Messages

I just added two IPs to a WAN interface, beyond its primary one. When I pressed the button to apply them, the interface got cut off. It can't be pinged on any of the three addresses. And I lost the remote web access to it.

Is this a known thing?

Fortunately I have a WireGuard tunnel to the device which has stayed connected, so I should be able to get to it through that -- although it's from another remote location, so first I need to set up a relaying system there. But what am I looking for here, in terms of what's gone wrong and why?

Since adding keepalives on both ends, WireGuard has behaved well.

Define "short". I haven't needed keepalives at all between Linux systems provided they're on public IPs, as is this case. Last I looked the Wireguard docs only recommend keepalives when one end is behind a NAT. In this case I had a keepalive initially at 10 minutes from the OPNsense side. Then I moved that down to 25 seconds, and also added one initiated from the Linux end, also at 25 seconds. That has kept the tunnel up overnight. So the OPNsense implementation is more dependent on keepalives in general, or else dependent on keepalives being initiated from the other side, or both.

Unbound is not good for us because it's failing to return listings for one of the domains we run the authoritative servers for. Each of those servers returns those listings fine. Google's 8.8.8.8 and 8.8.4.4 do too. But Unbound fails without even providing an excuse.

Found that the problem is "rebind" protection. Yes, we have a public domain we use for some private IPs, for diverse VPN connections. With DNSmasq, that requires adding "rebind-domain-ok=/that.domain/" in the Advanced box, which we now hope is not going away in the future, despite the notice. Is there a similar way to configure Unbound?

After setting up Wireguard between a new OPNsense appliance and a Linux server that's rock-solid with Wireguard connections to other Linux devices, it only intermittently works. Strangely, it will work to allow connections from the Linux end both to the Wireguard IP on the OPNsense box, and to the LAN behind it, but only for a while. After it fails for both, if I then go to the VPN:Wireguard > Endpoints page and simply press "Save" it starts working again. But after a few minutes it sometimes fails. The "List Configuration" tab however shows it as active nonetheless. Sometimes it does seem to recover on its own.

I've not seen the like between Linux Wireguard machines flake in this way. Both ends are on public IPs, and configured explicitly with those IPs.