Messages

1

24.7 Production Series / Re: Upgrade to 24.7.5 does not automatically reboot

« on: September 26, 2024, 03:31:56 pm »

I've done a couple of firewalls.

They did both reboot, but not before showing the dashboard with 24.7.5.

I watched the second one via it's iLO console an could see a delay between the dashboard refresh and it starting to stop services for the reboot.

2

General Discussion / Re: Unable to import Let's Encrypt certificate

« on: August 02, 2024, 05:13:26 pm »

Try using the fullchain.pem instead of the cert.pem

3

Virtual private networks / Re: problem with openvpn roadwarrior and sip clients

« on: July 04, 2024, 05:04:53 pm »

I've seen this sort of behavior when using Freepbx/PBXact with Endpoint Manager to configure remote SIP devices.

If this is your scenario try resetting the SIP device to factory, configure a temporary rule on the firewall to allow insecure access to the configuration address, set the SIP device provisioning to the same address and run the provisioning.

When it restarts it should bring up the VPN and then use the secure address to talk to the PBX. After which you can remove the temporary rule.

4

24.1 Legacy Series / Re: Firewall Rules Help

« on: May 19, 2024, 08:55:14 am »

My bad if this has changed.

The quote was from Franco.

5

24.1 Legacy Series / Re: Firewall Rules Help

« on: May 19, 2024, 08:34:54 am »

From https://forum.opnsense.org/index.php?topic=2790.0

MAC addresses are not covered by FreeBSD's ipfw(4) and pf(4) packet filters which OPNsense uses. You can, however, use the captive portal functionality to allow access only to specific MAC addresses in the advanced configuration, see "Allowed MAC addresses".

6

24.1 Legacy Series / Re: Migrate from ISC DHCP to Kea

« on: May 06, 2024, 11:10:49 am »

If you search the forum you will find that several people have created migration scripts.

The Kea service has had CSV import and export capability added to it.

The DHCPv4 service does not currently have a CSV export function.

7

Virtual private networks / Re: wireguard peer generator - QR code is invalid

« on: April 21, 2024, 06:46:24 pm »

Could you be missing the end-point port number?

And presuming you have a peer PublicKey value.

8

24.1 Legacy Series / Wireguard - Peer Generator

« on: April 11, 2024, 12:51:42 pm »

Would it be worth adding a DNS field to VPN: Wireguard: Peer Generator?

It may resolve an issue where people are configuring road warriors, which can't resolve DNS, which looks to be a common question.

Edit: And possibly an IP address field.

9

24.1 Legacy Series / Re: [Solved]Python script converts Opnsense configuration file into kea reservations

« on: March 09, 2024, 10:16:02 pm »

If export/import is added to the ISC DHCPv4/v6 using the same file format as the existing Kea export/import, then migration of reservations between the two becomes trivial.

10

24.1 Legacy Series / Kea testing observations

« on: March 06, 2024, 11:45:10 am »

I've migrated a couple of firewalls to see how Kea behaves. Both have multiple networks which are using DHCP.  Both migrations were seamless and Kea is working as expected.

Some of the things I experienced I think could be enhanced if they are possible to deploy.

- When creating a subnet I would find it useful to be able to also define a name/label, or pull-in the interface name for the subnet (from a readability perspective).

- When creating a subnet you can enter a pool (as a /29 in my test) which is not in the subnet.

- When creating a reservation there is a check that the IP address is in the displayed subnet. As all the subnets are already defined this could be reversed such that the subnet is set from the entered IP address. Which is another way of saying I frequently did not have the right subnet when manually migrating reservations. That may have also been less of an issue if the subnet selection was name based rather than IP address based.


For the log file

- I miss seeing the DHCP discover, offer, etc. messages.

- ISC DHCPv4 will log a hostname if available, I've not seen them in the Kea logs yet.

While neither of the log messages are required they make it easier to spot a new device trying to connect to a network and if there is an issue with it.

11

24.1 Legacy Series / Re: After update OPNsense 24.1.2 and Suricata 7 VoIP is dead

« on: February 26, 2024, 03:40:39 pm »

Just a FYI.

I have two VoIP systems behind almost identical firewall hardware (one has a couple of additional 10GB ports) running  24.1.2_1  and configured in the same way. PBX traffic is over a 1:1 NAT.

I've seen the same issue of IDS needing to be disabled on one of them but not the other.

The major difference between the two looks to be the SIP trunk provider.

12

24.1 Legacy Series / Re: [Solved]Python script converts Opnsense configuration file into kea reservations

« on: February 25, 2024, 09:17:10 pm »

I did look at the contents of your merge output.

This will be the first time I've used Kea, so I'm not sure what the final result will need to be.

When I get time I'll run another machine with my firewall config on it and add additional subnets into Kea. Then see what the xml looks like.

I'll also dig out some old bash scripts I wrote which I used to migrate in ISC DHCP configs when I moved some clients from an external ISC DHCP server to OPNsense.

13

24.1 Legacy Series / Re: [Solved]Python script converts Opnsense configuration file into kea reservations

« on: February 25, 2024, 06:14:58 pm »

Are you searching the config-OPNsense*.xml for which interfaces use DHCP or are you just converting DHCP for the lan interface?

I have no lan network but I do have a number of Vlans which use DHCP and was unable to get to a merge.xml

I don't code in python and so far my attempts at modifying your script have yet to be successful from my linux workstation.

14

24.1 Legacy Series / Re: Import static dhcp from ISC to kea?

« on: January 31, 2024, 03:43:31 pm »

Maybe at the CLI?

See https://kb.isc.org/docs/migrating-from-isc-dhcp-to-kea-dhcp-using-the-migration-assistant

15

General Discussion / Re: OPNSense with UK Vodafone FTTC

« on: January 12, 2024, 11:19:33 pm »

I think you'll find it is all covered in the OPNsense documentation.

I went through it when I was adding an ISP connection over CityFibre, which also required using a vlan.