Topics

1

General Discussion / I can't update: "Could not authenticate the selected mirror."

« on: April 21, 2022, 02:46:56 am »

I tried System->Firmware->Status->Check for updates... and it spits out this:

Code: [Select]

***GOT REQUEST TO CHECK FOR UPDATES***
Currently running OPNsense 21.7.2_1 (amd64/OpenSSL) at Wed Apr 20 18:39:04 MDT 2022
Fetching changelog information, please wait... done
Updating OPNsense repository catalogue...
pkg: Repository OPNsense has a wrong packagesite, need to re-create database
Fetching meta.conf: . done
Fetching packagesite.txz: .......... done
Processing entries: .......... done
OPNsense repository update completed. 777 packages processed.
Updating mimugmail repository catalogue...
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg: https://opn-repo.routerperformance.net/repo/FreeBSD:12:amd64/meta.txz: Authentication error
repository mimugmail has no meta file, using default settings
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
2619649490944:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg: https://opn-repo.routerperformance.net/repo/FreeBSD:12:amd64/packagesite.txz: Authentication error
Unable to update repository mimugmail
Error updating repositories!
Checking integrity... done (0 conflicting)
Your packages are up to date.
***DONE***
Then says: "Could not authenticate the selected mirror."

I found a few threads on the message board.
1) SSL cert check, my files exist and are non-zero size
2) Check date and time -- looks accurate with my phone/PC
3) Someone suggested deleting the fake let's encrypt cert, I tried that, it didn't help.

Other ideas? What else can I check? My whole network seems to be functioning correctly. Not sure why opnsense is complaining about this.

Thanks,
-Greg

2

20.7 Legacy Series / nginx won't start "Address is already in use"

« on: February 14, 2021, 05:29:49 am »

I'm trying to set up the nginx plugin on my OPNsense and it seems I keep running into this problem where I try to restart the service and it completely breaks. Now when I try to start it, I get this:

Code: [Select]

root@opnsense:~ # service nginx start
Performing sanity check on nginx configuration:
nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
Starting nginx.
nginx: [emerg] bind() to unix:/var/run/nginx_status.sock failed (48: Address already in use)
nginx: [emerg] bind() to unix:/var/run/nginx_status.sock failed (48: Address already in use)
nginx: [emerg] bind() to unix:/var/run/nginx_status.sock failed (48: Address already in use)
nginx: [emerg] bind() to unix:/var/run/nginx_status.sock failed (48: Address already in use)
nginx: [emerg] bind() to unix:/var/run/nginx_status.sock failed (48: Address already in use)
nginx: [emerg] still could not bind()
/usr/local/etc/rc.d/nginx: WARNING: failed to start nginx
root@opnsense:~ # ps auxww |grep nginx
root     24076   0.0  0.0 1060888  3196  0  R+   21:25       0:00.00 grep nginx
root@opnsense:~ # service nginx status
nginx is not running.
root@opnsense:~ # ls -la /var/run/nginx*
-rw-r-----  1 root  wheel  0 Feb 13 20:40 /var/run/nginx.pid
srw-rw-rw-  1 root  wheel  0 Feb 13 20:40 /var/run/nginx_status.sock
root@opnsense:~ #

I found this thread from the 19.1 Legacy Series archive but there was no resolution. As you can see the nginx service isn't running. I've tried deleting the 0-byte files in /var/run and they just get recreated when the service start is attempted.

I tried removing a lot of the config options I set in the nginx plugin options but it still doesn't start up. I think it gets thrown into a broken state and can no longer be started. Any ideas on how to troubleshoot this?

3

General Discussion / Unbound DNS cannot flush out stale DNS entries

« on: December 22, 2020, 11:07:26 pm »

 I've been using OPNsense for a bit and one thing I do a lot these days is add more IoT devices to my LAN. I have the biggest problem with removing the stale DNS DHCP entries from the system. I'm curious how to go about doing this in a way that works every time.

 The problem occurs when I try to set up a new device. I program it to hook up to my WiFi with DHCP because I don't know what the MAC is, yet. It gets a randomly assigned DHCP IP from the pool and shows up in the leases list. At this point, it becomes part of the DNS results because Unbound records the DHCP lease data in its DNS entries. I can see this with `nslookup <name> <opnsense>` from other computers on the network.

 Now that I have the MAC I can go in and add the static entry on the DHCP server but then the nslookup results show both the old pool IP and the new static IP. I cannot get the old pool IP to go away!! I tried restarting the DHCP server and restarting Unbound DNS server multiple times but the entry won't go away.

 I have even tried disconnecting the device, waiting for OPNsense to recognize that the device is offline but the lease is out there and clicking the little trash icon next to it to delete the entry from the DHCP server but when I use nslookup and force it to use the root DNS server it STILL resolves (even after restarting Unbound and DHCP servers)! What gives??

 Just about the only way I've found that ALWAYS works so far is to reboot the router but that takes 2-3 minutes and the internet is down at my house during that time so I'd like to find a way to do this that doesn't involve a restart.

 Unfortunately, because these are IoT devices, there's no easy way to get it to issue a "ipconfig /release" to tell the DHCP server that they're done so I have to do this from the router's side.

Thanks,
-Greg
Do I have to wait for the lease to expire?

4

Tutorials and FAQs / Help! VLAN rule isn't always applying...

« on: November 26, 2020, 06:41:27 pm »

In an effort to learn networking, I'm migrating my home network to take advantage of VLANs. I've set up OpnSense and hooked everything up and I'm trying to get the rules situated but they're not making sense to me now.

I've got a "management" VLAN10 a "client" VLAN20 and a "wifi" VLAN30.

VLAN10 has a hassio host (for home assistant) [172.27.10.5]
VLAN20 has skeeter my desktop computer [172.27.20.4]
VLAN30 has pixel my phone [172.27.30.40]

I wrote a very simple rule in the VLAN20 ruleset to allow skeeter to connect to hassio, works great! But for the life of me, I cannot figure out why I can't write the same rule for pixel and have it work on VLAN30.

I've attached the live log that I captured showing both blocking and passing packets that look identical! Also my rule set for VLAN30 and VLAN20. I have skeeter listed as one of the "management_hosts" so it matches that top rule immediately when I connect skeeter to hassio. I created the top two rules on VLAN30 to try to allow pixel to connect but it's still being blocked.

Please help me solve this, I really want to understand where I'm missing understanding on this...