Topics

I'm testing protonVPN which has been configured for LAN2 of my appliance (all the devices connected to LAN2 will go through the VPN) and I have still doubts how to best configure DNS: I have attached both the port forward and the LAN2 firewall rules, could someone kindly let me know if I've done it correctly?

Also, the first rule of the firewall rules (the DNS one), is it necessary or it's redundant?

Tia.

[rdr rule]

I have configured my LAN2 interface with Wireguard (testing ProtonVPN) and looking at the firewall -> log files -> live view I've noticed a few rdr rule entries, could someone please explain what is an rdr rule?

Tia.

I have configured one of my appliance ports to use ProtonVPN and I followed the official instructions including this: https://docs.opnsense.org/manual/how-tos/wireguard-client-proton.html#protonvpn-dns-leaks

I have only a smart TV connected to that port (LAN2), with a static IP address of 192.168.10.16 (for ProtonVPN is then 10.2.0.2).
Using the embedded browser, I've checked any potential DNS leaks browsing to www.dnsleaktest.com website, and no leaks occur (it only detects the ProtonVPN server).

In ISC DHCPv4 for LAN2, I have included the DNS server as the Proton one - 10.2.0.1

Now, if I look at the Firewall -> Live View of both the above IP addresses + port=53, I see the smart tv querying not just the ProtonVPN IP address (10.2.0.1) but also Google DNS servers, how is that possible?

Any suggestions would be much appreciated.

Tia.

[htpasswd]

I tried to install htpasswd but I got the message that's not been found in the repositories, is there a workaround to get it installed?

Tia.

I'm running 23.7.12_5 installed on two Transcend SSD 128GB (ZFS), one 2.5" SATA and one mSATA, and looking at my dashboard (SMART Status), I've noticed one SSD has disappeared, and I suppose it means one drive has failed, am I correct?

How do I understand which one has failed?

Tia.

Decided to uninstall Zenarmor and after rebooting OPNsense 23.7.8_1 I saw a plugin missing notification, how so?

Tia.

I've created a VIP (see picture) on a different subnet than my LAN net (192.168.0.1/24), and I can't understand how to make that IP visible (the modem I need to reach is on 192.168.2.1) e.g. pingable from a device within my LAN: could someone  please guide me?

I believe I have to create an NAT outbound rule, what exactly?

Tia.

[System -> Configurations -> Backups]

I wasn't able to find an explanation of what that option in System -> Configurations -> Backups exactly does: could someone shed some light?

Tia.

As per subject, is that possible? After the upgrade to 23.7.6, the cicada theme has lots of displaying issue and I can't even change to the default theme from GUI (all the drop-down menus don't work), hence I'm hoping I can do that from CLI.

Tia.

I've created two WG tunnels (Mullvad) and created a gateway group with both tunnels on tier 1 to use load balancing, so in the firewall -> LAN rule I've selected that gateway group.

But when I look at the firewall -> live view of both wireguard interfaces, I see traffic on one WG interface only and on the other one it's just every now and then some ICMP and that's all, what am I missing?

Tia.

Could someone explain to me what exactly the step 9 of the WireGuard Selective Routing tutorial does ?

https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html#step-9-configure-routing

Tia.

I've installed AdGuard Home on a Raspi4 connected to my LAN (192.168.0.1) and Raspi IP address is 192.168.0.14

AdGuard is listening on all interfaces (bind DNS on 0.0.0.0)

Unbound is disabled.

On LAN I have a port forward rule, the firewall rule as well as the outbound rule, and the setup seems to work but in AdGuard dashboard I see all the stats coming from a single IP, i.e. 192.168.0.1 - how would I fix that?

Tia.

[ALL]

Let's start with my OPNsense setup:

1. Unbound disabled

2. Raspi4 acting as DNS server (Quad9 servers) connected to another port of the appliance (LAN3)

3. Port forward for LAN interface

4. LAN rule for port 53 automatically created by the port forward

5. System -> Settings -> General -> DNS servers = 1.1.1.1 (I have to input a DNS server otherwise OPNsense cannot perform updates, even if I check the option "Allow DNS server list to be overridden by DHCP/PPP on WAN")

I've noticed that if System -> Settings -> General -> DNS servers list is empty then OPNsense cannot resolve any websites and ALL the LAN devices have no Internet access, hence I've added the Cloudflare server -> I've got a DNS leak as tested with this website from any device on my LAN i.e. I get two ISP as result, Quad9 and Cloudflare  >:(

During the DNS leak test I was watching the live firewall output and noticed that the LAN rule to redirect the DNS requests is rightly triggered alongside another one labelled "let out anything from the firewall host itself" on LAN3 interface (that's where the Raspi4 is connected to).

For both rules the destination address is the one of the Raspi4.

Why the port forward doesn't suffice and the client is using both DNS servers to perform the test (DNS leak) ?

How do I instruct OPNsense to use the ISP DNS servers while the clients only using the Raspi4 servers as per the port forward?

Tia.

I'm testing the Mullvad app on my smartphone (it uses Wireguard) and it works just fine.

If I connect the smartphone to my home network, then OPNsense denies the connection (see attachment): where do I start to troubleshoot?

On the same smartphone, I have also ProtonVPN app and it connects straightaway  ::)

Tia.

After crashing my head for several days ;D  I managed to get wireguard working, and now I'd like to add a second tunnel for failover: is there a guide for dummies I can follow?

Tia.

I've decided to upgrade to the latest version 23.7.1_3 and noticed my client can no longer connect through ProtonVPN (I didn't change anything) - I'm using OpenVPN.

Can someone guide me how to troubleshoot this, where to start from?

Tia.

Since the ISP modem has no access to its GUI (as it's locked), is there a way through OPNsense to check what speed the modem is syncing ?

Tia.

[net.inet.rss.bits]

I'm testing the RSS with i225 (igc) and before enabling that the net.inet.rss.bits value was 2 (it's a 4-core/4-thread CPU), but after enabling RSS the net.inet.rss.bits was set to '3', how come?

And should I leave it to 3 or should I add a tunable and set net.inet.rss.bits=2 ?

Tia.

I'm trying to figure out why OpenVPN doesn't give me Internet access (it was working for the past 7 days).

I'm using ProtonVPN and the serivce works fine from both my laptop and my smartphone: can anyone helpm out to troubleshoot as I'm not a netoworking expert?

This the the client1.conf content:

Code Select Expand

dev ovpnc1
verb 3
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
script-security 3
daemon openvpn_client1
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp4
auth SHA512
up /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkup
down /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkdown
local x.x.x.x  #IP masked
tls-client
client
lport 0
management /var/etc/openvpn/client1.sock unix
remote 146.70.133.130 5060
remote 146.70.179.50 4569
remote 146.70.179.50 1194
remote 146.70.83.66 5060
remote 146.70.96.66 1194
remote 154.47.24.193 1194
remote 146.70.133.130 1194
remote 146.70.83.66 1194
remote 146.70.96.66 5060
auth-user-pass /var/etc/openvpn/client1.up
ca /var/etc/openvpn/client1.ca
tls-auth /var/etc/openvpn/client1.tls-auth 1
compress stub-v2
route-nopull
remote-random
tun-mtu 1464
reneg-sec 0
remote-cert-tls server



Tia.

[os-wireguard]

I'm trying to understand why there are two WireGuard plugins, os-wireguard & os-wireguard-go, both on the same version 1.13_5 (and same size, 55.5 KiB), and in case which one to install.

Tia.