Topics

1

21.1 Legacy Series / System log showing errors. How to debug

« on: March 17, 2021, 02:27:10 pm »

I am seeing errors consistently printed to the system log.  Here's a sample:

Code: [Select]

2021-03-17T09:21:44 api[17144] no matching csrf found for request
2021-03-17T09:21:44 api[43449] no matching csrf found for request
2021-03-17T09:21:39 api[17144] no matching csrf found for request
2021-03-17T09:21:39 api[43449] no matching csrf found for request
2021-03-17T09:21:34 api[17144] no matching csrf found for request
2021-03-17T09:21:34 api[43449] no matching csrf found for request
2021-03-17T09:21:29 api[43449] no matching csrf found for request
2021-03-17T09:21:29 api[17144] no matching csrf found for request
2021-03-17T09:21:24 api[43449] no matching csrf found for request

I don't know how to troubleshoot this and any help would be greatly appreciated.  Here's some information on my setup

Code: [Select]

OPNsense 21.1.3_3-amd64
FreeBSD 12.1-RELEASE-p14-HBSD
OpenSSL 1.1.1j 16 Feb 2021
Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz (4 cores)

I am not positive when these started (b/c I stupidly cleared my log), but I did just make some changes to my wireguard firewall rules.  No idea if that's related.  FWIW, everything seems to be running fine, but these errors are concerning nonetheless. 

Thanks in advance for any help.

2

Intrusion Detection and Prevention / First time user setup - which interfaces

« on: February 16, 2021, 07:03:15 pm »

I admit to being a little confused about which interfaces to place intrusion detection on.

Here is my network topology

6 Port Protectli box

• 2 Empty ports (LAN and OPT1) -
  
• Lagg0 (named TRUNK) - 3 ports in LACP LAGG going to Cisco managed port in trunk mode-> 10.0.10.1/24
• VLAN10 - HOME - 10.0.0.1/24
• VLAN20 - GUEST - 10.0.20.1/24
• VLAN30 - SERVERS - 10.0.30.1/24

All traffic is tagged in the switch and passed through the LAGG.

I believe I don't need intrusion detection on the WAN since it's completely locked down using firewall rules. I do want it on my internal network to ensure that nothing is compromised.

In the Intrusion Detection admin page in the interfaces dropdown I see the all the interfaces linked above AND I see em3, em4, em5 which are the physical ports that I have set in the LAGG. 

Should I be setting intrusion detection on the single interface named TRUNK and assume it can see all the traffic from the VLANS? Should it be set to the physical interfaces which comprise the LAGG?  or to the VLANS themselves?

3

21.1 Legacy Series / Local connections dropped at seemingly random intervals

« on: February 16, 2021, 05:05:46 pm »

I am experiencing a perplexing, and troubling problem where at seemingly random intervals all devices on my local network lose connection to the router.  I have no idea if WAN connectivity is dropped as well since, during these moments, my internal IPs are dropped.  This started happening ~2 days ago which roughly corresponds to updating to OPNsense 21.1.1.

Topology

Fios -> OPNsense 21.1.1-amd64 running on a 6 port Protectli -> Cisco managed switch

Connections in use

 - Lagg0 (three nics using LACP in trunk mode to the switch) -> 10.0.2.0/24
- VLAN10 (HOME) -> 10.0.0.0/24
- VLAN 20 (Guest) -> 10.0.20.0/24
- VLAN 30 (Servers) -> 10.0.30.0/24

When the connection problems occur, I receive an IP from the opnsense in a range I'm not using at all.  192.168.97.15 with a netmask of 255.255.0.0

Unfortunately, I'm really not certain where to start even troubleshooting this issue.

4

21.1 Legacy Series / (solved) Can't automount a USB drive

« on: February 14, 2021, 01:42:29 am »

I can't seem to get my 4Gb USB drive to automount at load. I plan on symlinking `/var/log` and `/tmp` to this drive to save writes to my root SSD. 

Code: [Select]

root@opnsense:/ # gpart show da0
=>     40  7856048  da0  GPT  (3.7G)
       40  7856048    1  freebsd-ufs  (3.7G)


Code: [Select]

root@opnsense:/ # cat /etc/fstab
# Device Mountpoint FStype Options Dump Pass#
/dev/gpt/rootfs / ufs rw,noatime 1 1
/dev/gpt/swapfs none swap sw 0 0
/dev/da0p1 /mnt/usb_drive ufs rw,noatime 2 2


Code: [Select]

root@opnsense:/ # df -a -H
Filesystem         Size    Used   Avail Capacity  Mounted on
/dev/gpt/rootfs    107G    2.3G     96G     2%    /
devfs              1.0k    1.0k      0B   100%    /dev
devfs              1.0k    1.0k      0B   100%    /var/dhcpd/dev
devfs              1.0k    1.0k      0B   100%    /var/unbound/dev

Running `mount -a` successfully mounts the drive.  Any idea why it's not mounting when I restart? 

5

21.1 Legacy Series / New Install - No WAN Access

« on: February 05, 2021, 05:33:01 pm »

I recently purchased gear to upgrade my network and have chosen OPNsense as my firewall/router.  To allow the switch from one router to another, I am working to configure OPNsense as far as I can before switching out my old router for the new one. 

I successfully got OPNsense up and running with a new install with a 192.168.1.1/24 range in the LAN with the WAN being provided via DHCP from my current router.  However, my desired end state network uses 10.1.1.1/24, not 192.168...  So, I reset OPNsense to factory settings and set 10.1.1.1/24 as the LAN static IP.  However, now nothing is working. 

Fios --> ASUS RT-AC86U (10.1.1.1/24 private IP space) --> OPNsense

OPNsense details

• WAN DHCP (has IP of 10.1.1.177 from the Asus' DHCP)
• LAN IPv4 10.1.1.1/24 with DHCP enabled
• allow all firewall rules for LAN/WAN

I successfully get an IP and can access the OPNsense web gui when connected to LAN. However, neither a LAN connected computer nor the OPNsense box itself are able to connect out to the Internet.  Example, Pinging 1.1.1.1 from the OPNsense web gui times out. 

I am assuming that my problem is based on the fact that my legacy network is using the same RFC-1918 private networking space (but I'm not positive) since it worked with OPNsense using 192.168.1.x.

Any help or thoughts getting this up and running would be greatly appreciated.