Messages

16

Zenarmor (Sensei) / Re: Source/Destination IPs wrong

« on: February 13, 2023, 07:52:11 pm »

WOW that was it, thank you, I don't remember that every being an option...is this enabled by default? Should it?? I didn't enable it. That did indeed fix the issue.

17

Zenarmor (Sensei) / Source/Destination IPs wrong

« on: February 11, 2023, 11:09:25 pm »

I see the actual source and destination then a couple other random IPs that aren't mine listed for that as well with the interface MAC (usually) as the MAC of the bad IP.

10.105.21.169 is listed as source for the MAC that's supposed to be 10.0.0.5, that's the same for ALL IPs on the network.  There is also this duplicated for a junk IP but the interface MAC is listed. Is this expected? I got an intel Nic for this and it appears to still be broken to some extent, at least.

18

Zenarmor (Sensei) / Re: Mangles local hosts resolution

« on: February 10, 2023, 11:48:31 am »

removed

19

Hardware and Performance / Re: 10gb home internet, nic question

« on: February 07, 2023, 02:44:25 pm »

ZA will cut your speed down a lot, Ive tuned and tuned and ended up disabling ZA as I went from 10Gb to like 5, even in passive monitoring mode. Which seems odd as their target market seems to be SMBs that will have at least 10Gb...All testing I was doing with this was done using iPerf, I verify 10Gb through the firewall, enable ZA, test to verify speed is about half, then I did a bunch of performance tuning but nothing really helped.

20

Zenarmor (Sensei) / Re: Local vs Remote confusion

« on: January 14, 2023, 02:54:22 am »

It doesn't matter, both tie into netmap and as such both will perform similarly as long as you have decent hardware. For context I have 10Gb networking and with ZA enabled passive OR routed bandwidth is cut to ~5gb to about half. SO I don't think it matters and you could just leave it in routed mode.

21

22.7 Legacy Series / X520 vs Mellanox ConnectX3 speed

« on: December 22, 2022, 09:11:12 pm »

I switched from a mellanox card to an intel x520. I was able to get full 10gb using perf between opnsense and my unraid server, after switching to X520 I am getting less than 2 from unraid to opnsense but full 10gb between opnsense to unraid, telling me that I have something misconfigured. Any ideas? Anyone else with an X520 getting line speed?

Edit: I found the issue, sorry! I just didn't look hard enough at the forums.  I found this which helped ALOT.

https://binaryimpulse.com/2022/11/opnsense-performance-tuning-for-multi-gigabit-internet/

From here: https://forum.opnsense.org/index.php?topic=18754.150

Thanks!

22

General Discussion / Re: Getting started with pfELK - single node and MaxMind in Docker

« on: December 19, 2022, 03:20:35 pm »

Reviving this thread instead of starting a new one. I am trying to install pfELK on a machine on my LAN (following the how-to for docker-compose) and have a couple of questions:

1. My machine has modest hardware so I'd like to maximise performance. I thought that it would be a good idea to run pfELK on a single-node setup, so I wanted to modify the docker-compose.yml file accordingly. The only instruction I found on Github was to modify /etc/elasticsearch/elasticsearch.yml, but a) that file does not exist before you start the install and b) I would have thought that docker-compose.yml also needs to be modified. Do I need to change the create certs and environment sections, and if so how? Alternatively, if running three nodes does not consume more resources than a single node, please let me know.

2. Also, I'd like to set up MaxMind, and I'd like to do it on Docker since my machine is running Alpine Linux and I don't think there is a repository for MaxMind available. I have found a Docker container for the purpose, but I am not sure exactly how pfElk speaks to MaxMind so I need some more info to make sure the two can communicate. The pfELK how-to for MaxMind does not mention the required interface with MaxMind so I don't know what the prerequisite is when not installing MaxMind in the standard way.

Just use this:

https://github.com/pfelk/pfelk

Note that under 16gb of ram you could crash the entire system.  You need a min 8gb just for ELK, 16 would be better, plus whatever overhead the host system needs.  You don't want to do this if you don't have the resources as it will not be a fun time for you...

23

22.7 Legacy Series / Re: Unbound quits running sometimes after 22.7.9 update

« on: December 19, 2022, 03:18:21 pm »

Disregard. This problem is occurring due to Suricata 6.0.9 issues found by others. If I just restart Suricata then Unbound I dont need to do a full reboot.
In the interim Ive downgraded Suricata to 6.0.8 from Opnsense 22.7.8 release.

Interesting! I actually saw some issues and completely wiped suricata which helped. Good data point.

24

22.7 Legacy Series / Re: Why does 2FA demand password and token in a single field?

« on: December 18, 2022, 07:38:38 pm »

Yes any modern SSH implementation does password then 2fa prompt, I think we need this as appending is not that useful

25

22.7 Legacy Series / Re: Firewall first allow then reject 30s later

« on: December 18, 2022, 07:37:21 pm »

Don't use floating rules unless you absolutely have to.
Put the rules where they belong, on the actual interface.

Interface groups would be the better way to go if you have multiple interfaces that need the same rules

26

22.7 Legacy Series / Re: Unbound quits running sometimes after 22.7.9 update

« on: December 04, 2022, 02:25:27 am »

The update rebooted very weirdly, there were processes it did not shut down and I had to do a manual reboot as the update did not properly reboot. Unbound is fine here, though, I just updated verbosity in logging so I'll monitor it.

27

22.7 Legacy Series / [OPNsense 22.7.7_1-amd64] vnstat crash/error

« on: November 16, 2022, 02:55:38 pm »

Hello, I get the below error spammed in the log when using vnstat, I do not get any stats though.

[00acf906-9459-4683-964d-7bab56a4b5c1] Script action failed with Command '/usr/local/bin/vnstat -y ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/processhandler.py", line 482, in execute subprocess.check_call(script_command, env=self.config_environment, shell=True, File "/usr/local/lib/python3.9/subprocess.py", line 373, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '/usr/local/bin/vnstat -y ' returned non-zero exit status 1.

28

Zenarmor (Sensei) / Re: 1.12 Mellanox Support

« on: November 10, 2022, 08:52:20 pm »

Awesome thank you for confirming.

29

Zenarmor (Sensei) / 1.12 Mellanox Support

« on: November 10, 2022, 07:42:56 pm »

Does 1.12 support Mellanox nic's yet?

30

22.7 Legacy Series / Re: CrowdSec

« on: October 05, 2022, 11:01:50 pm »

22.7.5 that was released today finally fixed the firewall log issue, I can confirm it shows all blocks properly! Nice work Crowdsec!