Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
whats in log?
root@OPNsense:~ # cd / && du -ma | sort -nr | head -n 20
50463 .
32519 ./var
31071 ./var/log
30435 ./var/log/nginx
30430 ./var/log/nginx/ds1.xxxxxx.xx.error.log
Is it normal? Shall I simply disable Access Log Format in this particular HTTP server settings? Or can we set somewhere max. size of logs?
And can I apply this update directly on 20.1.9 or it's better to wait for 20.7.3?# opnsense-update -kr 20.7.2-netmapJust one question, maybe a silly one, is this reversable in case of problems ?
it looks more like a nginx question than opnsense one.I gave up because https://stackoverflow.com/questions/36120467/nginx-not-matching-location-i-think
but tell more detail what the user is typing, what the request to the upstream should be (perhaps url rewrite is required).
in first and second cases you use different server names..
details of 404 errors can be viewed in the "HTTP Error Logs"
Ok, understand it. Thus in perfect world we should have all in GUI named as headers are or alternatively, in their description
don't think so. ideally, there should be no "free" fields in GUI config
read "Safeguard user input"
https://docs.opnsense.org/development/guidelines/basics.html
so I highly doubt that such a request will not be declined
I have an idea about using hook and GUI, but I have a feeling that I have already tired the team with my requests and ideas)
nope. upgrade of nginx plugin will overwrite location.conf. so it will need to be restored (but i hope that @fabian will include this hook in next version. and may be it will use same foldername syntax ))If I'm right, there are already built-in hooks in "server's" section, so it might be the same for "location"?
QuoteWhere to find location.conf, somewhere within "/usr/local/etc/nginx"?/usr/local/opnsense/service/templates/OPNsense/Nginx/..QuoteStill I'm not able to locate separate config file where I could enter missing headers and include in main config..in the end of location.conf right before last brace insert new hook.
so before:Code: [Select]{% endif %}{# honeypot #}after:
}Code: [Select]{% endif %}{# honeypot #}
include {{ location['@uuid'] }}_post/*.conf;
}
go the GUI and apply nginx config (not reload, apply. so opnsense apply new location.conf)
go to the
/usr/local/etc/nginx/nginx.conf and be sure that at the end of location blocks there is a line like:
include 248efebe-d2e2-401b-b93f-f4d9061bb18c_post/*.conf;
if so, you can create folder like "248efebe-d2e2-401b-b93f-f4d9061bb18c_post" in /usr/local/etc/enginx/,
place a file like "mylocationname.conf" with your directives and Apply nginx conf.
imo that shoud work, (I checked and replaced User-agent header via the hook. works:Code: [Select]set $new_user_agent "${http_user_agent} via nginx";)
proxy_set_header User-Agent $new_user_agent;
at any step, something can go wrong. always make a backup
proxy_set_header Upgrade $http_upgrade;Does it make practical difference whether they are in location section or above?
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Forwarded-Host $http_host/editors;
server {
listen 80;
location / {
proxy_pass_header Server;
proxy_pass http://nextcloud/;
}
location /editors/ {
proxy_pass http://onlyoffice/;
}
}
no. proxy_redirect not used by default afaik. sorry, what are you going to do with this header?Thanks for reply! I've been trying to follow various guides of how to setup proxy for Nextcloud
proxy_set_header X-Forwarded-ForWhere to find location.conf, somewhere within "/usr/local/etc/nginx"?
set to $proxy_add_x_forwarded_for by location.conf
proxy_set_header Upgrade $http_upgrade; <- GUI websocket
proxy_set_header Connection $proxy_connection; <- GUI websocket
proxy_set_header X-Forwarded-Host $http_host/editors; <- not in GUI
server {
listen 80;
location / {
proxy_pass_header Server;
proxy_pass http://nextcloud/;
}
location /editors/ {
proxy_pass http://onlyoffice/;
}
}How can I configure above? Still I'm not able to locate separate config file where I could enter missing headers and include in main config...
proxy_redirect http:// $scheme://; <- I believe set already by "Use https"GUI doesn't correspond directly to standard headers' names and without documentation it's almost mission impossible to get it set properly.
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr; <- option set in HTTP Server
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Forwarded-Proto $scheme;
No, I'm off premise and connect to Opnsense over VPN. I can't afford to demolish it
Hi GreenMatter, I do not think this will be of help, since the problem is related to the kernel.
Are you able to start a new (test?) guest and see how the new test kernel is behaving?
remotely...
Hi GreenMatter, sensei heartbeat is unrelated to this.And again it happened again the same (on 20.1.9 - I'm waiting for final netmap version) within a few days from the first occurrence: lost access to all internal vlan networks.
Netmap error messages make me think this is related to netmap.
We had seen a lot of progress on netmap side for the past month. I expect vmx support will also perform better than 20.1.x
2020-09-09T04:31:07 kernel: 667.875025 [1180] netmap_grab_packets bad pkt at 390 len 0What surprising me is that all has been working fine for months, I had done no changes in setup, no new packages were installed and all of sudden this problem appears. I know it's net map but could it be triggered somehow by Sensei which inspects parent interface vmx1?
2020-09-09T04:31:07 kernel: 667.875016 [1180] netmap_grab_packets bad pkt at 389 len 0
2020-09-09T04:31:07 kernel: 667.875008 [1180] netmap_grab_packets bad pkt at 388 len 0
2020-09-09T04:31:07 kernel: 667.875001 [1180] netmap_grab_packets bad pkt at 387 len 0
2020-09-09T04:31:07 kernel: 667.874992 [1180] netmap_grab_packets bad pkt at 386 len 0
2020-09-09T04:31:07 kernel: 667.874306 [ 277] vmxnet3_netmap_rxsync 130 skipped! idx 46
2020-09-09T04:31:07 kernel: vmx1: watchdog timeout on queue 0
2020-09-09T04:31:02 eastpect[8308]: nm1::vmx1^: permanently promiscuous mode enabled
2020-09-09T04:31:02 eastpect[8308]: nm0::vmx1: permanently promiscuous mode enabled
Guests should use WPA Personal or Open plus captive portalRegardless guests, since users need to accept LE (untrusted) certificate every 2 months, so it is better to use untrusted, self signed certificate with much longer validity...