Messages

46

22.1 Legacy Series / Re: Floating rule issues

« on: May 20, 2022, 04:44:10 pm »

I get that part, I guess my question is more along the lines of why then does the Floating rules have a default deny all at the top? Wouldn't that logically mean that all the Default deny / state violation rules I'm seeing are from the "System Defined" rule in floating? Some are tagged DF, that's fine, I get that is blocked unless I manually change in FW settings but what about all the traffic blocked that do not have any tags? There isn't really any visibility into why its being dropped except its a state violation of some sort, making it hard to diagnose new drops.

47

22.1 Legacy Series / Floating rule issues

« on: May 20, 2022, 04:21:15 am »

I posted on a couple other threads regarding Default deny/state violations in the logs. On a related note, I have floating rules for certain items but it was my understanding that interface rules applied after floating. Im blocking a lot of IGMP traffic and had to make a new floating rule to allow IGMP on all interfaces. This shouldn't be required...floating rules are applied prior to interface rules so if there are default deny rules in the floating rules they will take precedent over the allow alls I have on each interface...Im also seeing blocked traffic to certain servers from a reverse proxy. all other traffic from that proxy is allowed so I'm not sure why/where the default deny is happening.

48

General Discussion / Re: Having trouble understanding why traffic is being blocked.

« on: May 20, 2022, 01:08:51 am »

Im having this exact same issue. And its actually blocking things, that's how I discovered it. I have many vlans and certain traffic is being blocked due to the opaque "Default Deny / State" error which is odd as I have Allow All inter-vlan and no denies. There should be 0 blocks between vlans. I did check the reasons and there is no flag set on the packets so that rules out a reset flag issue...It blocks connections between different pieces of my network infrastructure and servers as an example. Im curious why there is a default deny rule on the internal networks? I don't see any system deny rules in internal networks, the only default deny rules are on the floating rules default section but there's no explanation of what's being blocked.

Thanks a bunch, this is really screwing with some internal sites that just randomly are inaccessible due to this block.

49

22.1 Legacy Series / Re: Default deny / state violation rule

« on: May 19, 2022, 06:35:47 pm »

I am getting a ton of igmp Default deny / state violation rule blocks in my log, I enabled logging to track down packet loss with some apple HomeKit devices.  Destination is 224.0.0.1 so its clearly multicast.  Is this an issue or can it be ignored?  I do get pass traffic on 1 vlan but the rest of the vlans get dropped. Source is all my switches:

Opnsense --> Aggregation switch --> Main switches/poe switches/servers

The blocks are originating from every switch but 1 which is interesting.

Edit: I also get blocks from a reverse proxy on 1 vlan to a server on another vlan. Both vlans have default allow all rules internally.

50

22.1 Legacy Series / 2.5gbe wan port

« on: May 07, 2022, 03:07:41 am »

I’m curious why the rate in my wan settings is 10gbe rather than 2.5? I have a 2.5gb link. Is this just a bug or is it actually negotiating at 10gbe? Thanks!

51

22.1 Legacy Series / Re: Unbound log full of errors

« on: April 11, 2022, 11:04:52 pm »

Hmm how fresh? Im on a fresh install and it definitely doesn't do that. Are you sure its "fresh"? Any odd hardware? Static leases doesn't do that...unless something perhaps is corrupted.  Did you try running the health check in the package manager?

52

Zenarmor (Sensei) / Re: Mellanox cards

« on: April 08, 2022, 09:12:19 pm »

Ok thank you. Good thing my renewal coincided with the hardware upgrade 🤣 I’ll keep an eye out for changes though as I did enjoy using it.

53

Zenarmor (Sensei) / Mellanox cards

« on: April 07, 2022, 02:50:49 pm »

Just an FYI mellanox is not supported for the default netmap profile. I was able to install and enable but lost connectivity and had to ssh in and manually remove zenarmor from the terminal as it was crashing everything.  Is this expected? Thank you!

Edit: I see this - https://forum.opnsense.org/index.php?topic=17363.180 where mlx devices are being tested...did that ever work?

54

22.1 Legacy Series / Re: Unbound log full of errors

« on: April 07, 2022, 02:45:40 pm »

Check and make sure you are not logging ALL queries...unbound will have hundreds of thousands of requests at times, and if you have all logging enabled it will show stuff like that but most likely it is fine...

Hi,

After some days using a fresh OPNsense install, I noticed that unbound logs are just filled up with these errors:

Code: [Select]

2022-02-17T00:53:25 Error unbound [97508:1] error: recvfrom 22 failed: Protocol not available
2022-02-17T00:53:24 Error unbound [97508:1] error: recvfrom 21 failed: Protocol not available
2022-02-17T00:53:23 Error unbound [97508:3] error: recvfrom 21 failed: Protocol not available
2022-02-17T00:53:22 Error unbound [97508:1] error: recvfrom 25 failed: Protocol not available
2022-02-17T00:53:22 Error unbound [97508:0] error: recvfrom 22 failed: Protocol not available
2022-02-17T00:53:22 Error unbound [97508:3] error: recvfrom 24 failed: Protocol not available
2022-02-17T00:53:22 Error unbound [97508:3] error: recvfrom 23 failed: Protocol not available
2022-02-17T00:53:22 Error unbound [97508:3] error: recvfrom 21 failed: Protocol not available
2022-02-17T00:53:22 Error unbound [97508:3] error: recvfrom 22 failed: Protocol not available
2022-02-17T00:53:12 Error unbound [97508:1] error: recvfrom 21 failed: Protocol not available
2022-02-17T00:53:10 Error unbound [97508:1] error: recvfrom 24 failed: Protocol not available
2022-02-17T00:53:09 Error unbound [97508:0] error: recvfrom 23 failed: Protocol not available
2022-02-17T00:53:08 Error unbound [97508:1] error: recvfrom 28 failed: Protocol not available
2022-02-17T00:53:07 Error unbound [97508:1] error: recvfrom 22 failed: Protocol not available
2022-02-17T00:53:06 Error unbound [97508:3] error: recvfrom 21 failed: Protocol not available
2022-02-17T00:53:05 Error unbound [97508:0] error: recvfrom 21 failed: Protocol not available
2022-02-17T00:53:04 Error unbound [97508:3] error: recvfrom 23 failed: Protocol not available
2022-02-17T00:53:03 Error unbound [97508:0] error: recvfrom 23 failed: Protocol not available
2022-02-17T00:53:02 Error unbound [97508:3] error: recvfrom 21 failed: Protocol not available
2022-02-17T00:53:01 Error unbound [97508:3] error: recvfrom 25 failed: Protocol not available
I wonder if this is expected behaviour or something's wrong with my install, I haven't found anything similar to this issue anywhere else. Has anybody else encountered this issue?

55

22.1 Legacy Series / Re: 22.1rc1 crashes when the Statistics checkbox in an host alias is enabled

« on: April 07, 2022, 02:43:47 pm »

Awesome, thank you Franco!!

56

Tutorials and FAQs / Re: OPNsense 21.7.1 - New Fresh Guaranteed DNS OVER TLS

« on: March 31, 2022, 03:31:58 pm »

Reading through this partially answered may questions, so the only difference between this and the built in method is speed? You can do all of this using unbound, is the point of this a speed increase, and if so, what kind of increase do you see?  Thank you!

57

22.1 Legacy Series / Re: Bad performance on Proxmox with Realtek NICs and/or virtIO Bridge

« on: March 21, 2022, 02:47:47 pm »

Now, finally I got my new device with Intel NICs from china.
It has the exact same CPU and RAM config.

Now I cloned the System 1:1 to the new device and assigned the NICs.

I get full gigabit now!

@franco
So I think it is an issue with the new realtek driver.

Be careful with those Chinese nics, usually they are samples or just mis-branded.  I have one of those and it works well, but the "intel" nics show up as Realtek in the interface overview but it works without the re drivers so they are clearly intel-ish.  Just saying, Chinese electronics are a black hole of false advertising, just be aware.  I have some interesting stories of weird CPU engineering samples I have from stuff like that

58

22.1 Legacy Series / error: kex_exchange_identification: Connection closed by remote host

« on: March 15, 2022, 11:17:36 pm »

Anyone else seeing this message after the update?

error: kex_exchange_identification: Connection closed by remote host

Ill note im seeing this same message originating from each interface in opnsense on my other servers.  Spams log almost every hour on the dot.

Edit: make that every 15 minutes on the dot

Edit 2: I think this is ntopng actually, ill disable, and report back after 20 minutes or so.  All servers on network see same flood of ssh requests every 15 minutes so I THINK ntopng is doing this for network discovery.  Its a working theory.  Ill report back with my findings.

Edit 3: Yep ntopng was the culprit.  If anyone else runs into this, possibly disable network discovery on the app to stop.

59

Zenarmor (Sensei) / Re: A couple errors upgrading to 22.1

« on: February 22, 2022, 04:47:13 pm »

OK! I just re-installed and submitted a bug report.

Thanks!

60

22.1 Legacy Series / Re: os-ddclient

« on: February 18, 2022, 05:32:05 pm »

Its not, Error messages for benign items happen with a lot of the modules, looks to be a logging issue. lightpd and suricata throw the same Error logs for normal INFO level stuff at times. So its not limited to os-ddclient its something introduces in the update.

This is way off topic and uninformed, see https://github.com/opnsense/changelog/blob/9b4d433fa80a0540c5271181bfb3998806de5141/community/22.1/22.1#L12

helpful!