Messages

you can install Chrony and use NTS.

Yep. Here's a list of NTS servers:
- https://gist.github.com/jauderho/2ad0d441760fc5ed69d8d4e2d6b35f8d
- https://gitlab.com/-/snippets/2481323

I use:
time.cloudflare.com,ptbtime1.ptb.de,ptbtime2.ptb.de,ptbtime3.ptb.de,ntp2.glypnod.com,nts.sth1.ntp.se,nts.sth2.ntp.se,ntp.3eck.net,ntp.trifence.ch,ntp.zeitgitter.net,nts1.adopo.net,www.jabber-germany.de,www.masters-of-cloud.de,ntppool1.time.nl,ntppool2.time.nl,ptbtime4.ptb.de,paris.time.system76.com,ntp3.fau.de

Awesome. How to create a cron job to get it update everyday?

Hi
I enable IPv6 for multiple interfaces + vlan, and Adguard listening without issue. I see IPv6 addresses show up on Adguard's dashboard. However, I have no idea if redirect rule to adguard would force IPv6 as well. Temporarily I add LAN IPv6 to rdr tartget alias. The problem is that I don't have static IPv6, and my ISP changes prefix once a day. Appreciate some example of IPv6 rdr configuration on adguard and opnesne.
Cheers

Anyone else able to test?

I replaced repos with transfer, it seems there is no file or directory found.
Edit: replace the link inside, not rename. My bad. The new version works, but I have configured pihole so for now I round robin to both..for redundancy reason.  :P

Updated without issues. Here's my config:

Unbound on LAN interfaces standard port 53
AdGuard on dedicated VIP on port 53 using 127.0.0.1 ad upstream DNS
DHCP pointing to AdGuard VIP as DNS

This works for me, thank you. However I can't get any IPv6 forward to Adguard using Nat portfoward to ::1 and 127.0.0.1.

Thanks, I didn't know we can created another interface from the same port that's used for pppoe connection.
In my case,  I have my LAN bridged already and the modem using the same subnet so I only need to create the interface, add to bridge and create rule allow access to Modem's IP address, protocol: TCP port 80.
I wonder if there's any tips for pppoe connection. I heard ppl create multiple virtual ip for PPPOE connection in on order to cheat their speed connection. :P

Hi,

I just finished installing Adguard. Work like a charm. Please don't mind if I ask, is there a guide to add multiple networks to Adguard?
For example, I have a separate interface for AP, I changed rule of AP interface: Destination: AP address  to Destination: LAN address and added 192.168.1.1 as DNS in its DHCP. It seems to work and I start seeing Adguard picking up IP from mobile devices. However, I wonder if it would cause any issue.

Cheers

Edit: Found the answer in page 14

Yup, i actually Found Matt's website on how to do this : https://0x2142.com/how-to-set-up-adguard-on-opnsense/

Very Bottom.

Example how to add more networks is, Example Default with no additional networks :

In there, you'll see a section like this:
dns:
   bind_hosts:
       - 192.168.1.1

And one with more :

dns:
   bind_hosts:
       - 192.168.1.1
       - 192.168.10.1
       - 192.168.100.1

Thanks jlab

Edit: Faced a slow loading dashboard, failed to update. Turns out the solution is just need to change bind_host and dns:bind_host to 0.0.0.0. Also was un-abled to update till I hit a couple more times, thing just went through.

Thanks everyone, I just need to read the whole thread :D

One question tho, in some screenshots, I see Unbound: Register DHCP leases & Register DHCP static mappings are unticked. Others said they ticked those. I tried both and had no issue with internet connection. Kinda confused. Sorry, I'm a noob. My excuse is I just start using Opnsense a couple months ago.

Edit: Upgraded to the latest Opnsense today and Connection drop after reboot. Router can connect to internet but Adguard does not resolve DNS. Disabled Adguard and change Unbound back to 53 fix the issue. # Adguard plugin needs update. Solution: opnsense-revert -r 23.1.5 opnsense

Nice. Will do once I'm home. TY.

Hi guys,
Today I decided to try Zenarmor again and even w the new netmap from Franco, the speed was slow down to 600Mbps. So after removed ZA, connection speed is back to normal. But there is one annoying little thing that's always sticking around. Every time I uninstalled ZA.  This error always appear in Audit- Health log. Before the solution was to re-installed kernel but now even that doesn't work anymore. How do I get rid of this error?

Cheers

It looks like I ran into similar issue. I recalled what I did to cause the issue was bridged the Lan network and changed it back, then a couple reboots after that caused that. I also did enable PnP in bios so it might be the problem.  Anyway, fresh install seems fixing it.

Idk, I'm not a networking guy so maybe my wording is wrong. Maybe format like this:

Domain

Code Select Expand

000space.com


Unbound

Code Select Expand

local-zone: "000space.com." always_nxdomain

Really, idk. Hagezi typed like that hence I thought it's a type of format, which make sense to me.

Anyway, I found that only the links from Domain/Subdomains can be added to URLs of Blocklists, n the rest are not.

Like format in this one for example:

Code Select Expand

https://gitlab.com/hagezi/mirror/-/raw/main/dns-blocklists/domains/doh-vpn-proxy-bypass.txt

I use these lists from Hagezi which are quite wife approval.

Code Select Expand

https://gitlab.com/hagezi/mirror/-/tree/main/dns-blocklists/domains

Make sure you copy the RAW link, otherwise Unbound won't be able to read it.

Hi,
I'm using the latest version of Opnsense, kernel 23.1.2-tuntap. I have around 2.7M URLs of blacklist added to Unbound and it is quite a hassle to whitelist 400-500 URLs to Unbound :Whitelist Domains. I can't find any file in unbound directory that related to whitelist. Where is it located?

Also it would be great to have URLs of Whitelist so can I use https://raw.githubusercontent.com/hagezi/dns-blocklists/main/whitelist.txt or https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt that are update regularly/occasionally.
Cheers

Yes - good idea.

I also only have custom blocklists as the default list is not a good one (for me).

I use and love Hagezi's Blocklists - maintained well and fast https://github.com/hagezi/dns-blocklists

But it's only showing 'custom' at the moment.

Not a big deal at all - but would be nice to have a naming for them.

I use hagezi as well, his whitelist is not bad at all. Wife approved so far.

which version do you run for adblock?

edit i´m trying to run unbound but did´t seem to work when i used the unbound version

use the domain format instead, like https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/ultimate.txt .

I have the same

Code Select Expand

python39-3.9.13 is vulnerable . Is it bad?