Messages

I'm not the only SNMP user, right?

Was "Sticky connections" renamed to "Sticky outbound NAT" at some point?

I see it referenced here:

https://github.com/opnsense/core/issues/2170

but can't find that setting.

Trying to interoperate with Sonicwall firewalls. They allow to create an IPsec tunnel interface and create route policies on it, without assigning IPs to the tunnel, or specifying any local/remote subnets. I am not sure about the terminology of this, but I think this would be an unnumbered VTI.
I don't see a way to do this with the OpnSense UI, but it might just be that I am not familiar with how the UI works. If I choose "Route based" then I have to put IP addresses in, otherwise:

"A valid local network IP address must be specified."

Is is it possible to do this?

Adding VLANs has caused some of the interface indices to be shuffled around. This makes review of historical data difficult. Back in the days of Cisco IOS there was a 'snmp ifindex persist' config parameter [or something like that] that would prevent this. Is there an equivalent in OpnSense?

Can the interface descriptions seen with SNMP be synced with what is in the web interface?
Eg every interface is seen as the device name:

Code Select Expand


RFC1213-MIB::ifDescr.1 = STRING: "igb0"
RFC1213-MIB::ifDescr.2 = STRING: "igb1"
RFC1213-MIB::ifDescr.3 = STRING: "igb2"
RFC1213-MIB::ifDescr.4 = STRING: "igb3"
RFC1213-MIB::ifDescr.5 = STRING: "igb4"


but in UI we have the Identifier and Description values which would be more useful than the device name. Running OpnSense on a variety of hardware means that different systems show different names, even though all systems may have LAN, WAN1, WAN2, etc.

https://github.com/zerotier/ZeroTierOne/issues/835
"Route via Zerotier" according to the screenshot on there

Not quite that simple, you need to set allowDefault=1 on the client side as well to get it to accept a default route.
And it's case-sensitive as well, use the wrong case and it will accept the command it but give you no errors and not work  ;D

Afraid to say my experience with Zerotier on Opnsense has been nothing short of baffling. It's maddeningly inconsistent with whether it will come online or not, requires multiple reboots for the service to stay online, peers go to RELAY for no apparent reason, etc.
I don't think this is actually an Opnsense issue, I suspect that BSD is a second-class citizen when it comes to Opnsense development.

Have been experimenting with using a ZT tunnel as a default route for internet traffic.
It works OK once enabled with

Code Select Expand

zerotier-cli set <networkId> allowDefault=1

but then after a reboot, it's broken - Zerotier cannot establish a connection at all and no traffic is passed. Flip it back with allowDefault=0 , reboot and internet access is restored [albeit no longer over the ZT tunnel].
It is as if Zerotier is trying to use its own default route to establish connectivity for its own traffic, which seems like a silly defect.

We have had some success with this deployment scenario using Teltonika RutOS devices, but they simply don't have the horsepower to handle the throughput we need, hence looking at doing this on Opnsense [and I must say I am pretty damn impressed with Opnsense so far, other than this specific issue].