Messages

tried on yubikey too.  can you answer a few questions just to make sure i'm not doing something dumb

a) when i add it, it tells me its a 30 second time period despite the TOTP server being set to a time window of 120 at the moment.  Is this expected behaviour?

b) there doesn't really seem to be any way to tell OPNSense that a specific user should use a specific type of authentication method.   ie i could in theory have multiple  TOTP servers created.  I know in the tester it gives you the option to select the method. but from a created user perspective it doesn't seem to allow to say "this user must use this auth method"

c) when the QR is imported into the auth app it lists it as username@firewallname  is that the username i should be using to log in or is it just username?

don't know if it means anything or not but i changed it to 120 seconds time window and 30 seconds grace.  created a new secret/seed for the user. deleted the old one in authenticator and scanned the new QR.  Still doesn't work.   But the code still seems to change every 30 seconds.  is that normal behaviour (ie does it basically allow any of the last 4 codes in a 120 time window?)?

thanks, but just checked my phone and my fw and the times are out by maybe a second or 2.
Tue Mar 1 16:48:55 GMT 2022
phone is set to GMT and says much the same

i'll try changing it so that the codes are valid for longer and see if that helps

any more ideas to troubleshoot please?

yeah its still running.  Looking through the log files it still seems to be 'doing stuff' although from the clients perspective thats a big fat lie.
config wise its not doing a lot.   I've got a convoluted setup for dns so that everything works, i'd rather NOT have it like this but apparently it's the only way.
client > firewall dnsmasq (so that lan clients can access other lan clients etc via their hostname) > pihole (on server, docker) > firewall unbound (so that pihole can resolve hostnames for reporting etc)

(config of dnsmasq etc can be found - https://pi-hole.net/blog/2021/09/30/pi-hole-and-opnsense )

awesome.  glad it worked for you! :)

yeah i tried to use dns but kept getting issues with it getting confused and not working for a while etc.

just make sure you have all three NAT settings ticked in Firewall: Settings: Advanced

and create a nat port forwarding rule for what you want make sure nat reflection is ticked in the rule. and auto create a filter rule too.
if you've done it right you'll see the rule in the Firewall: Rules: Floating bit.
make sure its top of the rules. 

thats what i've got and it now worked.  hopefully it does for you

I had the same issues with hairpin nat when i first set up opnsense.  I'll dig out what i changed as it now works ok

any suggestions?  please?

Hi all,
Not sure what else I can put really, i've been using DNSMasq for my DNS for the last week or two

I'm finding that in this time, a disconcerting number of times it seems, randomly, all internet stops. 
Trying to troubleshoot exactly what has happened I worked out it was DNS that was the fault.   I restarted DNSMasq and everything starts working again.

Log files show nothing that i can make out (from what I can see it was still receiving a lot of DNS requests, just wasn't doing anything with them (supposed to upstream to my pihole).

Anyone else having issues? or is there anything i can tweak/change to make it less prone to these sort of issues?

ok well i got it working in the end.  I was using the wrong IP address for the VPN. It needs to be the IP that actually is associated with your  ovpnc1  interface.  I was putting in the 'gateway' IP on that subnet.
Also bear in mind that that IP may change a fair bit.  If it does then your squid.conf will need updating to that new IP.
I have found a script which checks that interface and changes the squid.conf to change the tcp_outgoing address.
Just need something to trigger that script now.

did you get this to work?  i too am trying to do the same thing.  I configured tcp_outgoing_address as the "route" for my openvpn client but it doesn't want to send any traffic to it. 

In Aduard home you can configure what device gets what block or allow by using client settings or using custom filtering rules.

have you tried that?

just looked at my plugin list and i don't see adguard! ?

When you enable the auth server, the default is <token><Password>

If you want it to be <password><token> you'll have to go into the two factory auth server config and check "Reverse token order"

yes, I know. I want to use it  password+token but as i say i've tested both ways in terms of testing and in the config.  neither make any difference.

I'm sure you already did this, but let me just make sure:

Within the Tester GUI, did you switch the "Authentication Server" to "TOTP-Server"?

For general logon you have to also add this option to "System" - "Settings" - "Administration" - "Authentication" - "Server". You will want to add all the needed "Identity Providers" you want to be able to logon.

Best wishes :)

thanks for your reply.  yes it's def selected the TOTP server in the tester page.   I'm not changing my authentication for the system to use TOTP until i have tested it and it is proven to be working ok, else i'll be locking myself out. (as per the guides instructions too)