Messages

If you find this useful, that's great.

I have made a major update to the notebook. It was initially using a very kludgey way of modifying the config XML. Just jamming new XML in Python text formatting. This is all now totally replaced by code that operates natively on XML using Python's xml.etree.ElementTree library. There are only two tiny cosmetic differences between the output of this script and the output of OPNsense's own config manupulators: Python adds an extra space in tags like this:

<sometag/>

So, they look like this:

<sometag />

This is not configurable that I can see in Python. Another person in a Github issue has identified which XML libraries add this space and which ones don't:

https://github.com/zeux/pugixml/issues/87#issuecomment-188621862

OPNsense can read config XML with these spaces, so it's irrelevant.

The only other difference is that the XML declaration at the very start has an encoding, but the one generated in OPNsense does not. Again, this has no effect on OPNsense's ability to import the config file.

Here is what it looks like from the script:

<?xml version='1.0' encoding='us-ascii'?>

Here is the native OPNsense:

<?xml version="1.0"?>

I may try to figure out how to get this output correct.

This interface is created automatically by OPNsense when you install the os-wireguard plugin. The purpose of this interface group is so that you can reference all WireGuard interfaces together as one when writing firewall rules. When using this interface in a particular firewall rule, that rule will apply to any WireGuard interface you create (you can have many WireGuard interfaces). If you want to reference specific WireGuard interfaces in a rule, you need to create those interfaces according to the documentation. The interface group is an integral part of WireGuard. You don't want to remove it. And I'm not sure it is removable unless you uninstall the WireGuard plugin.

The purpose of the interface group is mentioned here in the documentation:

"Finally, it allows separation of the firewall rules of each WireGuard instance (each wgX device). Otherwise they all need to be configured on the default WireGuard group that OPNsense creates."
https://docs.opnsense.org/manual/how-tos/wireguard-client.html#step-5-assignments-and-routing

This is where the interface group is created in the plugin source code:

https://github.com/opnsense/plugins/blob/3bcfab38f6ea265bf23b5b01eccc4e82f75fbb4e/net/wireguard/src/etc/inc/plugins.inc.d/wireguard.inc#L56-L70

And here is where it is referenced (perhaps in other places as well):

https://github.com/opnsense/plugins/blob/16f3522d08d30919b17e66bdec38352ef4c75208/net/wireguard/src/opnsense/service/templates/OPNsense/Wireguard/wireguard#L14-L19

Understood. Thanks for taking a look.

I've written a kludgy Jupyter notebook that takes a template config.xml and performs a set of replacements and additions based on the contents of an INI file. I'm using it for deployment of a project, but I figured that I would share it here if anyone needs something like this, at least it may be a place to start. There are a number of optimizations that are just for my project, so you may need to bend it to your will to make it useful.

https://gist.github.com/utkonos/57c79f1a0b68dd6a79cbf2de68db995a

I have been digging into the config.xml and during this, I noticed that the /conf/config.xml file has world readable permissions. I also noticed that the incremental backups of the config file located in /conf/backup have inconsistent permissions. Some are 640 and some are 644.

Are these permissions correct?

Yeah, we need to patch in ISO support but it could be done (similar to what msdosfs is doing) if you could raise a ticket on GitHub.

Done, and thank you sir.

https://github.com/opnsense/core/issues/5733

Greetings,

I am attempting to load a configuration file from a mounted ISO rather than a USB. The use case is for deployment on a VM inside of Proxmox, a virtualization environment. Generating an ISO and then uploading it to Proxmox's ISO storage is straightforward as is adding a second cd drive to the VM with that ISO attached. The result is cd0 with the OPNsense ISO attached and conf.iso attached to cd1. The layout of the conf.iso is /conf/config.xml as outlined in this previous thread:

https://forum.opnsense.org/index.php?topic=22307.0

Both devices are recognized correctly during first boot. When I press any key to start the configuration importer, both are listed:

<QEMU QEMU DVD-ROM 2.5+> at scbus1 target 0 lun 0 (cd0,pass0)
<QEMU QEMU DVD-ROM 2.5+> at scbus1 target 1 lun 0 (cd1,pass1)

When I select "cd1" at the prompt as the device to import from, it doesn't find the configuration and the following is printed to console:

No known partition layout was found for 'cd1'.

Is there a change that I can make to the ISO image that will allow this to work?