Messages

You would be better off looking at a m.2 format NIC to go either in the wifi slot (2230) or the 2nd storage slot (2280) - you can get proper intel chipset NICs in that format which are well supported

Do you have examples? I looked for m..2 NICs some time ago out of interest, and could hardly find ones, especially with an Intel chipset.
The only one I remember is on Amazon: "Kalea Informatique Controllerkarte Mini PCI Express (MiniPCIE) – 1 Port LAN Gigabit Ethernet – Chipsatz Intel 82574"

I did pkg upgrade xxxx for all the 3 files and that got it working again.

Somewhat similar here - I re-installed from CLI and updated (via GUI). pulled 1.3.3. working fine now on os-0.1.

Now did a

Code Select Expand

pkg remove os-crowdsec
pkg install os-crowdsec-devel

and crowdsec seems to be up and running. System->Firmware->Plugins now also reports 0.2 and shows notes for the plugin.

There is also sysctl hw.acpi.cpu.cx_lowest

Have you tried if

Code Select Expand

sysctl hw.acpi.cpu.cx_lowest=c3
has any effect on your system (the command as such works)?

[crowdsec_blacklists]

Sorry if I'm missing something obvious, but I just installed it and the two aliases crowdsec_blacklists and crowdsec6_blacklists are empty ?

I thought they'd contain the URLs where they'd take the bad IPs from ?

It looks like they get pulled every two hours by default according to the "Alerts" tab on the plugin UI. I don't remember if they got populated immediately at installation time though. I'd give it a little time, like two hours max or check the docs.

Confirmed that they get populated automatically after some time (2h sounds about right).

Can't recommend firehol - it often blocs GitHub addresses (false positives).

You need to pick the right tunable. It depends on the driver used by your NIC

For blocking all traffic to certain IPs, use IP Blocklists, not suricata - much faster.

1. Define a URL table alias with your IP source
2. Employ a firewall rule(s) to block all traffic from/to that alias.

I get a different error on OPNsense 22.1.6 (Intel i5250u / Qotom Q355G4):

Code Select Expand

Starting powerdxx.
powerd++: (ECONFLICT) a power daemon is already running under PID: 22
/usr/local/etc/rc.d/powerdxx: WARNING: failed to start powerdxx

PID 22 is, of course, the regular powerd:

Code Select Expand

22 root         20    0    12M  2240K select   0   0:46   0.00% /usr/sbin/powerd -b adp -a adp -n adp

So ... as per https://opensourcelibs.com/lib/powerdxx, I'll change over to powerdxx:

Code Select Expand

root@OPNsense:/tmp # service powerdxx onestart
Starting powerdxx.
powerd++: (ECONFLICT) a power daemon is already running under PID: 22
/usr/local/etc/rc.d/powerdxx: WARNING: failed to start powerdxx
root@OPNsense:/tmp # service powerd stop
Stopping powerd.
Waiting for PIDS: 22.
root@OPNsense:/tmp # service powerd disable
Cannot 'disable' powerd. Set powerd_enable to YES in /etc/rc.conf or use 'onedisable' instead of 'disable'.
root@OPNsense:/tmp # service powerd onedisable
powerd disabled in /etc/rc.conf
root@OPNsense:/tmp # service powerdxx enable
powerdxx enabled in /etc/rc.conf
root@OPNsense:/tmp # service powerdxx start
Starting powerdxx.

Stopping powerdxx and running it in foreground verbose mode confirms it works:

Code Select Expand

root@OPNsense:/tmp # powerd++ -vf -a adp -n adp -n 75% -M 1600
powerd++: cannot read hw.acpi.acline
Terminal Output
        verbose:               yes
        foreground:            yes
Load Sampling
        load samples:          4
        polling interval:      500 ms
        load average over:     2000 ms
Frequency Limits
        battery:               [500 MHz, 1600 MHz]
        online:                [500 MHz, 1600 MHz]
        unknown:               [500 MHz, 1600 MHz]
CPU Cores
        CPU cores:             2
Core Groups
          0:                   [0, 0]
          1:                   [1, 1]
Core Group Frequency Limits
          0:                   [500 MHz, 1601 MHz]
          1:                   [500 MHz, 1601 MHz]
Load Targets
        battery power target:  50 % load
        online power target:   50 % load
        unknown power target:  75 % load
Temperature Throttling
        active:                yes
        source:                dev.cpu.%d.temperature
          0:                   [95 C, 105 C]
          1:                   [95 C, 105 C]
power: unknown, load:  912 MHz,  54 C, cpu.0.freq: 1601 MHz, wanted: 1216 MHz
power: unknown, load:  900 MHz,  54 C, cpu.1.freq: 1601 MHz, wanted: 1200 MHz
power: unknown, load:  617 MHz,  54 C, cpu.0.freq: 1200 MHz, wanted:  822 MHz
power: unknown, load:  605 MHz,  53 C, cpu.1.freq: 1200 MHz, wanted:  806 MHz
power: unknown, load:  327 MHz,  54 C, cpu.0.freq:  800 MHz, wanted:  436 MHz
power: unknown, load:  308 MHz,  53 C, cpu.1.freq:  800 MHz, wanted:  410 MHz
power: unknown, load:   27 MHz,  54 C, cpu.0.freq:  500 MHz, wanted:   36 MHz

However, it does not seem to enable the turbo mode (when setting max MHz to 2700):

Code Select Expand

power: unknown, load: 1002 MHz,  69 C, cpu.0.freq: 1200 MHz, wanted: 1336 MHz
power: unknown, load:  993 MHz,  68 C, cpu.1.freq: 1200 MHz, wanted: 1324 MHz
power: unknown, load: 1093 MHz,  70 C, cpu.0.freq: 1300 MHz, wanted: 1457 MHz
power: unknown, load: 1075 MHz,  68 C, cpu.1.freq: 1300 MHz, wanted: 1433 MHz
power: unknown, load: 1159 MHz,  71 C, cpu.0.freq: 1400 MHz, wanted: 1545 MHz
power: unknown, load: 1117 MHz,  68 C, cpu.1.freq: 1400 MHz, wanted: 1489 MHz
power: unknown, load: 1110 MHz,  70 C, cpu.0.freq: 1500 MHz, wanted: 1480 MHz
power: unknown, load: 1045 MHz,  67 C, cpu.1.freq: 1500 MHz, wanted: 1393 MHz
power: unknown, load: 1095 MHz,  69 C, cpu.0.freq: 1400 MHz, wanted: 1460 MHz

Perhaps a hardware CPU temperature protection kicks in?

I think fsetstat etc. are functions of the SFTP server, not independent Linux commands. So you need to look at Proxmox' SFTP implementation I think.

See e.g. https://community.atlassian.com/t5/Bitbucket-questions/Couldn-t-fsetstat-permission-denied-errors-with-sftp-deploy/qaq-p/1108832 or https://stackoverflow.com/questions/8675373/using-perl-sftp-i-keep-getting-an-fsetstat-error-when-i-put-a-file https://serverfault.com/questions/821760/denying-timestamp-modification-on-sftp-server (for modifying a linux SFTP server) or ...

Alternatively, the OPNsense / ACME SFTP script might need to be modified, see e.g. https://stackoverflow.com/questions/62170626/workaround-for-unsupported-setstat-request-on-sftp-server-with-sshj

BTW, I came across similar issues with uploading the certificates to my ESXi server -- connection works but copying the files over fails unfortunately :-(

And you should work on your google-foo :-)

Bumping this - same issue here.

Also, suricata still throws alerts for ET_info although I removed (disabled) that ruleset ..

Ntopng should be able to meet OP's requirements?

In the meantime, you can also have suricataog events as JSON and alert yourself per email through monit (monitoring the JSON file). There is documentation floating around. I could also dig up the config later tonight if needed.

Unfortunately, no - would be great to get this to work somehow!

This has been fixed in 22.1: https://github.com/opnsense/core/issues/5396

Easiest is to use Adguard Home (from the community repo) in place of pihole.

Adguard Home can do all that pihole can, including EDNS, and you can run it all on one box.

"Chaining" pihole or AGH to unbound does not make sense if you want to use EDNS: EDNS is only relevant if you forward queries, not if you run a full resolver (which is standard behaviour for unbound).

AGH can do split DNS and EDNS and caching, so you could use that to (1) forward local queries to unbound and (2) everything else directly to an upstream resolver with EDNS.

Note that EDNS breaks your privacy, though.