Messages

[Disable anti-lockout]

P.S. Also disable that global "anti-lockout" thing.

Is it the checkbox Disable anti-lockout in Firewall -> Settings -> Advanced ?

My ISP is German Telekom, bound by EU customer protection and privacy legislation including GDPR so why should I hand my DNS requests to a US based company on a silver platter?

Then Quad9 should  be fine as they are based in Switzerland.

It's a tricky one, I read many users saying they are happy for Unbound to do the job as they don't care whether or not their ISP can see the DNS queries, but personally I do use DoT with Quad9.

Have a look at the official guide here: https://docs.opnsense.org/manual/unbound.html#dns-over-tls

I suggest do a lot of research before making up your mind.

I'd want to allow only two devices within the LAN to access the OPNsense gui (and ssh too), can someone explain to me how do I do that?

Tia.

So, yes, there was 'something else' and that was the PS5  ::)  I forgot I manually configured the DNS with Quad9

As soon as I turn it off, all that 'noise' stops  ;D

Thank you all.

[System -> Settings -> General -> Networking]

Or maybe

System -> Settings -> General -> Networking -> DNS

127.0.0.1

Sorry, I don't understand what you mean...

As I said, the section System -> Settings -> General -> Networking is all blank/unchecked

I really would like to understand if there is anything to be concerned, e.g. something to change in my config...

Also, if I click on info box information, it brings up a pop up window (Detailed rule info) with reference to the "Disable force gateway" option in the Firewall -> Settings -> Advanced section

There are some "ifs, ands and buts" around how the OPNsense host itself resolves DNS, primarily controlled via System -> Settings -> General -> Networking options. If you want to use Unbound for everything, you probably want that entire section to be blank (i.e. no DNS servers specified, and all options unchecked).

Yes, I can confirm nothing has been checked/selected on that networking section...

Thank you both!

A reservation just means that the IP address is reserved for a given client - the client still needs to use DHCP to get a lease, renew it, etc.

Does it mean that every 24 hrs the Kea DHCP server releases the IP address and then reassigns that same IP address to the same very host?  :o

With ISC DHCPv4 if I assign a static IP address to a device then job done, right?

[let out anything from firewall host itself (force gw)]

I've configured Unbound with DoT and Quad9 servers (9.9.9.9 & 149.112.112.112), and looking at the firewall live view on the WAN interface, I see continual calls to those servers on port 53 (and not 853) where the source is my WAN IP address, the destination is the Quad9 server and the label is "let out anything from firewall host itself (force gw)"

Similarly, if I filter port 853, i see the same type of output, i.e. source is my WAN IP address, the destination is the Quad9 server and the label is "let out anything from firewall host itself (force gw)"

I'd want to know if that's normal beavhiour or there is something wrong in my configuration.

Tia.

I've decided to test the (new) Kea DHCP service and I've added 10 hosts an in the 'Reservations' section, so far so good.

What I don't understand is that if I click on 'Leases DHCPv4' menu, I see all those hosts with a Lifetime of 86400 (which is the default value for hosts with no reservation), and they actually expire within 24 hrs, hence I'm confused, why is that?

Tia.

+1

In https://docs.opnsense.org/manual/how-tos/wireguard-client-mullvad.html#
Under Step 1 there is a paragraph:
"On Peers tab create a new Peer, give it a Name, set 0.0.0.0/0 in Allowed IPs and set the DNS to 193.138.218.74. This is the one MulladVPN provides for privacy."
However in Peers in Opnsense there is not place to set DNS address...

I can confirm that the option to add a DNS server is on the instance configuration instead, they should amend that typo...
Also, the DNS IP address 193.138.218.74 has been decommissioned a while ago, have a look here for the list of actual Mullvad DNS servers: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

That settings only specify the external dns ip...isn't it?

I believe so

[DNS servers]

Someone could kindly explain to me what steps should I implement to do this:

Assuming you have configured DHCP static mappings in OPNsense for the hosts using the tunnel, specify in that configuration either the DNS servers supplied by your VPN provider (see note below), or public DNS servers. This will override the network-wide DNS settings for those hosts

Configure public DNS servers for your whole local network, rather than local DNS servers

taken from https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html (steps 3 and 4 to avoid dns leak)

thanks

Just go to Services -> ISC DHCPv4 -> LAN and either select a single host or the entire LAN and type your preferred DNS servers IP addresses in the option DNS servers