktion load balancing ausgeschlossen, welche Argumente sprechen für HAProxy statt nginx?

36

German - Deutsch / Re: mehrere Subdomains via Port 80/443

« on: November 16, 2020, 01:05:42 pm »

Frage: welches ist der sinnvollste Weg, diese Weiterleitungen zu den jeweiligen Subdomains einzurichten?

Um mehrere Webserver hinter der Firewall über Port 80 und 443 verfügbar zu machen würde ich so vorgehen:
- öffentlich erreichbar --> reverse proxy: z. B. plugin HAProxy oder nginx
- nur über eigene Geräte und sensible Daten --> VPN: z. B. openVPN, IPSEc, WireGuard

Ich selbst verwende nginx und WireGuard für diesen Zweck.

37

20.7 Legacy Series / Re: SIP / ALG

« on: November 16, 2020, 12:40:08 pm »

Your rules are wrong.

What is wrong?
Can you please be specific?

38

20.7 Legacy Series / Re: Unbound - DNSBL exclusions for DNS over TLS Servers

« on: October 14, 2020, 02:43:33 pm »

Firewall rule to point your mailserver to another DNS or install a forwarder to you ISP ones on the mailserver direct. And for client use the unbound? Would that be an idea?

Yes, that is more or less what I already described in my first post as possible solutions.
(1) resolver on mail server directly
(2) point mail server to other DNS. My idea additional bind on OPNsense.

As "split functionality" of unbound act as resolver resolver for one host and act as DoT forwarder for everything else is not possible, that's it.

39

20.7 Legacy Series / Re: SIP / ALG

« on: October 13, 2020, 02:49:03 pm »

I do have 3CX running behind opnsense and PPPoE WAN and without using any hidden settings.

Unfortunately I do not have a link to an all inclusive instruction and I cannot find the time to post all my setting in detail. But Some hints for you.

firewall - NAT - port forwarding:
- WAN    TCP/UDP  5060 --> 3CX IP
- WAN    TCP          5061 --> 3CX IP
- WAN    TCP/UDP   5090 --> 3CX IP
- WAN    TCP          5001 --> 3CX IP
- WAN    UDP          9000 - 10999 --> 3CX IP

firewall - NAT - outbound
- WAN    3CX IP  *  *  * interface address *  yes

firewall - rules - WAN
- TCP/UDP  *  * 3CX IP    5060 * *
- TCP         *  * 3CX IP    5061 * *
- TCP/UDP  *  * 3CX IP    5090 * *
- TCP         *  * 3CX IP    5001 * *
- UDP        *  * 3CX IP    9000 - 10999 * *

firewall - rules - DMZ (zone where 3CX is located)
TCP/UDC  3CX IP  *  *  *  *  *

40

20.7 Legacy Series / Re: Unbound - DNSBL exclusions for DNS over TLS Servers

« on: October 13, 2020, 02:26:39 pm »

Whitelisting on the Blacklist Section.

OK. Now we are talking about two different things. I was not talking about the DNSBL function of the unbund plugin. My issue is related to to another server using DNBS and as DNS server my opnsense box with unbound plugin and DoT to a big anycast resolver.

My question is if I can define expeditions for unbound not to use the DoT connection for certain addresses and resolve these addressed by its own.

41

20.7 Legacy Series / Re: Unbound - DNSBL exclusions for DNS over TLS Servers

« on: October 12, 2020, 04:10:42 pm »

maybe you can work with overwrites and set the list as DNS entries there.

A workaround that could help. I will try out.

There is also a whitelist in Unbound which would exclude the DNSBL from these entries.

Here I am not sure what you are talking about. There is a white list called "private domains". But my understanding is that this will disable the filter to block return of local IP addresses (e. g. 127.0.0.x) as typically used by DNSBL as response. Or are you talking about a different setting?

42

20.7 Legacy Series / Unbound - DNSBL exclusions for DNS over TLS Servers

« on: October 11, 2020, 11:39:22 am »

Hello,

it is possible in unbound plugin to define DNSBL addresses as exclusions for DNS over TLS Servers?

I am using opnsense box with unbound as primary DNS server. My mail server with spam filter and DNSBL also is using this box as DNS server. When I used to direct resolve the domain all was fine. But since I changed to use DNS over TLS with Cloudflare server may mail server cannot use all DNSBL list any longer.

Defining exclusion list in unbound is my first idea. Alternatively, setup bind on opnsense additionally for DNBS only or setup an dedicated DNS server directly on the mail server.

43

Web Proxy Filtering and Caching / Re: nginx default_server

« on: October 05, 2020, 01:51:16 pm »

You can use dynamic dns providers if you like to make it easier to call it anyway.

Maybe I was misleading you.

All is fine when using host name even whit dynamic address. I am not intending to call my server by IP.

But if someone does call my server by IP, the response should be a specific server and not the one that currently is shown.

44

Web Proxy Filtering and Caching / Re: nginx default_server

« on: October 04, 2020, 07:56:50 am »

But if someone accesses my server by IP address

you can also add server with your ip in server_name

Thank you. I did not know this.
But unfortunately in my case difficult due to dynamic IP on my home set-up.

45

Web Proxy Filtering and Caching / Re: nginx default_server

« on: October 04, 2020, 07:55:09 am »

As far as I know, it chooses the first server that is in your generated config. That order likely matches your config.xml file. There is no control in the UI.

This could be. At least the server shown by access via IP is the first one that is listed on the configuration page of nginx plugin.

If there now would be an easy way in nginx plugin to change the order without deleting and re-creating everything would be great and solve the issue.