Messages

Probably by raising an issue on GitHub is your best bet :) They are very good at providing feedback there.

Can you SSH in to your firewall and do a search for "panic.txt"? Is that a file?

As root;

Code Select Expand


find / | grep panic.txt

Can you see what the uptime of the firewall is, whenever you encounter this message? This message shows when you log in to OPNsense through your browser; but is it likely that the firewall has done a reboot- and then shows this message?

https://www.truenas.com/community/threads/this-is-driving-me-nuts-kdb-enter-panic.35536/page-3

Do you have any peripherals hooked up to your firewall?

jclendineng

But, if you have services facing the public? Then would it not be beneficial to also use Suricata / IDS?

I have a lot of these coming on my public facing ports these days, which I think Suricata handles pretty well :)

Code Select Expand


2034647 blocked xxx.xxx.xxx.xxx 54658 yyy.yyy.yyy.yyy 80 ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228)


I do not fully understand your question. But I think this is possible? Maybe this can get you started, these are from my notes from another project where I routed an entire subnet through a VPN connection:

Interfaces > Assignments. You will have multiple OpenVPN interface there??
Assign one interface which will be used as a gateway. After assignment, click the name of the interface (OPT5 or something similar).

• Enable Interface
  Description: WAN_OpenVPN
  Leave rest of the configuration as is. Click Save.
  
  Apply the changes.
  
  Go System > Gateways Click +Add gateway.
  
  Name: GW_WAN_OpenVPN
  Description: Access through WAN_OpenVPN?
  Interface: WAN_OpenVPN
  
  IP adress: xxx.xxx.xxx.xxx
  
  Check far gateway.
  Set rest to default.
  
  Click Save, Apply.
  
  Rules
  Go to Rules.
  
  Select the designated interface for your subnet / another OpenVPN server (??) which you would like to go out on internet through this WireGuard VPN.
  
  Add Rule.
  
  Allow any any IPv4, but be sure to select
  
  Gateway: GW_WAN_OpenVPN as your gateway under Advanced settings.
  
  Do not know if this helps, but good luck :)

A suggestion (however, I can see the issue):

Are you using the default ntpd service? I think you can use `ntpdate`. You could schedule a cron job using:

Code Select Expand

ntpdate

Try it from the CLI first? Set date to a wrong time, and try to issue `ntpdate`.
https://en.wikipedia.org/wiki/Ntpdate

If you have disabled the default ntpd service, by removing all of the ntp servers, and are using Chrony instead- perhaps this works:

Code Select Expand

chronyc makestep

https://www.mankier.com/1/chronyc

However, those cron jobs should only be, in optimal conditions, only have to be used once, after a boot, where the timer is really offset (?) I do not know how to accomplish this.


A question- did you let it run for a while? Could it be that OPNsense would be able to correct itself, over time?

I myself have this scenario which I have not found a good answer for:
- I have redirected all DNS requests to Unbound, which uses DoT upstream. Even the OPNsense installation as well.
- I have redirected all NTP requests to Chrony, which uses NTS - a NTS secured NTP server uses TLS/SSL to authenticate NTP traffic on the net.
- I am unable to use my stratum-1 rpi GPS HAT enabled NTP server in conjunction with Chrony, because I am not allowed to mix NTS and non-NTS servers. Which is merely a GUI problem / because whenever you opt in to use NTS, source Selection is using `authselectmode require` and not `authselectmode mix. I think I saw a forum post about it, but I cannot find it right now. I could go the route of adding certs and stuff to the Raspberry Pi.. .

Browse down to 'Source Selection' - https://chrony.tuxfamily.org/doc/4.2/chrony.conf.html to see many options that the GUI in OPNsense does not consider =)


IN the scenario where the time would be as wrong as it was in your case, I believe I would not get any DNS answers on my network with this setup, and all my devices would also drift as well as the time would not be accepted due to I have opted in for NTS and redirected all requests to the chronyd install on OPNsense.

Merry Christmas =)

[Telegraf]

mimugmail
I do not comprehend your answer. Pfelk is just a set of tools for analyzing this data, which comes from a source, like Suricata. Yes?

The question was meant for the statement 'Only few people on the forum are using Suricata at all as I learned in the last user group meeting.'

If it was meant to say 'Only few people on the forum are using Telegraf at all as I learned in the last user group meeting', I would understand your answer :)

Have not had the time to look into this. Life and all. Thank you for providing such an awesome products anyways :) Merry Christmas!

They do not use the Intrusion Detection service? Que pasa - can you please enlighten me? How are they securing / monitoring public facing services then? :)

Yes. There are issues opened on GitHub.


Anyways, thanks for reaching out!

Then what are they using  :o

Basically do this (I think - I cannot find my notes on how I did this):
1. System > Gateways > Add gateway.
Name can be 'GW_WireGuard' - the interface selected would be your WG interface.
2. Make a rule on the LAN interface; expand the ruleset (advanced or something) and select your newly created gateway instead of the default gateway.

Maybe this can get you started?

I use 127.0.0.1 as DNS server under System -> Settings -> General. This way, the OPNsense system itself (??) uses the Unbound resolver; which again uses DoT upstream.

Combined with NAT redirection rules, I have then full control over "regular" DNS queries - have not tinkered that much in regards to DoH. 

At least this is what I think I am doing :) Is this best practise? Do not know.

Does your IPv6 network resolve IPv6 hosts? Does IPv6 even work?

I know nothing about IPv6; but it looks as it cannot resolve?

Code Select Expand

ping -a google.com -6

Code Select Expand

dig -6 google.com

What happens if you try some of these servers listed here: https://linuxreviews.org/IPv6-listening_NTP_servers

https://serverfault.com/questions/951752/ntp-and-ntpdate-over-ipv6-does-not-work

:o :o

A regular reboot would also produce the same error?

What does the log say?

I am just thinking off the top of my head here; do you have any services that is prohibiting Unbound to start. .. If you do a regular reboot, and you see that Unbound does not start - but you can start it manually and everything works fine - how about disabling other services 1-by-1 & reboot; to find out what the culprit service might be? I have no idea which service might be interferring with the Unbound service though :)

If you disable all other DNS servers except Cloudflare's, what happens then - is your OPNsense firewall able to ping any of the spotify's servers? Then the problem might be Cloudflare.

Why, you say? Do not know.

I had the same issue when using Quad9 (not Spotify, it was just another random service); so I just dropped using them. I use a combination of 5-6 of those I found here: https://dnsprivacy.org/public_resolvers/

I would like to have this as well.

On my (VLAN) interfaces I have port redirect for 123 pointing to the Chrony service over at 127.0.0.1:123 (having the default NTPD disabled).

Chrony is using NTS enabled NTP servers:

time.cloudflare.com
nts.netnod.se
sth1.nts.netnod.se
sth2.nts.netnode.se

However, I have been unable to incorporate my RPi with GPS HAT with this setup, because the NTP server on the RPi does not use NTS.

I have not thought of the condition described in the comment from newsense.

It would induce a whole lot of problems when I come to think of it, because I do port redirect :53 to Unbound as well, which only uses DoT upstream servers (they are configured using IP - 95.215.19.53@853 - https://dns.njal.la ) - but in regards to certificates, time is of the essence.

Good cactch, newsense- thanks. Let's see if I find any ip addresses for these NTS enabled NTP servers. ..

Oh, wait - it is on the latest release.

[root@opnsense ~]$ telegraf --version
Telegraf 1.20.3

Hah! I have followed every release note and nowhere it has said the underlying software has been updated. Welp, I learned something new today - so is it safe to assume plugins are always *updated*, even though it does not say. .. I mean, the release notes are pretty good, but to also incorporate all the other bits and bytes-- would be awesome :)

Hmm. That would have been nice, to have somewhere in the GUI which says which version the plugin *actually* is.

I will look into this a bit more now. Cool!