Messages

Back for news ;-)

The HA Cluster has been tested in a separate way, behind an ISP router different from the first post (Sagem Livebox V5).

I added a small 8 ports switch between the ISP routeur & the WAN interface of each Opnsense box.

One modification has been done : the outbound rules where set as "Source : LAN Address" instead of "LAN Net" ==> My expert told me it wasn't relevant enough for the previous CARP_VIP/MacAddress issue we met.



For now, the HA Cluster is fully responsive, the failover works great, incoming VPN or incoming NAT rules are processed ;-) The only "trouble" I have is OpenVPN connection not kept during a failover, but this will be not a real problem for end users.

I will give you some feedback when I well go back on site.

Hi All@community

We are facing an issue with a CARP/HA cluster.

Environment works perfectly with the HA Cluster, last OpnSense release up2date :

- 2 identical OpenSense boxes,
- A CARP LAN woking correctly : toogle from MASTER to SLAVE while removing one member,
- Two gateways : first ISP is a fiber connection (Zyxel VMG3625-T50B routeur), second on a GSM 5G cellular WAN
- Both gateways are in a CARP WAN OpnSense setup : WAN_CARP ans 5G_CARP
- Gateways Group setup : also working in good state, setup from WAN to 5G ou 5G to WAN if any gateways are removed

Issue we met : the WAN IP fiber router sees only an ARP table with the two IP of each OpnSense boxes (192.168.1.3/24 and 192.168.1.4/24), the CARP address (192.168.1.254/24) + the CARP MacAddress is not seen :-(

We thought of an ISP router misconfiguration but no L2/L3 setup available at this side.

We added an intermediate Ethernet switch beetween the 2 OpnSense boxes and the fiber ISP routeur : same issue.

We absolutely do not have any outbound issues from the LAN side toward the Internet, but due to this fact as no ARP entries are shown at the ISP router  side, we are not able to perform any incoming traffic.

The ISP broadband routeur (Zyxel VMG3625-T50B routeur) is setup to perform NAT (not as bridge mode) : while adding a NAT rule for accepting OpenVPN traffic ==> IP address for one of the 2 OpnSense box instead of the WAN CARP IP (192.168.1.254), we ar able to open a VPN tunnel from outside. If we modify the VPN behaviour to use the WAN_CARP address + modifying the NAT entry at the Zyxel VMG3625-T50B routeur, no more any OpenVPN incoming traffic works.

As a reminder, the broadband router always shows ARP/IP address for the two OpnSense boxes.

Any clues/ideas will be welcome, we will have a look with an expert this Wednesday October 25th do go deeper, if we missed a setup.

Ciao - Au revoir

Sorry for any English mistakes, I'm not english native spoken !!!

Hi all !

I did an upgrade this afternoon for a previous version from opnsense 22.7.11_1 -> 23.1_7.

This upgrade was done in two steps :

opnsense upgraded: 22.7.11_1 -> 23.1_6
opnsense upgraded: 23.1_6 -> 23.1.7_3

I'm not sure that that point, but it seems that we lost the WAN netmask from /24 to /32 after upgrade :-(

OPNSense was claiming a gateway 100% lost packet, the cellular router was OK, o dropped packets from itself.

I check at the Gateways settings, tried a modification for the Monitor IP and OPNSense told the network range ( /24) wasn't relying the WAN interface

I did a check for the WAN settings, and the IP V4 address was  /32 instead of /24. Once changed to /24, situation came back to nominal.

Did a such behaviour was seen in the past ?
Is it a known bug ?

Everything was OK before the upgrade.

Thanks a lot for your opinion.

PS : No VLANs, no Virtual Interface, just a very easy setup with a 4 x GB I211 Gigabit Network / Core i3-4010U CPU @ 1.70GHz

Shame on me. - Enable IPsec was not checked...

Hi !

I was creating an IPSec macOS Mobile setup*, and the same shame : forgot to turn it on ;-)

*https://github.com/thomergil/opnsense-ipsec-vpn

Hello to all of you,

I would like to ask you about an OPNSense project, to be deployed at a manager's home place.

This manager has a pfSense firewall (installed by myself) in his agency. This pfsense will be replaced by an OPNSense version.

The customer wants a site-to-site VPN between his home (SoHo) and the agency: easy with 2 OPNSense.

I will propose him an OPNSense installation at his home, a good triplet of Ubiquiti WiFi points and the associated WiFI controller.

The customer will also receive an A/V equipment (ARCAM connected amp + a nice dose of Focal in Dolby Atmos !!!), video-projector, etc... in short the whole package.

In the absolute, and according to the diagram below, I could not control the IPTV Decoder (Orange TV France ) via the WiFi and/or Ethernet equipment of the 192.168.100.0/24 LAN

https://i.imgur.com/Z7XxGTO.jpg

I don't want to replace the ISP routeur (LiveBox) with an OPNSense firewall + tricks on it, to make the IPTV video streams + phone flow through it (the customer will keep a fixed phone connected to the Livebox).

Thanks for your opinion !

Regards.

Bonjour à toutes & à tous,

Je me permets de vous solliciter au sujet d'un projet OPNSense, à déployer au domicile d'un gérant.

Ce gérant possède un firewall pfSense (installé par moi même) au sein de son agence. Ce pfsense sera remplacé par une version OPNSense.

Le client souhaite un VPN site à site entre son domicile (SoHo) et l'agence : facile avec 2 OPNSense.

Je compte donc lui proposer une pose d'un OPNSense à son domicile, d'une bonne triplette de points WiFi Ubiquiti et le contrôleur WiFI associé.

Le Client va recevoir également un équipement A/V (ampli connecté ARCAM + une belle dose de Focal en Dolby Atmos !!!), vidéo-projecteur, etc... bref la totale.

Dans l'absolu, et selon le schéma ci dessous, je ne pourrais pas contrôler le décodeur TV Orange via les équipements WiFi et/ou Ethernet du LAN 192.168.100.0/24

https://i.imgur.com/Z7XxGTO.jpg

Je ne souhaite pas remplacer la LiveBox par un firewall OPNSense + tricks dessus, pour y faire transiter les flux vidéo IPTV + téléphone (le client va conserver un téléphone fixe branché sur la Livebox).

Selon vos expériences, est-il possible - à l'aide d'un firewall OPNSense côté SoHo - de faire fonctionner l'ensemble ? Le firewall sera très certainement un modèle 4 interfaces, en provenance de chez Provya.

Merci pour vos avis et expériences sur une telle configuration et m'indiquer si elle semble réalisable ou non.

PS : je pense conseiller l'utilisation d'une ChromeCast pluggé sur le contrôleur A/V ARCAM pour y diffuser le contenu TV Orange