Messages

31

22.7 Legacy Series / Re: CrowdSec

« on: September 07, 2022, 08:02:41 pm »

Any updates on this? Live logging is still broken in 22.7 I'm sure it works great but something is still messed up.

32

22.7 Legacy Series / Re: CrowdSec

« on: August 29, 2022, 05:54:24 pm »

Hi!

I do not know where to write, so I write here.

In my Firewall:Log Files:Live View, when blocking IP using CrowdSec, a line is displayed indicating only the date and time without any details, and only this is reflected in the details:

__timestamp__   2022-08-10T12:25:00
action   0x0
anchorname   match
dir   
interface   in
interface_name   in
ipversion   240
label   
reason   4
rid   
rulenr   crowdsec
subrulenr   em1

At the same time, it is not clear whether the IP address is blocked or not (action   0x0).

bumping this - anything blocked via a rule should show up in the firewall logs properly, is this something crowdsec needs to fix? Currently you just have to take its word that its blocking anything.

33

22.7 Legacy Series / Re: 22.7.2 Wireguard service won't start

« on: August 29, 2022, 02:37:06 pm »

@somebod3983 all you need to do to use the WireGuard kernel module is run the command below at the OPNsense cli. No need to uninstall go. May need to restart the service to reestablish any ongoing connections. All current peers and setting in the WireGuard settings gui will be used without any others action needed.

Code: [Select]

pkg install wireguard-kmod

Im assuming the FW needs rebooted after this? Also wireguard go service fails to start, assuming that's OK as kmod is running and everything works just fine.

34

Zenarmor (Sensei) / Re: zenarmor 1.11.4-rc1 packages are available for OPNsense 22.7 RC

« on: August 19, 2022, 06:16:53 pm »

I know you could be correct but the fact that suricate works means that my mellanox cards do indeed work with netmap, so maybe more of an issue in zenarmor? I couldnt find too much on the bsd side that would indicate mlx drivers were broken.

Edit: I should have specified, Suricate in IPS mode works with mellanox so netmap should be fine

35

General Discussion / Re: Crowdsec firewall blacklists

« on: August 04, 2022, 03:11:53 pm »

Hello!

I suppose you are running the 1.0 version (crowdsec 1.3.4), with opnsense 22.7

> Enable Firewall Bouncer (IPS)
> When this is enabled I get no alerts for blocks in the firewall logs.

You mean you don't see anything in /ui/diagnostics/log/core/filter ?

or with

Code: [Select]

# cat /var/log/filter/latest.log  | grep 'blocked by crowdsec'
Is the process "crowdsec-firewall-bouncer" running?

What's in /var/log/crowdsec/crowdsec-firewall-bouncer.log ? If you enable verbose debug in the settings tab, you should see the calls to pfctl there too.

Another thing to try (for ipv4):

Code: [Select]

# pfctl -t crowdsec_blacklists -T show

Interesting, so expected behavior is instead of showing up in the firewall logs you have to use terminal and tail the actual log? Thats good to know, I may need to disable the bouncer then, and just use the v4/6 blocklists manually so I can properly audit them without needing a custom solution.  Im assuming the IDS part is enough to track and report the rogue IPs, so that should work fine.

36

General Discussion / Crowdsec firewall blacklists

« on: August 03, 2022, 06:03:20 pm »

I have crowdsec and its working well.  I already have a central node so I was able to tie opnsense into it just fine.  I had a question though, I see this:

Enable Firewall Bouncer (IPS)

When this is enabled I get no alerts for blocks in the firewall logs. I have to disable this to get any alerts from my block rules. Is this expected?

Enable log for rules

I enable the above and I get some alerts but they are all blank, with no info except that it came from crowdsec.  Basically I want to make sure the crowdsec lists are being blocked correctly and since they wont show up in the logs its a bit difficult. It seems like the firewall bouncer is needed to block detections on the firewall but needs to be disabled to get blocks to show up in the logs using the blocklists that ship with crowdsec.

37

Zenarmor (Sensei) / Re: zenarmor 1.11.4-rc1 packages are available for OPNsense 22.7 RC

« on: August 01, 2022, 02:20:28 pm »

Dear zenarmor users,

We've shipped zenarmor 1.11.4-rc1 on the OPNsense 22.7 branch.

This release is meant for compatibility with the upcoming OPNsense 22.7 release.

Please feel free to report any issues you've encountered and we'll get them all sorted out before OPNsense 22.7.

Does this include support for mellanox nics yet? Or is that a BSD driver limitation.

38

22.7 Legacy Series / Re: Unbound Restarting every 2 hours after upgrade to 22.7

« on: August 01, 2022, 02:18:46 pm »

It does coincide

https://www.imagebam.com/view/MEBZHA2

https://www.imagebam.com/view/MEBZHA5

Interesting..In any case, unbound should not restart on WAN renew anyhow right? Unless im missing something Personally I dont have WAN interface selected in unbound anyways.

39

22.7 Legacy Series / Re: Unbound Restarting every 2 hours after upgrade to 22.7

« on: August 01, 2022, 02:15:54 pm »

Might be a side effect of https://github.com/opnsense/core/issues/5624

Need to check on Monday.

I need one info from everyone having this issue: under WAN settings, what is your IPv4 type?


Cheers,
Franco

Im using iPv4/DHCP only

40

22.7 Legacy Series / Re: Unbound Restarting every 2 hours after upgrade to 22.7

« on: July 29, 2022, 11:12:54 pm »

Every 20 minutes here, fun times

41

22.1 Legacy Series / Re: Default deny / state violation rule

« on: July 17, 2022, 02:50:55 am »

My issue was fixed alleviated doing the following:

• Navigate to Firewall > Settings > Advanced/li]
  
  • Go to Miscellaneous > Firewall Optimization
  • switch from "normal" to "conservative"
  
  This caused any of my "FA" and "FCA" TCP packages to stop being blocked, which was causing intermittent issues in certain applications (like connecting via SSH across different local networks).  Changing the algorithm helped me idle a lot longer, but it still disconnects.
  
  This is driving me nuts!

I did this, we will see. I have plenty of resources so shouldn't hurt anything.

42

Hardware and Performance / Re: 10GB LAN Performance

« on: July 17, 2022, 02:47:03 am »

Mellanox ConnectX-3 10gb SFP dual port here, 1 to WAN and 1 to my LAN. No tunables set up.

That’s interesting. I have Chelsio NICs, which are supposedly well supported, but I had to mess around with tunables and settings before I managed to get netmap to run in native mode and offer half decent performance. https://forum.opnsense.org/index.php?topic=25263.0

further testing is seeing sub optimal speeds. 1 direction is 9.4gb or so (fine) the other direction is 5-6gb. I think that comes down to single thread performance. I have a good (older) cpu in a rack server and iperf doesnt even touch it but im thinking single thread is the issue as iperf is single thread even with -P set, as that only is streams and (my understanding is) that mulkti stream is still all single threaded per the og dev.

43

22.1 Legacy Series / Re: os-ddclient

« on: July 17, 2022, 02:42:34 am »

Im assuming the legacy dyndns client is going away in the new update? If so I need to migrate all the cloudflare sites to the new system but I dont see a cloudflare API option in the "new" plugin.  How are people managing cloudflare dns updates in this plugin? Also if we are keeping the "legacy" plugin in some form Id prefer that as it just works for all our sites.

44

Hardware and Performance / Re: 10GB LAN Performance

« on: June 07, 2022, 12:15:27 am »

Good to hear those speeds are achievable. What NICs do you guys use? Did you have to fiddle with tunables in order to get the performance?

Fwiw I looked at Vyatta also but didn’t really see the point. Nftables in itself is straightforward enough so not so much gained vs a vanilla Debian - where you also get more flexibility. In both cases losing out vs OpnSense’s awesome gui.

Mellanox ConnectX-3 10gb SFP dual port here, 1 to WAN and 1 to my LAN. No tunables set up.

45

Hardware and Performance / Re: 10GB LAN Performance

« on: June 04, 2022, 03:34:12 pm »

It may just come down to BSDs lacking driver support for many things which is where unix shines since the community is much much bigger. That said, I can get a solid 9.8gb natted over opnsense, running an older xeon here. I get 9.8gb from opnsense to my unraid server running iperf3 (using -P8 for 8 threads) but unraid server to opnsense is only ~5-6gb sometimes 4, but I think that has more to do with unraid at that point since Im able to do 10gb 1 way.