Messages

@waxhead

https://github.com/opnsense/core/issues/4647

ASRock J3455 is a bit dated, but cheap. Works well. Fanless. I have a mini-itx case from Intertech which fits OK in the living room.

Well, you shouldn't have to, I guess.

Install nmap / zenmap on the Server and check wether or not port 123 on the IPs are filtered, or open?

And / or check the actual ntpd.conf file for anything mysterious.

Just a suggestion.

Good luck!

@Vilhonator

It would be awesome to use Unbound for all interfaces, but specific interfaces with DNSBL.

pfBlockerNG v3.0.0_6 (pfSense) has this feature now, although just for specific IP adresses which then can bypass DNSBL - https://www.reddit.com/r/pfBlockerNG/comments/kcpg8g/pfblockerng_v300_6_update/

Updated:
DNSBL - NAT / Floating rule modifications when Localhost interface is selected
Add preliminary DNSBL Group Policy configuration that will globally bypass DNSBL for the defined LAN IPs

This might be of some assistance? https://forum.netgate.com/topic/129365/bypassing-dnsbl-for-specific-ips

Strange, I thought it would be the other way around- that you could reach the vServer Gateway at .174, but not the 146. address as it is not in the same subnet.

Your Server (client) has IP 192.168.31.162/27 (vServerP)

Your Firewall has two interfaces.
vFirewallP : 192.168.31.146/27 and vServer Gateway (192.168.31.174/27).


The time does only sync when you try .146.

It does not sync when you try .174.

But you can reach all interfaces with ICMP.

I have no idea, actually. I am not that adversed in subnetting, or in VMware.

But.

The guest OPNsense has 2 interfaces, 1 is in bridge-mode (WAN)- the other, as an internal network (LAN)?
And the Server, the other guest, has just 1 interface, which is in the same internal network as the LAN interface on the OPNsense guest.

Ugh, why do you do subnetting. What about just doing VLANs ;) Then just set the appropriate VLAN tag on your Server guest network interface :)

Next step would be to paste your actual ntpd.conf configuration file, i guess.

Sorry, I do not know what could be wrong. It seems that the screenshot provided shows the correct settings?

Great, so it worked? Cool :)

And the browser check gave you Encrypted DNS as well?

I might have misunderstood something here.

But, do you have three interfaces- all within the same net?

Or; what is the subnets of these interfaces? Can you post the CIDR notation of each?

And what is the IP/Subnet of the client (Server?) from where you execute your PowerShell command? .. Is the server on the same subnet as the Gateway?

What does Command prompt: w32tm /query /peers give you?

You can ping all OPNsense interface addresses from your "Server"?

https://www.cloudflare.com/en-gb/ssl/encrypted-sni/

Check your browser. What does it say (Secure DNS)?

I cannot understand your network scheme; the names you provided, Port 2 - Firewall Management, Port 3 - Server Gateway - I do not see them in the screenshot you have provided?

You have two interfaces which has an unique IP adresse on the same subnet?

SSH in to your fw.

Check connectivity with these commands:

chronyc sources
chronyc sourcestats
chronyc tracking

See if you are connected securely with NTS:
sudo chronyc -N authdata

If you disable ntpd, which you should if you want Chrony to listen to port 123, remember to do something to make the fw synchronize itself (cron job + ntpdate)


Some more information can be found here:
https://github.com/opnsense/plugins/issues/2162
https://github.com/opnsense/core/issues/2012

Try to manually, on a client on a LAN, synchronize time from the OPNsense fw.

Yes. I would suggest DNS over TLS which uses port 853, which will even encrypt your DNS queries.

Check your browser: https://www.cloudflare.com/en-gb/ssl/encrypted-sni/ before you start.
Probably fails on multiple checks? Do not bother with the "Encrypted SNI" for now.

This is how I have done it - atleast how I think I've done it.

System > Settings > General : REMOVE any DNS Server you have listed here. Click Save.

Go to Services > Unbound DNS > General.
* Enable Unbound
* Enable DNSSEC Support

This is from the top of my head, but make sure those things are checked. Listen port should be 53 and you should be listening on all interfaces. Do not worry the WAN etc., everything is blocked by the default firewall rules.

Hm, then go to Miscellaneous under Unbound and add servers which supports TLS. You have to specify the adresse in server@port fashion:

Write 1.1.1.1@853 and press Enter.
Probably add atleast one more, 1.0.0.1@853.

Click Save.

I do not know what platform you are on; Windows? Flush your DNS with CMD: ipconfig /flushdns

Grab a cup of coffee.

Go to Firewall > Log Files > Live View. Click the drop down Menu which says "action". Choose dst_port, remove the text "pass" and write 853 and click the + symbol.

Now as you go to your LAN client and visit websites and ping stuffs, like ping microsoft.com or any other website- you should see traffic gets populated to either one of your DNS servers you have defined under Miscellaneous.

Verify which DNS server you are using with nslookup, "nslookup hltv.org".

Check your browser again? https://www.cloudflare.com/en-gb/ssl/encrypted-sni/


Now. If clients were to not use your OPNsense as a DNS server (they do not honor the DNS Server provided in the DHCP offer), you could do NAT Port forwarding from your LAN interface and redirect every traffic (UDP/TCP) destined for !LAN@53, to be redirected to 127.0.0.1 port 53.

You could check if any traffic is going out, by doing the Live View in the Firewall logs as mentioned above, and change port to 53.

That way, if you have a client which use for instance 8.8.8.8 as a DNS server, you'll redirect this request to your OPNSense Unbound DNS service. And voilà, the upstream DNS which will be 1.1.1.1 serves this request over TLS.

Try this and see if anything of it makes any sense ;)

Yay, first post.