Messages

91

Intrusion Detection and Prevention / Re: ET Telemetry Edition having problems?

« on: October 14, 2021, 12:50:28 pm »

Maybe new problem: Since yesterday, my Suricata instance (on 21.7.3_3) no longer updates the rules - neither the cron job nor a manual "Download & update rules" does anything.

I added a few rule categories yesterday and "enabled" and "saved" them. Since then -> downloads don't work.

--

EDIT: The issue was the "OPNsense-App-detect/test" rule. Once I disabled that, the rules would download again.

92

21.7 Legacy Series / Re: ACME-Automation Copy Certificate to Host via SFTP - Howto?

« on: October 14, 2021, 12:38:55 pm »

The ACME plugin sftp automation only permits certificate-based login, not password-based. So you need to set up a ssh certificate login at your target box (guides are available via google).

Attention: The ssh certificate/key you need it not the general OPNsense ssh one, but the specific one for the ACME plugin, found at  /var/etc/acme-client/sftp-config/id.rsa.pub (thanks to https://forum.opnsense.org/index.php?topic=20437.0!).

93

Intrusion Detection and Prevention / Abuse.ch SSBL - more performant TLS ruleset?

« on: October 13, 2021, 10:46:35 am »

https://sslbl.abuse.ch/blacklist/ states:

In addition, SSLBL provides a more performant Suricata ruleset that uses tls_cert_fingerprint instead of tls.fingerprint. Please use either the ruleset above (sslblacklist.rules) OR sslblacklist_tls_cert.rules from below. Do not use both of them at the same time.

...

In order to use the more perfomant Suricata ruleset avilable for download below, you must run Suricata 4.1.0 or newer.

https://sslbl.abuse.ch/blacklist/sslblacklist_tls_cert.rules

Would it be possible to replace the current SSLBL ruleset with the more performant TLS ruleset? Or add it as a custom ruleset?

(the "user defined" tab only seems to permit adding custom rules, not custom rulesets)

94

German - Deutsch / Re: Cloudflare Proxy - Reverse Proxy und Wireguard?

« on: October 13, 2021, 09:21:15 am »

Bei cloudflare den proxy für eine unterdomain abgeschaltet, zB "wireguard.myTLD.de": no proxy (DNS Einstellungen) und das dann für wireguard verwendet.

Ansonsten: Tailscale anschauen, das müsste dank fremden relay servern auch ohne Offenlegung der eigenen WAN-IP funktionieren.

95

21.7 Legacy Series / Re: Iperf speeds slow (Vmware environment)

« on: October 12, 2021, 09:18:30 pm »

I've added "hw.pci.honor_msi_blacklist=0" made no real difference.

Apologies - that tunable us only relevant if you pass through a physical NIC to opnsense I believe, so likely would not have effect on vmxnet3 performance.

96

21.7 Legacy Series / Re: How to test Google Drive configuration backups

« on: October 11, 2021, 09:00:16 pm »

They are not encrypted the same way, uses different keys, so I need to know how to manually decrypt the file from Google Drive so

Apologies - I had naively assumed that the backup to gdrive was made in plain text and protected by the usual GDriveaccess control.

Just checked my own setup and indeed the backups are encrypted. Thankfully I did save the key somewhere. So I'll need to test it as well. *Follows thread*

97

21.7 Legacy Series / Re: How to test Google Drive configuration backups

« on: October 11, 2021, 04:36:32 pm »

1. Download config (backup) from Opnsense GUI
2. Download from Google Drive
3. Diff.
4. Be happy.

98

21.7 Legacy Series / Re: Iperf speeds slow (Vmware environment)

« on: October 11, 2021, 03:54:18 pm »

Add a tunable:
hw.pci.honor_msi_blacklist=0

(See e.g. https://forum.netgate.com/topic/157688/remove-vmware-msi-x-from-the-pci-blacklist)

99

21.7 Legacy Series / Re: ZFS Health Status and Menu Coming Soon?

« on: October 11, 2021, 03:51:35 pm »

Any plans to impelement automatic snapshots before any opnsense-code or opnsense-update? I saw this on TrueNAS.

Same mechanics (automatic boot environment creation upon pkg updates) are in Illumos/OmniOS; and probably in FreeBSD itself, too. So maybe some code / concepts can be re-used for this.

100

21.7 Legacy Series / Re: Unbound DNS BL

« on: September 26, 2021, 12:07:27 pm »

There is no easy interface for unbound DNSBL.

Better install adguard home from the community repo - it offers similar functionality to pihole, including a nice Interface.

101

21.7 Legacy Series / Re: resolving issue (?)

« on: September 21, 2021, 05:55:25 pm »

Not an unbound issue - it only does DNS. And your resolves work apparently.

Do you use IP blocklists?

102

21.7 Legacy Series / Re: Firewall and ASN

« on: September 21, 2021, 01:22:16 pm »

*push* - This would certainly help with keeping a "whitelist" of IP addresses that should not be blocked by IP blocklists.

I had some github.com IPs showing up on some IP blocklists I used for example.

103

21.7 Legacy Series / Re: Chrony NTS broken?

« on: September 21, 2021, 01:18:34 pm »

Works fine for me (latest opnsense version); these are the public NTS servers known to me:

Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
=========================================================================
time.cloudflare.com          NTS     3   15  256   4d    0    0    8  100
sth1.nts.netnod.se           NTS     1   15  256   8d    0    0    8  100
sth2.nts.netnod.se           NTS     1   15  256  10d    0    0    8  100
ptbtime1.ptb.de              NTS     1   15  256  10d    0    0    8  100
ptbtime2.ptb.de              NTS     1   15  256  10d    0    0    8  100
ptbtime3.ptb.de              NTS     1   15  256  10d    0    0    8  100
nts1.time.nl                 NTS     1   15  256  10d    0    0    8  104
nts.ntp.se                   NTS     1   15  256  10d    0    0    8  100
ntp1.glypnod.com             NTS    19   15  256 447m    0    0    3  104
ntp2.glypnod.com             NTS     1   15  256   7d    0    0    8  104
ntpmon.dcs1.biz              NTS     1   15  256   7d    0    0    8  104

104

21.7 Legacy Series / Re: resolving issue (?)

« on: September 21, 2021, 01:15:56 pm »

Cloudflare could be blocking it.

But what's stage is that you seem to be able to ping it under its domain name, so it does get resolved?

Anyway, since I had my own issues with unbound: check whether strict qname minimisation is enabled and if so turn it off - it's a likely culprit.

105

Tutorials and FAQs / Re: HOWTO - Redirect all DNS Requests to Opnsense

« on: September 16, 2021, 06:42:14 pm »

Thanks but that's not it - the option is unchecked..

Probably more of a firewall issue I guess?