Messages

Result of "tcpdump -n host 192.168.0.60 and port 22" while trying to open an SSH session from PC to opnsense :

Look like there is nothing that answer on this interface (LAN). Really strange if you see the previous screenshot.

ipconfig show :
igb0 (LAN) with an IPv4 address I've defined (192.168.0.254), status active and up
igb1 (WAN) with an IPv4 address too, defined by provider via DHCP (...), status active and up.
Others interfaces have no carrier (igb2 and igb3.
Also exists enc0, lo0, pflog0 and pfsync0

From the LAN, I could ping OPNSense. Look like everything is ok

For netstat, I'm used to type "netstat -tlnp" from other Unix (not *BSD) so I could not decrypt exactly what is showed in "netstat -a" qo I used "netstat -4an" to focus on my access from LAN to web management :
I have DNS (53), HTTP (80) and HTTPS (443) listening (see picture). Look like OK for me.

TCPdump give too much informations (and private ones), so I need an example to narrow the display.

I'm already accessing with https SSL the router.
Have tried without too, same result

Hi,
I updated my OPNSense via the web interface with no problem, system rebooted and functional.
A week later, I wanted to access it via web interface : no answer.
I've tried via SSH : no connection.
Only the console is ok, no error, no strange message.
Updated via console : ok
Restarted : still no web interface or SSH.

I think some rules discarded during update. Any idea ?

Bonjour,

Voilà, tout est dans le titre. Après la mise à jour (faite par l'interface Web), plus moyen d'y acceder. Plus de SSH aussi, il ne me reste plus que la console.
Une idée ?

Je répond moi-même :
Je désactive le firewall et basta :)

No other way.
Cheers,
Franco

So, a good idea to make the update(s) less frustrating : put an option to do automatically updates over and over until the current version ! From 17.1 to 20.1.7, it took an afternoon and I have 10 boxes to do :)

Thanks.

I'm not sure how OPNSense is working but :
Using loadbalancing with 2 or more WAN need a stateful engine otherwise that will not work.
When a web connexion is made (web is a good example because it's doing many requests with a non-linear timeline), you can have packets going from either WAN but the firewall should remember the source and what WAN interface it's using. Otherwise, any destination with a security will detect a "spoofing" or 'man-in-the-middle" attack and will block you (or cookie based on public @IP will fail, etc...).
The hard part with web is to remember that "path" for a very long time because a user could stay on a page for an undefined period.

Hi,

Is there a faster way to upgrade from 17.1 to current 20.1.7 instead of upgrading to all steps between  (except of course, to reinstall everything) ?

Thanks.

[I disable PF completely]

And if ... I disable PF completely ?
I dont need the firewall part of OPNSense, just the router and VPN. My WAN (LAN corporate) is already secured by firewalls.

What do you think ?

RFC1918 and bogon networks already desactivated :)

Who should I trust ?

• franco : Do a NAT from a high port like 12345 to LAN 443 - not working
• ristridin : do a Firewall rule External IP/Host -> WAN address -> OPNSense 443 - not working
• jwright : disable reply-to on WAN rules - not working
• banym : change Mngmt port and open it from WAN - not working

I'm amazed by the number of answers to this very basic question (while pfSense is doing that in a very easy way) and none of them is working or provided with a simple step-to-step tutorial or picture, to avoid any errors.

BTW, my problem is still there.

You have not read my message...
The problem is not to setup the VPN, the problem is to give access to the Admin console to OPNSense GUI, without using a VPN.
I"ve tried many settings, including a NAT transversal, all my attempts are blocked by the deny rule.