Messages

1

24.7 Production Series / Re: DNS/Adguard Home broken in 24.7 (release candidate)

« on: August 01, 2024, 11:47:06 pm »

OP here.

Here we go again: One reboot later, Adguard fails to start (and thus does CrowdSec). 

I can't seem to find proper logs, but trying to start Adguard manually (via sudo) throws the following "fatal" error:

Code: [Select]

% sudo ./AdGuardHome
2024/08/01 23:44:03.973473 [info] AdGuard Home, version v0.107.45
2024/08/01 23:44:03.977454 [info] tls: using default ciphers
2024/08/01 23:44:03.978383 [info] safesearch default: disabled
2024/08/01 23:44:03.981912 [info] Initializing auth module: /usr/local/AdGuardHome/data/sessions.db
2024/08/01 23:44:03.981975 [info] auth: initialized.  users:1  sessions:0
2024/08/01 23:44:03.982085 [info] tls: number of certs: 2
2024/08/01 23:44:03.982098 [info] tls: got an intermediate cert
2024/08/01 23:44:04.004956 [info] web: initializing
2024/08/01 23:44:04.005215 [fatal] filtering: filtering: unknown blocked-service "yy"
Also, the "opnsense-revert" patch to bring back the telemetry widget did not survice the reboot. (!)

Looks very much like a repeat of this 2023 problem: https://forum.opnsense.org/index.php?topic=35251.0

Yep.

SOLUTION: edit your AdGuardHome.yaml and remove the offensive service - in my case "yy", see above.

Location: /usr/local/AdGuardHome/AdGuardHome.yaml

Code: [Select]

% sudo nano /usr/local/AdGuardHome/AdGuardHome.yaml


2

24.7 Production Series / Re: DNS/Adguard Home broken in 24.7 (release candidate)

« on: July 30, 2024, 08:43:02 pm »

OP here.

No problems since updating to the release version of 24.7 (currently on 24.7_9).

Note that as part of the upgrade process, mimugmail's Adguard Home plugin was updated as well.

3

24.7 Production Series / Re: DNS/Adguard Home broken in 24.7

« on: July 19, 2024, 09:26:31 am »

It is not RC2. 

It was 24.7-something-something-2.  I remembered it as "r2" but may be wrong. It was the most recent update following the instructions on https://forum.opnsense.org/index.php?topic=41580.0 (upgrade from beta to RC1).

4

24.7 Production Series / Re: Community Repo now compatible with 24.7 and above

« on: July 18, 2024, 09:27:55 am »

Adguard Home:  PSA:  After some uptime, I ran into an unspecified issue with Adguard Home (https://forum.opnsense.org/index.php?topic=41610.0) and reverted to 24.1. 

5

24.7 Production Series / [SOLVED] Adguard Home broken in 24.7

« on: July 18, 2024, 09:16:02 am »

Updated to 24.7 r.2 yesterday morning. All went well and working from home was fine.

This morning, DNS resolution was broken - Adguard Home was not resolving (I think - might have also been Unbound as I am running Adguard Home -> Unbound as resolver).

A reboot did NOT help. (Re-)Starting Adguard Home manually from the CLI errores out due to a service "yy" blocking the port (?).

Rolling back (via bectl) to 24.1.10_3 helped instantly - II am up an running without problems.

Apologies for lack of detail - cant dig deeper / replay the erroneous config right now, so just a word of caution and not a full bug report.

Doesn't seem to be the kernel issue, as I am running virtualized in ESXi.

(Edit: fixed title)

6

Documentation and Translation / Re: AdGuard Home setup guide

« on: January 27, 2024, 11:55:44 pm »

On the certs:

I use a very easy setup with acme let's encrypt certificates:

1. Use a wildcard cert

2. Paste into adguard home GUI settings -> encryption settings:

Certificate path:
/var/etc/cert.pem

Key file path:
/var/etc/key.pem

Works.

7

23.1 Legacy Series / Re: Secure NTP

« on: January 23, 2024, 06:15:47 pm »

I gather the regular approach is to use firewall rules to control whether e.g. NTP is available or not to a given subnet, not limiting the "listen to" interface settings in each service.

Works for me. No WAN rule "pass"ing traffic to port 123 = nobody from outside can access my local NTP server.

8

Hardware and Performance / Re: PC(ie) Hardware Recommended to work with OPNSense WiFi & Fiber optic

« on: January 05, 2024, 11:11:31 am »

Do not use the Opnsense box for WiFi. Use a separate AP.

9

Hardware and Performance / Re: Quad Gigabit on PCIe 3.0 x1 ?

« on: December 26, 2023, 07:06:59 pm »

PCIe 3.0 x1 is 8 GT/s or 0,97 GByte/s (https://www.heise.de/select/ct/2020/24/2014911062765141952), so yes, 4x Gigabit is no problem.

As to cards, customary proposal would be an Intel i350-T4 (and variants) -- buy used, but beware the fakes (https://forums.servethehome.com/index.php?threads/comparison-intel-i350-t4-genuine-vs-fake.6917/).

10

23.7 Legacy Series / Re: DHCP for several interfaces

« on: October 20, 2023, 08:25:53 pm »

Wouldn't this be a classic case for (free)RADIUS?

- unknown / unauthenticated clients are assigned to the untrusted VLAN
- authenticated clients are assigned to the trusted VLAN

(note: I've always wanted to set this up on my home network to cleanly separate work and private devices, but have never gotten round to it)

11

Hardware and Performance / Re: New to OPNsense - improving power consumption

« on: September 09, 2023, 11:17:46 pm »

There are several forum threads on power consumption.

One in particular recommended using powerdxx and playing around with the C states. Try here: https://forum.opnsense.org/index.php?topic=28033.0

But generally speaking, a firewall is unlikely to reach high C states because it will invariably be woken up by incoming traffic (= interrupts). Plus, certain NICS or NIC settings will prevent high C states (example: Intel 1G NIC, an i219 IIRC, will prevent high C states if you enable jumbo frames).

12

Hardware and Performance / Re: FireWall speed

« on: August 30, 2023, 05:56:14 pm »

Try a CPU with less cores but higher per-core ooomph (higher IPC, higher CPU frequency, etc.)

And try it without using HyperThreading (SMT).

13

23.7 Legacy Series / Re: This close to giving up

« on: August 30, 2023, 05:49:53 pm »

Sounds more like an issue with getting internet connectivity to OPNsense than the routing/firewalling.

Just checking that you
- do not use USB NICs
- do not use Realtek NICs (or if you do, have installed the plugin drivers)
- do not use Intel i225 / i226 NICs ?
- do not run OPNsense virtualised
- have checked and re-done the cabling

14

Intrusion Detection and Prevention / Re: Suricata Not Finding Anything

« on: August 16, 2023, 03:41:40 pm »

I have enabled "OPNsense-App-detect/test" with suricata in IDS Mode. Opnsense 23.7.1_3. Suricata listening on LAN and VLAN interfaces (not WAN).

Testing eicar download via HTTP wget/curl triggers the alert. Using a browser doesn't because the browser/website switches to HTTPS automatically.

15

23.7 Legacy Series / Re: DHCP Friendly Name (without static IP)

« on: August 03, 2023, 10:10:01 am »

That is probably because the device got a DHCP dynamic address while being unnamed and you subsequently "named" it. It should fall into one item on next DHCP release or at least next reboot.