Messages

maybe in this context.
there is a little cosmetic error.

when activating the security headers.
you have 2 entries of

Code Select Expand

proxy_hide_header Strict-Transport-Security;

Great,
it works.

Hi,

Since version 1.8

HSTS not sent automatically anymore if HTTP over TLS is configured (still available via security header)

I guess there's a little problem here.

after activation via security header the nginx.conf has the following entry

Code Select Expand

add_header Strict-Transport-Security "15768000" always;

max-age is missing ?

it should be

Code Select Expand

add_header Strict-Transport-Security "max-age=15768000" always;

Or do I get something wrong......

Yes, I can recreate it.
thanks

Hi,

in my global error log, there is every minute a signal process started entry.
what could be the cause ?.
thanks.

OPNsense 19.1.4 / nginx 1.9

[25]

Nabend, ich verstehe es so.

WAN IP Firewall: QSC mit 87.x.x.x
LAN IP Firewall:  192.168.20.199
DMZ IP Firewall: 192.168.30.199
Proxmox MG IP:  192.168.30.254 (vom Wan empfängt es über 25 und leitet über 25 an den Mailserver
(LAN) weiter, intern horcht die PMG zusätzlich auf Port 26)
Mailserver IP:      192.168.20.90 (horcht auf Port 25) und leitet externe Mails ... über Port 26 der PMG. (als Relay) ins Internet weiter.

Also für mich LAN --> DMZ  NAT 192.168.30.254:25  auf 192.168.30.254:26. Da du ja an deinem internen Mailserver nichts verändert möchtest.

Gruß Andreas

@Fabian Great, thanks a lot. I have found it

https://github.com/opnsense/plugins/pull/930

Great work

regards
Andreas

Hi guys, hi @Fabian,
I am looking for a way to block or unblock IP´s /IP-ranges in the location block.

like

Code Select Expand

location / {
  # block one workstation
  deny    192.168.1.1;
  # allow anyone in 192.168.1.0/24
  allow   192.168.1.0/24;
  # drop rest of the world
  deny    all;
}

Is it already possible or is there another solution?

Best regards,
Andreas