Messages

Die APUs sind fein. Sie schaffen halt kein Gbit per PPPoE und für die IDS-Komponenten (Suricata, Sensei) sind sie wohl auch etwas schwach dimensioniert. Alles andere läuft prima. 4 GB RAM sind ja auch eher üppig, wenn man mal mit so einem Edgerouter oder ähnlichem Zeug, auf dem gerne OpenWRT installiert wird, vergleicht.

Ich hatte lange Zeit einen VMware-Cluster mit je einer VM auf den beiden ESXi-Servern und einer HA-Konfiguration der beiden Firewalls. Secure Computing Sidewinder. Lief tatsächlich wie eine Eins.

Die Firewalls wurden durch Hardware ersetzt, weil der Durchsatz irgendwann nicht mehr ausreichte ... nicht wegen der Verfügbarkeit.

I am a big fan of Apache Guacamole:
https://guacamole.apache.org

Remote access via browser. Targets: RDP, VNC, SSH. Various authentication backends. In short: everything those commercial "SSL portals" offer, only well designed, with current crypto (only depending on your frontend webserver) and open source. The frontend is HTML5.

The downside: the engine/server is written in Java and deployed via Tomcat. That's quite a mouthful in terms of memory requirements.

While it might be added as a plugin to OPNsense I would recommend against it for this reason. On the plus side: it runs beautifully from FreeBSD packages on a suitable FreeBSD machine or in a jail. It's simple to setup. And you can use OPNsense's HAproxy to handle TLS and the certificates and then relay HTTP(S) to your Guacamole server.

HTH, kind regards,
Patrick

Das tut sie sowieso ...

Hmm, is this documented somewhere?

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242744

IMHO you can definitely run those services on an APU system. If you stick to the algorithms supported by AES-NI, then IPSec won't be a problem and the other services you mentioned are not compute intensive.

Use a switch. With VLANs or without, but don't bridge the interfaces of the APU to create a cheap switch. I regularly do that, because it works, but you won't get gigabit speeds. The bridging code will be vastly improved in FreeBSD 13. Some time in 2022 for OPNsense, I hear.

Similarly WireGuard performance will improve by a great margin, but probably this year already.

As for the cheap brackets: that price is a steal! Ever ordered simple metal brackets for anything by Cisco?  ;)

Kind regards,
Patrick

APU4D4 are limited but suitable for the job in my case. I have a 50/10 Mbit/s DSL line ...
Don't expect gigabit speeds, couple of hundred M will be the most you are going to get, specifically with bridging.
And I have not even tried to run Sensei and/or Suricata. Again, they do perfectly well with a couple of less demanding services. I run AdGuardHome, WireGuard, Postfix, ... absolutely no problem.

And on the plus side, they are robust and need very little energy.

Rackmount: https://www.varia-store.com/de/produkt/104337-19-quot-dualrack-system-konfigurator-fuer-pc-engines-apu4-boards-dual-slot.html

Bisher hab ich sonst keine Probleme. Mit Enter oder CTL-C kommt man leider auch nicht weiter. Wenn ich herunterfahre oder einen USB Stick einstecke oder so dann seh ich das alles in der Konsole. Die WebUI und und alle Firewall Dienste laufen normal. Seltsam oder?

Das sieht so aus als hast Du die serielle Konsole aktiviert. D.h. Du siehst die Boot-Meldungen des Kernels noch auf der VGA/IPMI, das Login kommt dann aber auf der seriellen.

Couldn't find it yesterday, are these Intels aware of spectre and meltdown?

Spectre and Meltdown are side channel attacks in a multi-tenant environment. They are hardly relevant on a dedicated appliance without any remote user access. Unless you already have a remote code execution vulnerability in which case you have larger problems, IMHO.

Kind regards,
Patrick

Seems VLAn is the way to go but with most devices not supporting it natively I need to have the switch do these things, plus separate wireless SSIDs, and very fast the number of networks grow and the maintenance work grows with it...

VLANs and separate wireless SSIDs on access points that support VLANs are the way to create multiple separate networks at the infrastructure level to separate untrusted devices that do not support VLANs, of course.
With two VLANs you create two "virtual switches" on your single real switch. Then assign ports to the different VLANs (untagged) to separate e.g. your IoT devices from your computers.

In short, it all centers in applying different fw policies by "class" of devices, for me they are my networking stuff, servers, PCs, media/gaming, smart home devices and finally CCTV.  That's already 6 VLANs and at least 3 of them have devices both wired and others wireless, so 3 SSIDs... That's getting quite complex for me, especially since I don't mind them contacting each other most of the time...

Don't think in terms of function but in terms of trust. Put all devices you trust equally well (or not ;)) into the same VLAN. Essentially only your infrastructure needs to support VLANs. The switch, the access points, and OPNsense. These are connected by ports that carry tagged frames, so called "trunk" ports.
All other devices are connected to an access port that carries only one VLAN untagged. Or a particular SSID that is mapped to a particular VLAN.

Think of VLANs as separate switches, separate access points, separate networks. You could build the same with 6 times the number of APs, 6 switches, and 6 ports on your OPNsense, right? VLANs are just a way to save ports and switches.

HTH,
Patrick

17:00 ist prima :)

- And i don't think the traffic will go over the OPNsense. A switch is working MAC based not IP based, so it will look in its ARP Table and will send the traffic directly to the next device (which is not your OPNsense)

This is not quite correct. With two separate layer 3 networks the client will never send a packet with a destination address of the server in the layer 2 header, because it will not perform ARP, because the network is not directly attached. Instead it will do an ARP lookup of the router and send all packets there.

Now the router could send an ICMP redirect, but those are again layer 3, not layer 2, and the networks are separate, so in the end it doesn't.

But why would you even want to run two layer 3 networks on the same broadcast domain (layer 2 network aka switch)? If there is a reason for this addressing scheme, VLANs are indeed the answer, provided your switch supports them.

Wenn es nur für ordentliche Zugriffe von außen sein soll würde ich den HAProxy dafür nehmen, der managed dann die Zertifikate.

Und eine ordentliche Authentifizierung vor das TrueNAS login kleben. Das Teil ist nicht dafür gemacht, aus dem Internet erreichbar zu sein.

Ebend - entweder das, oder auf der OPNsense einen cacheing recursive nameserver wie z.B. den Unbound einschalten und den nach 1.1.1.1 forwarden lassen.

Just a guess, but does the AdGuard server have the privilege and the code to put the LAN interface in promiscuous mode on FreeBSD?

@tusc, if you look with ifconfig, you should see a "promisc" for the network interface in question. If that is missing, you can configure that manually with e.g. ifconfig igb0 promisc.

HTH,
Patrick