Messages

Are you sure your devices are igb?

From my box:

Code Select Expand


root@firewall:~ # sysctl -a | grep igb | wc -l
    1945
root@firewall:~ # dmidecode | grep X11
Product Name: X11SDW-4C-TP13F
String 2: Supermicro motherboard-X11 Series
root@firewall:~ # ifconfig -a | grep igb
igb0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
inet6 fe80::ae1f:6bff:fec3:e9e8%igb0 prefixlen 64 scopeid 0x1
igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
inet6 fe80::ae1f:6bff:fec3:e9e9%igb1 prefixlen 64 scopeid 0x2
igb2: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
igb3: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
igb4: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
igb5: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
igb6: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
igb7: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
igb8: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
root@firewall:~ #


Hi guys, after the upgrade to 21.7.1 I've noticed a very high consumption of ram and swap: ram over 50% and swap, after a couple of days of activity, at 99%  :o.
Clearly this problem is solved by restarting, but in all these years of use it had never happened to me. It is absolutely not a machine problem, as it mounts an i5-9400F with 16 Gb of ram. Reading on the net someone suggestedd to disable the ipv6, but I currently, on this infrastructure, don't use it.
Has it happened to others? Thanks for the answers.

I've also noticed this but for me this is tied to the Maltrail application's sensor python script. The moment I restart the sensor the memory is back to around 7% which is my average. I didn't have this problem prior to 21.7.1 and have put in a daily job to restart maltrail to get it back to normal.

You only need to assign/enable an interface when you do things like policy based routing (PIA, Azire, Mullvad). Just for offering dialin its not required

So I did enable/assign the wg0 interface to one called WireGuard and that explains the second one.

I want to do allow the WireGuard users access into the network but want to control it also. Therefore if I disable the interface can I assign firewall rules on the remaining local created one? If not which one do I assign rules to? I can rename the interface to make it less weird.


Sent from my iPhone using Tapatalk

See the attached image.. not sure how this happened but any thoughts how to fix it or get to one?


Sent from my iPhone using Tapatalk

It was updated from 4 to 5. Anything in the logs?

Same experience as above ^. Log timestamp was from the shutdown and it never started up nor could I start it from the gui.

I also noticed the rc.d script for zabbix_agentd was gone completely so I couldn't even start it manually.

FYI I just upgraded from 20.7.2 with Zabbix agent installed and after the upgrade to 20.7.3 the package/agent was in a funky state. It wasn't starting or nothing so I removed it and re-installed and now it works. So not sure if there was an issue with the upgrade process for the AGENT with 20.7.3 but thought I'd bring it up.

So I've got it collecting data... I don't see my WAN link in the list of interfaces to protect, not sure if I should since I use netgraph for something and see igb0 (the physical WAN link) but not ngeth0.

I also setup a reverse DNS query server to my firewall (192.168.14.1) but don't see those IPs getting resolved. Am I missing something?

Looks good now!

Now to play with it!

During the installation of latest Sensei version on the latest stable OPNsense 20.7 version (20.7.1) it is crashing after doing all the steps and hitting the finish button. Box crashes and reboots.

Setup:

SYS-1019D-4C-FHN13TP w/2x8GB ECC RAM
Dual GEOM hard drives
5 interfaces in use; ixl0 - GUEST, ixl1 - DMZ, ixl2 - IoT, ixl3 - LAN, and igb0 using NetGraph for AT&T bypass
No VLANs
Have Suricata running right now but disabled it on second try and failed.

Any thing to troubleshoot or provide additional context around?

I installed OS-VMware plugin and it installs fine, according to OPNsense, but in ESXi it says VMware Tools are not installed.
How can I find out what went wrong?
ps -ef gives but a few processes, not what I expected....
`
/usr/local/opnsense/version/vmware
/usr/local/share/open-vm-tools/scripts/vmware
/usr/local/share/vmware-tools/scripts/vmware
`
are the only files/folders I found with vmware in the name, the first has a version in it (1.5) the second is an empty folder and the third has a network folder in it with a script...
Running that script does nothing, as far as I can tell...

I had this on initial plugin install but had to reboot for it to startup.

Does it work accessing it from the LAN side using the WAN IP ?

Yes!

But when using the LAN client hitting the WAN Port Forward it maps it to the internal IP of the LAN client and the WAN Port Forward forwards to a LAN based IP.

LAN Client - Same /24, .220 IP
WAN Port Forward forward IP - Same /24, .1 IP

Bump, any help?


Sent from my iPhone using Tapatalk

You have to enable "Automatic outbound NAT for Reflection" to make te NAT Reflection working.

This doesn't work...

I have the same problem. Port forward NAT on the WAN IP and DMZ can't access it even though DMZ has access to the internet/wan. The connection comes back into the IP on the port forward NAT it redirects to as the DMZ internal host IP.

So I have multiple subnets (e.g. LAN, IoT, DMZ, and GUEST) with a few jump/remote hosts in the DMZ. I have a port forwarding NAT rule in place with the following settings:

SRC *
SRC PORT *
DEST WAN ADDRESS
DEST PORT 1000
NAT IP <FW LAN IP>
NAT PORT HTTPS

My Firewall settings are settings for NAT are as follows:

Reflection for port forwards    - ON
Reflection for 1:1 - ON   
Automatic outbound NAT for Reflection - ON

With these current settings the LAN can access the NAT fine using the WAN IP and the port specified but the DMZ cannot, it gets denied with from the DMZ host attempting going to the NAT IP/NAT PORT in the logs.

In the past when I had pfSense this type of setup worked so I can't explain why this isn't working.

No matter what settings I make for NAT reflection it never works from the DMZ segment but it can break the LAN side.

Thoughts?

The goal would be the DMZ can access services on the WAN address like any external client but basically hairpin back into the firewall.

So after today's install and tearing my hair out thinking it was something funky in ESXi I rebuilt my home firewall to bare metal.

After the install the WAN comes online and the firewall can ping 8.8.8.8 but internal clients can't and even sourcing the LAN interface on the firewall doesn't work.

After I did a:

Code Select Expand


opnsense-revert -r 19.7.2 opnsense


And then went into the LAN interface and simply hit SAVE and APPLY all my interfaces started to pass traffic (WAN + 4 internals).

I am not sure what happened but with opnsense 19.7.3 package the firewall isn't passing traffic across interfaces to WAN.

More than happy to provide any type of logs or whatever since I can reproduce it every time.