Messages

Is this really such an uncommon use case that nobody has any ideas? Sigh.

Hi all, so this is incredibly frustrating as my setup had been working, but now it's not and I'm not sure why.

Essentially, I have the ONT provided by my ISP and two external IP addresses available, the desired effect is to have all network traffic default through one, and specific internal IP addresses route through the second.

I have a virtual IP set up for the second address, adding one for the first kills my internet connection. I also have an alias set up for the virtual machine I want on this external IP.

The firewall rules I had set all had been working until last night, however there was an issue with vpn software on the virtual machine host, I had to remove it and reconfigure the network settings, but everything on the host and virtual machine is back to normal, however, I can't get the virtual machine to switch over to the external IP address no matter what I do, and it's driving me insane!

I noticed OPNSense is somewhat slow to apply firewall rules and that's probably not helping much when trying to adjust things, but whatever the solution to this is, I need help figuring it out.

The main IP address I want to use ends in .190 and the one ending in .189 is the one that's for specific use.

I have no one to one or outbound rules since those haven't seemed to fix anything, and they weren't required in the past for this to work.

https://imgur.com/a/OUHMLYb

Really, no ideas from anyone?

Hi all, so having an issue getting a blacklist I set up to work, I set up an alias as an ip list, cloned my geopip rule, which is working as I can see it in the live log, and selected my new blacklist as the source, unfortunately it doesn't seem to be working and I'm not sure why. I've uploaded some screenshots hoping people can maybe give me more info.

Also for some reason it took ages for my router to actually reboot after I applied the rules, and now there are loads of "default deny rule" entries showing in the live feed that weren't there before.

Weird but those don't appear to be affecting anything from a cursory glance.

https://imgur.com/a/nJ6VkhG

So it looks like adding the virtual IP at all is what's killing my internet, not the rule.

In my lan and wan firewall rules, I have them set to * for the most part, so I'm wondering, do I need to specify the first static IP for this to work instead of relying on it just being the default? Is that what's killing my internet when I add a virtual IP?

Alright so I watched some pfsense stuff and it looks like the virtual IP section is what I want, and if I set port forwarding to my second static IP for this one machine, like this, I can access it from the web."

The problem is that it kills everything else on my network, I can load google, but basically no other webpages. Once I put it back to "wan address" and reboot everything is normal.

Well, I've been poking at this on and off and trying different things but no matter what I try with either 1:1 or outbound NAT I just can't get it to work, uhg.

Ah, do I just need to specify single host or address?

All my other rules for port forwarding are set to any wan address, so going to my first one which shows up as one of the interfaces, I'm also hoping to essentially have it show as "WAN2" or whatever I would label it on the main page, I figure I'd have to manually configure it as a second gateway.

I did just find that setting under system however, seems sleep helped, so I'll set that up and hopefully everything uses the first WAN and the second will not be used automatically by mistake. It is set to default so hopefully numbering the second one won't cause it to be higher priority due to the number in the name.

edit: alright, I have that up and switching the server from any wan address to the external one works with NAT reflection but not from outside the local network, probably because specifying a single host or network means that it will only accept connections from a specific external IP, like if I only wanted access to something from work or something like that. Getting close though.

I just need a way to have "wan2 address" as an option really.

Hey everyone, so this is probably going to be a bit confusing, hopefully not too much so, and hopefully I can explain what I'm trying to do.

So, for starters to "set the scene", my ISP provides on a vlan, for static IP addresses, it's vlan 3000.

My OPNSense box only has two Ethernet ports, and I've gotten it set up and working for a while now without any issues, with one going to the optical network terminal and the other to a 48 port managed switch.

What I want to do now however, is move a web server onto a second static IP that my ISP has assigned, so that I can keep my personal stuff on it's own external IP, and monitor traffic for the web server individually.

Now, poking around in the wan interface, it looks like I might be able to add another upstream gateway on the ipv4 field, not sure if that's correct or it will work, so looking for clarification on that.

I'm also then wondering how I go about only selecting a single internal IP address to use this second gateway. Considering I only have two ethernet ports on my opnsense box, and the machine I want to use the second gateway is a virtual machine, setting specific interfaces to be their own vlan or isolate them completely isn't going to be an option, so I'm a little lost on how I can get this going, and hopefully someone can provide a link to a tutorial or something like that to show how it's done.

Thanks.

Hello all, so thankfully I was able to figure out my previous issue even though I got no input on it from others, apparently you not only need NAT rules but floating rules as well.

I have all of my stuff working correctly except for one thing, I am unable to access my website using the url when I am on the local network, I have to use the IP of the machine hosting it. It's not a big issue or anything but if possible I would like to be able to just type in the url and have it work as it did previously.

What changes do I need to make to do this?

The floating firewall rules look a lot more inline with what I've done on the consumer router, even though a post about NAT port forwarding is the first one that comes up.

Set up like this looks like how it should work to me, however I'm still not getting the results I want, but I think a floating rule and just the right setup for it will have me golden.



I'm ridiculously tired though and need to sleep, hopefully someone else can share shots of their config here so that I can fix it before work.

Looks like I'm getting a "default deny rule" entry in the firewall log, whenever I see a connection to the website I'm hosting, now I have to figure out how to edit or disable this rule.

Damnit, it looks like according to uptimerobot my teamspeak isn't accessible properly either.

Hey all, so another hiccup I've ran into with opnsense so far is for a website that I host, I set up the port forwarding for it in the same manner I did for other things like my sftp server, and it works, but not quite right.

I can no longer access the website on my lan by typing the url in like I could previously, I have to go to the virtual machine's IP address.

I also noticed that it was inconsistent as to whether or not putting http:// in front of the url would allow access or not, often timing out without using it, but it would work with it. The website also worked fine directly typing the IP in.

I noticed a lot of random connects and instant disconnects though and tried hidemyass, and I noticed that from other countries (my cell phone does work) the url does not work but the ip address does, and I have my dns service pointing to the right one. With or without http:// in the url, I couldn't connect.

I changed the management port to 440 for opnsense and disabled the browser redirect as mentioned in some other threads, but nothing seems to be getting this to work quite right as it had been when I was just using the isp provided router.

Here are the settings for port forwarding, I'm hoping to get this fixed asap. Unfortunately I'm at a dead end.

Used hidemyass to try and connect from another country through a vpn and it looks like it's just timing out so it's still not set up right, but it does work if I use the ip address. Uhg.