Topics

Trying to add a cron job to update the Unbound blocklists in System-->Settings-->Cron but it's not in the drop-down menu, how possible?

Tia.

Just complete a fresh install and the WAN doesn't pick up an IP address, never happen before, any suggestions?

Username and password checked, and my spare router connects immediately...

Tia.

My ISP provide dynamic IP address, so every now and then my IP address changes, and as per post subject, how easy is to set that alert up?

Tia.

Since I don't use IDS/IPS, would I gain any boost performance by enabling the hardware offload settings on my APU2E4?

Tia.

I found the following details on how to install Speedtest on FreeBSD, is there a way to install it on OPNsense?

Code Select Expand

$ sudo pkg update && sudo pkg install -g libidn2 ca_root_nss
$ sudo pkg add "https://bintray.com/ookla/download/download_file?file_path=ookla-speedtest-1.0.0-freebsd.pkg"

https://www.speedtest.net/apps/cli

Tia.

I've got 2x LAN ports and 1x WAN port and I'd want to create firewall rules to 'isolate' LAN2 (which is on a differnet subnet than LAN1) in order to allow only Internet access and no access to LAN1, any advice, please?

Tia.

If two or more lists have same domains, is Unbound 'smart' to not include duplicates in the dnsbl.conf file?

Tia?

I read an interesting article here and my current configuration is pretty similar with the one in the article is "example 2", i.e. DoT, recursive caching DNS, TCP port 853 and DNSSEC.

There is an "example 3" (Authoritative, validating, recursive caching DNS) and I've noticed a few differences. i.e. there are no upstream servers, the listening interface/address is only 127.0.0.1, there is no DoT - I'm trying to understand if there is a real benefit in using this third configuration...

How do you configure Unbound ? Keen to hear (and learn) from the experts of this subject, thanks.

After a sudden outage, I've run the command fsck:

Code Select Expand

root@hush:/ # fsck
** /dev/gpt/rootfs (NO WRITE)
** Last Mounted on /mnt
** Root file system
** Phase 1 - Check Blocks and Sizes
INCORRECT BLOCK COUNT I=2006612 (20672 should be 20608)
CORRECT? no

** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check Reference Counts
UNREF FILE  I=2007178  OWNER=root MODE=100644
SIZE=197 MTIME=Mar 20 12:22 2021
RECONNECT? no


CLEAR? no

** Phase 5 - Check Cyl groups
FREE BLK COUNT(S) WRONG IN SUPERBLK
SALVAGE? no

SUMMARY INFORMATION BAD
SALVAGE? no

BLK(S) MISSING IN BIT MAPS
SALVAGE? no

71680 files, 1015643 used, 26972945 free (4945 frags, 3371000 blocks, 0.0% fragmentation)
root@hush:/ #

Is there anything to worry about? How to correct the block count error?

Tia.

I've updated to 21.1.3_3 and suddenly Unbound stopped running + I can't make it running again, i.e. I start the service and after a few seconds it stops: is anybody experiencing a similar issue?

Bottom line with Unbound not working I cannot surf the Internet and I had to exclude it from the network  ???

Tia.

I need a client on subnet 192.168.0.1/24 (LAN) being able to ping another client which is on subnet 192.168.10.1/24 (LAN2) - and viceversa.

LAN and LAN2 are on two different physical Ethernet ports of the OPNsense router.

I'm playing with Firewall --> NAT --> Outbound, but no luck s far  :-[

Can someone help, please?

Tia.

Does anybody have got the same error message? Rebooting the router didn't make any difference.

Code Select Expand

2021-03-10T22:49:58 ntpd[99842] kernel reports TIME_ERROR: 0x41: Clock Unsynchronized
2021-03-10T22:49:58 ntpd[99842] kernel reports TIME_ERROR: 0x41: Clock Unsynchronized
2021-03-10T22:49:58 ntpd[99842] Listening on routing socket on fd #26 for interface updates
2021-03-10T22:49:58 ntpd[99842] Listen normally on 5 pppoe0 51.x.x.x:123
2021-03-10T22:49:58 ntpd[99842] Listen normally on 4 pppoe0 [fe80::20d:b9ff:fe55:a4e8%8]:123
2021-03-10T22:49:58 ntpd[99842] Listen normally on 3 lo0 127.0.0.1:123
2021-03-10T22:49:58 ntpd[99842] Listen normally on 2 lo0 [::1]:123
2021-03-10T22:49:58 ntpd[99842] Listen and drop on 1 v4wildcard 0.0.0.0:123
2021-03-10T22:49:58 ntpd[99842] Listen and drop on 0 v6wildcard [::]:123
2021-03-10T22:49:58 ntpd[99842] restrict: 'monitor' cannot be disabled while 'limited' is enabled
2021-03-10T22:49:58 ntpd[99842] gps base set to 2021-01-17 (week 2141)
2021-03-10T22:49:58 ntpd[99842] basedate set to 2021-01-13
2021-03-10T22:49:58 ntpd[99842] proto: precision = 0.418 usec (-21)
2021-03-10T22:49:58 ntpd[78182] ----------------------------------------------------
2021-03-10T22:49:58 ntpd[78182] available at https://www.nwtime.org/support
2021-03-10T22:49:58 ntpd[78182] corporation. Support and training for ntp-4 are
2021-03-10T22:49:58 ntpd[78182] Inc. (NTF), a non-profit 501(c)(3) public-benefit
2021-03-10T22:49:58 ntpd[78182] ntp-4 is maintained by Network Time Foundation,

I'm on the latest 21.1.3

And is there an easy fix for this?

Tia.

Can someone please advise how to understand which service is using proxy ACLs?

I'm trying to delete the cron job "download and reload external proxy ACLs" but I get an error.

Tia.

I have Suricata disabled, but I am not able to delete its cron job in system --> settings --> cron: I click on the bin icon but nothing happens, how c ome?

Tia

I am a bit confused, ergo I need some clarification:

One of my 'Aliases' is the Yoyo list which I used to configure a Firewall rule for both LAN and WAN (as per documentation).
Now, I've actually realised (better later than ever) I have the same Yoyo list in Unboubnd--> Blacklist -->  Type of DNSBL, so my question is: do I have to delete both rules in LAN and WAN or just in LAN ?

I was thinking that if I keep the rule in WAN that would prevent those IP addresses to connect to my client(s) or they would be blocked anyway thanks to Unbound?

Tia.

I've installed the Snort ruleset but in the download section I still see all the ETPRO telemetry rules too: how do I rid of them?

Tia.

A few days ago I decided to not renew my Kaspersky licence and to use Windows Defender, but since then I see some 'strange' entries in the Suricata log, that is my laptop trying to connect to 205.185.216.10 or 205.185.216.42 and those two IP addresses trying to connect to my laptop (attached an example).

Does anybody has noticed the same, by any chance? It seems being related to Windows Update, I really doubt my laptop is infected...

Tia.

Can someone please advise on how I can allow ping on the WAN side?

I'm trying to set up an external service which in order to work must receive a ping response from my WAN address.

Tia.

I have a pretty basic setup, modem <--> APU2E4 <--> access point and it works just fine. My connection to ISP is PPPoE and I've seen so many posts claiming that this type of connection seems to impact the performance of OPNsense.

I can change the modem setting from bridge mode onto modem/router, so that it can handle the PPPoE protocol and then connect the OPNsense appliance to the router DMZ (to avoid doube NAT): would this bring any benefits at all?

Tia.

I have a pretty basic setup, that is modem <--> opnsene appliance <--> access point and it works just fine.

My Internet is 80/20 and my opnsense box's got three ports: one connected to the modem, one connected to the AP and the third one to the PS4.
My local LAN is on 192.168.0.1/24 while the PS4 is on a different subnet, 192.168.10.1/24

The issue is my son complaining about his laggy ps4 (ping can go up to 170-180) and was wondering if there is anything at all I can do to improve my setup.

Tia.