Messages

I think this might be a bug in OPNsense on the older DEC850. I reset to factory defaults, copied my settings to a VM, manually entered them, shut down the VM, and restarted the DEC850. Over time my performance degrades from 250 MB to 950 MB down to 30 MB, and stays there unless I factory reset, and power cycle the modem and firewall. I'm going to venture a guess it has something to do with a setting being left over from an older version release.

I'm going to pick up a cheap laptop to confirm it's not my modem doing this.

I was installing an old image. The latest version works fine.

I'm trying to figure out why my firewall's performance degrades with the latest version. So, I'm setting up a virtualbox VM to manually transfer settings. I have a feeling my old config had some rogue setting that's not playing well with the newest version. But, I can't get the installer to load successfully in a VBox environment.

I keep getting an ld-elf invalid file format error. I'm using the dvd installer. Anyone know what might be going on?

https://imgur.com/a/opnsense-vbox-1P7bWFw

Yeah, I'm looking into it from a factory reset. Factory reset brought me back to 800 Mbps out of 1 gigabit.

I know the system since I've been running it for awhile. I probably had some configuration that was not applied properly during an update.

-------

Saving config, factory reset, restore config, and then reboot fixed the issue. I'm able to get 250 Mbps to 500 Mbps immediately.

--------

I tried another fresh install and it looks like the problem is caused by turning Surricata on. I probably need to remove some rules. I have a ET open/bottcc.portgrouped and all of the ET telemetry rules installed. Happen to know which I should get rid of?

Does Zenarmor have better performance as an IPS?

I know which features typically cause slowdown so I disabled them. I think this is a bug in OPNSense. The connection will be fine if I connect directly through the modem.

I already made sure the issue is not my modem by getting my ISP to reset from their end. I also shut off the modem and firewall, and then restarted them. I tried turning off IPS and IDS, and turning off my VPN. Even though, I've taken out those potential bottenecks I'm still getting download speeds of only 20 Mbps, when I should have gigabit. I do have a bunch of tunables turned on that increased my throughput back on 24.1. I'm on  24.7.10_2.

Have any idea what might be causing my issues? Anyone experiencing slow speeds even after a reset?

Yeah, I have to work on filtering alerts from Monit. I'm getting spammed by security researchers checking for vulnerabilities.

Currently, I just have

Code Select Expand

content = "blocked" for my Surricata service tests. Is it possible to drop a file path in the Monit Service Tests Settings. I'm probably going to have to filter out a ton of junk.

Would

Code Select Expand

content = "blocked" && ((content = "<test signature>" && content != "<ip address>") || /* more false positives */ ) be the right way to filter?

My intrusion detection keeps picking up a security company spamming my ports to check for vulnerable VOIP ports. I do not use VOIP, and monit keeps spamming my email with alerts over it. To silence it do I want to reject or block connections on that port? What's the difference between the two?

I'm using Unbound to forward specific websites to DNSmasq, which I use to populate an external alias that sends those connections out through one gateway. On my firewall rulles, I have that rule placed above the rule for routing out my VPN's gateway. All of the default web traffic is supposed to go out over my VPN connection.

Normally, my forwarding rules make me successfully go out without using the VPN; but, on occasion connections still go out over the VPN. Does anyone know what might be causing me to go out the wrong way on occasion?

Wouldn't having this in a plugin improve the security of OPNsense?

I don't like having to venture into the repos of non-hardened BSD to install microcode updates. But, definitely running on bare metal those updates could have security and performance benefits. Is there any means of including this in an official plugin since we do not need this for VMs.

I have four use cases I'm trying to solve for. There are three solutions, which I need. I've already figured out the two general rules needed, but cannot figure out how to handle the exceptions properly.

I'm using GEOIP to send traffic to different wireguard gateways. If the site is located in the US it goes out though a US server. If not the US it goes out over my preferred wireguard gateway. This works perfectly well. Where I run into trouble is getting the exceptions to route traffic reliably. There are a few sites I either do not want going out over a VPN, or to use a VPN running Socks5.

I tried using the FQDN. That works until the site refreshes their IP. It's an issue with a mismatch between the DNS on my OPNsense box, and what IP the URL currently resolves to.  I also tried using ASN; however, a large amount of sites use the same ASNs. Is there a reliable means of doing this?

Would running a local DNS, and refreshing the database before visiting those sites work? Is there a means of doing that with Unbound?

Found the setting under advanced settings.

I'm stuck at setting a certificate for signing my client instance. I have the Mullvad certificate, which OPNsense is not letting me import under System --> Trust --> Certificate, as I do not have access to the private key. I tried importing it through System --> Trust --> Authorities; but, I cannot set that for OpenVPN client. I tried creating my own CA to see if I can sign a certificate using the imported Mullvad certificate as an authority. But, under "Sign a Certificate Signing Request" I do not know what to paste in the CSR file.

How can I properly import the CA given by Mullvad to get OpenVPN working?

Just used a larger usb, and it copied find.

I just downloaded the latest bios update. After dding it to a disk, from Arch Linux, it is not bootable on a Dec850. gparted keeps giving an error about not being able to have a partition outside of the disk. I saw a few posts saying that means there's space in the img that needs to be zeroed out. The partition has iba for the flag should I just add boot to that?