"
I have Suricata running with ET Telemetry Pro with a couple of rulests (dhsield, emerging-current-events, emerging-imap, emerging-malware, emerging-phishing, emerging-web-client, emerging-web-server — I just checked a few after after reading their description somewhere), running on both LAN and WAN. So far so good, it runs. But I am at a loss how I would see the results. Is there a way I can make sure that something is triggered so that I can see it actually detects something?
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
#21
Intrusion Detection and Prevention / How can I test my Suricata setup? Say, test URL?
December 14, 2022, 11:06:37 PM #22
General Discussion / Bandwidth: LAN devices get it first come, first served (can hog everything)?
December 04, 2022, 11:45:59 PM
I noticed the following (22.10 Business Edition): I have two laptops that are connected to the LAN and that I perform a speedtest on.
What happens is this: when the first one starts a bit earlier than the second one, the first one eats all the bandwidth. In other words, in my case: the first one goes up to close to 300Mbps, and the second one stays at 2-4Mbps until the first one finishes, then shoots up. If I start them (near) simultaneously, they both get roughly half of the available WAN bandwidth.
That makes the impression that if one user on the network is first, they can hog the entire bandwidth and the rest has no chance until they are done. Is that indeed the case? Or is there some rebalancing going on when the situation persists longer (speedtest is only 15 seconds)?
What happens is this: when the first one starts a bit earlier than the second one, the first one eats all the bandwidth. In other words, in my case: the first one goes up to close to 300Mbps, and the second one stays at 2-4Mbps until the first one finishes, then shoots up. If I start them (near) simultaneously, they both get roughly half of the available WAN bandwidth.
That makes the impression that if one user on the network is first, they can hog the entire bandwidth and the rest has no chance until they are done. Is that indeed the case? Or is there some rebalancing going on when the situation persists longer (speedtest is only 15 seconds)?
#23
Virtual private networks / Looking for an example .mobileconfig macOS profile for IKEv2 VPN XAuth
December 03, 2022, 05:15:56 PM
I have a setup where I have a working IKEv2 using a certificate for the server and username/password (FreeRADIUS on the OPNsense side). This works for macOS and not for iOS. And it only works if I tell Phase 2 on the OPNsense side to tell the client to tunnel only to my OPNsense LAN network (Local Subnet)
I would like to be able to send all traffic through that IPsec link, for that I can enter Network 0.0.0.0/0 in Phase 2. But when I do that, the client cannot send or receive traffic from the internet at large. It only works with a partial VPN.
I have seen some information that I need to set that "send all traffic over VPN" at the macOS side as well, but the only way to do that is to create a .mobileconfig in Apple Configurator and edit that to include that setting (by hand) in the XML:
But maybe that no longer works.
So, as a first step, I tried recreating the manually created IKEv2 VPN on the macOS client (the one that works). But if I try that, macOS (Monterey) complains that there is a 'configuration error' and it immediately fails without trying to set up the VPN.
So, exactly the same VPN connection, one entered by hand and one entered via a profile, one works, one not. I tried a lot of other things based on internet articles, but I haven't been able to create a .mobileconfig that works and that combines a certificate for IKEv2 in combination with Xauth (username password) so that I can use FreeRADIUS on the opnsense router.
Is there anyone who has a working .mobileconfig (even without 'all traffic over VPN') so that I can use that as a basis to solve the 'all traffic' issue?
I would like to be able to send all traffic through that IPsec link, for that I can enter Network 0.0.0.0/0 in Phase 2. But when I do that, the client cannot send or receive traffic from the internet at large. It only works with a partial VPN.
I have seen some information that I need to set that "send all traffic over VPN" at the macOS side as well, but the only way to do that is to create a .mobileconfig in Apple Configurator and edit that to include that setting (by hand) in the XML:
Code Select
<key>IPv4</key>
<dict>
<key>OverridePrimary</key>
<integer>1</integer>
</dict>
But maybe that no longer works.
So, as a first step, I tried recreating the manually created IKEv2 VPN on the macOS client (the one that works). But if I try that, macOS (Monterey) complains that there is a 'configuration error' and it immediately fails without trying to set up the VPN.
So, exactly the same VPN connection, one entered by hand and one entered via a profile, one works, one not. I tried a lot of other things based on internet articles, but I haven't been able to create a .mobileconfig that works and that combines a certificate for IKEv2 in combination with Xauth (username password) so that I can use FreeRADIUS on the opnsense router.
Is there anyone who has a working .mobileconfig (even without 'all traffic over VPN') so that I can use that as a basis to solve the 'all traffic' issue?
#24
General Discussion / IPsec/IKEv2/FreeRADIUS works, but can only reach local LAN
December 03, 2022, 04:30:29 AM
I have set up IKEv2 IPsec. I can connect the tunnel and I can connect to the devices on OPNsense's LAN.
WAN: my-WAN-range (5 fixed IP)
LAN: 192.168.2.2/24
IPsec net: 192.168.102.2/24
Local Net: 0.0.0.0/0 (route all traffic via VPN)
Usets: FreeRADIUS
When the laptop is connected via IKEv2 to the OPNsense IPsec service, it gets IP address 192.168.102.163 (se in FreeRADIUS)
When connected I can connect to sites on the LAN (so from 192.168.102.163 to for instance 192.168.2.86), but I cannot get to the internet at large. I cannot see any blocked stuff in the Firewall logging. It seems my packets disappear in a black hole when I try to reach some web site (like www.apple.com).
How can I find out what happens with the traffic from the Road Warrior laptop?
WAN: my-WAN-range (5 fixed IP)
LAN: 192.168.2.2/24
IPsec net: 192.168.102.2/24
Local Net: 0.0.0.0/0 (route all traffic via VPN)
Usets: FreeRADIUS
When the laptop is connected via IKEv2 to the OPNsense IPsec service, it gets IP address 192.168.102.163 (se in FreeRADIUS)
When connected I can connect to sites on the LAN (so from 192.168.102.163 to for instance 192.168.2.86), but I cannot get to the internet at large. I cannot see any blocked stuff in the Firewall logging. It seems my packets disappear in a black hole when I try to reach some web site (like www.apple.com).
How can I find out what happens with the traffic from the Road Warrior laptop?
#25
General Discussion / Problem creating working rules for this setup
December 02, 2022, 03:16:12 AM
My WAN: A.B.C.D/29 (5 fixed IP addresses)
My LAN: 192.168.2.2/24
A vlan VLANA: 192.168.3.2/24
My IPsec tunnel for Road Warriors/Mobile Clients:
I'm also still confused about direction, especially in the case of IPsec.
My LAN: 192.168.2.2/24
A vlan VLANA: 192.168.3.2/24
My IPsec tunnel for Road Warriors/Mobile Clients:
- IP Pool for the mobile client: 192.168.102.2/24
- Network in Phase 2: 0.0.0.0/0
I'm also still confused about direction, especially in the case of IPsec.
#26
Virtual private networks / SOLVED: IPsec connect from iOS works. But traffic doesn't flow
November 30, 2022, 02:19:03 PM
I am able to create an IPsec VPN from my iPhone to my OPNsense router. The IPsec log says
My LAN is 192.168.2.2/24 and the IPSec Pool is 10.0.0.0/24. I see these IPsec pass log entries on the IPsec interface, but that is the only traffic I see on the IPsec interface.
LAN Interface:
The DNS query to the internal DNS goes out, but the status is 'refused'. A query to 8.8.8.8 times out it seems.
What am I missing here? Why can't the VPN-connected device reach any system on my LAN or on the WAN?
Code Select
2022-11-30T13:51:54 Informational charon 10[IKE] <con1|19> CHILD_SA con1{4} established with SPIs cbe4c22d_i 0e09c456_o and TS 192.168.2.0/24 === 10.0.0.1/32
2022-11-30T13:51:54 Informational charon 10[ENC] <con1|19> parsed QUICK_MODE request 3990959854 [ HASH ]
2022-11-30T13:51:54 Informational charon 10[NET] <con1|19> received packet: from 188.207.79.87[17618] to 213.125.118.50[4500] (76 bytes)
My LAN is 192.168.2.2/24 and the IPSec Pool is 10.0.0.0/24. I see these IPsec pass log entries on the IPsec interface, but that is the only traffic I see on the IPsec interface.
Code Select
IPsec 2022-11-30T13:55:41 10.0.0.1:57972 192.168.2.66:53 udp
IPsec 2022-11-30T13:55:41 10.0.0.1:54646 192.168.2.66:53 udp LAN Interface:
Code Select
LAN 2022-11-30T14:03:20 10.0.0.1:62818 192.168.2.66:443 tcp let out anything from firewall host itself
LAN 2022-11-30T14:03:19 10.0.0.1:64705 192.168.2.66:53 udp let out anything from firewall host itself
LAN 2022-11-30T14:03:19 10.0.0.1:60687 192.168.2.66:53 udp let out anything from firewall host itself The DNS query to the internal DNS goes out, but the status is 'refused'. A query to 8.8.8.8 times out it seems.
Code Select
IPsec 2022-11-30T14:08:16 10.0.0.1:62819 8.8.8.8:53 tcp
What am I missing here? Why can't the VPN-connected device reach any system on my LAN or on the WAN?
#27
General Discussion / Is there a way I can actual WAN destination & port in logging?
November 30, 2022, 02:50:26 AM
If I filter logging on interface=WAN, dir=in, action=pass I want to see which ports on which IPs on my LAN are tried.
But what I see is the translated destination (so after NAT). Suppose I let port 80 and 8080 on the WAN NAT forward to an internal server, but simple on some single port (say 8081), I see where it ends up, but I cannot see what the outside world was actually trying (80 or 8080).
I would expect that the WAN-in logging is src and dest before NAT and the LAN-out logging after NAT.
But what I see is the translated destination (so after NAT). Suppose I let port 80 and 8080 on the WAN NAT forward to an internal server, but simple on some single port (say 8081), I see where it ends up, but I cannot see what the outside world was actually trying (80 or 8080).
I would expect that the WAN-in logging is src and dest before NAT and the LAN-out logging after NAT.
#28
General Discussion / Weird firewall logging entries (22.10)
November 30, 2022, 02:43:19 AM
I am looking at my newly set up OPNsense appliance, and I am wondering about some things I see. E.g.
A Mac on the local LAN gets a blocked action (LAN IN) on connecting to 17.57.146.41:5223 (some Apple push notfication port). Why? The rules say that from the LAN, everything may go out. It gets blocked by the Default deny / state violation rule. Is there a way to find out why OPNsense actually blocks it? Weirder still, at another moment it gets passed via the Default allow LAN to any rule.
I see it passing, then shortly thereafter the blocking happens for a while to the same address/port every 30secs or so (say 10 times for a total of 5 minutes
A Mac on the local LAN gets a blocked action (LAN IN) on connecting to 17.57.146.41:5223 (some Apple push notfication port). Why? The rules say that from the LAN, everything may go out. It gets blocked by the Default deny / state violation rule. Is there a way to find out why OPNsense actually blocks it? Weirder still, at another moment it gets passed via the Default allow LAN to any rule.
I see it passing, then shortly thereafter the blocking happens for a while to the same address/port every 30secs or so (say 10 times for a total of 5 minutes
#29
Virtual private networks / IPsec or IKEv2 for iOS/macOS high performance road warrior VPN?
November 29, 2022, 05:17:57 PM
Hah. After spending quite a bit of time on it, I just found out L2TP isn't supported at all in OPNsense... So, migrating the existing L2TP setup from EdgeOS (which does support L2TP) to OPNsense would never have worked. And here I was, adding PSK, accounts, and failing (basically, I'm not that much of an expert in this whole VPN business)...
So, I must (sadly) have new VPN configurations created on my family's macOS and iOS 'road warrior' devices. I cannot simply recreate their current access it on OPNsense, replace the EdgeMax with the OPNsense appliance and have them connect as they used to without them noticing anything.
Now, I don't want to install software on the clients (management nightmare for me), so I must go with what iOS/macOS offer out of the box, and that is IKEv2 or Cisco IPsec.
Which one should I use?
Additionally, in my current L2TP setup, the VPN connections get a fixed IP address inside the main LAN. So, the DHCP pool on the LAN is from 192.168.2.100-192.168.2.149, and the L2TP/IPsec pool is 192.168.2.160/27, but each account gets its own fixed IP. That enables me to fine tune what the users are allowed to do, and also in Apple Remote Desktop, the IP address stays the same all the time.
Can I replicate that on OPNsense?
So, I must (sadly) have new VPN configurations created on my family's macOS and iOS 'road warrior' devices. I cannot simply recreate their current access it on OPNsense, replace the EdgeMax with the OPNsense appliance and have them connect as they used to without them noticing anything.
Now, I don't want to install software on the clients (management nightmare for me), so I must go with what iOS/macOS offer out of the box, and that is IKEv2 or Cisco IPsec.
Which one should I use?
Additionally, in my current L2TP setup, the VPN connections get a fixed IP address inside the main LAN. So, the DHCP pool on the LAN is from 192.168.2.100-192.168.2.149, and the L2TP/IPsec pool is 192.168.2.160/27, but each account gets its own fixed IP. That enables me to fine tune what the users are allowed to do, and also in Apple Remote Desktop, the IP address stays the same all the time.
Can I replicate that on OPNsense?
#30
Virtual private networks / No luck in setting up a 'road warrior' IPsec VPN for iPhone
November 27, 2022, 06:14:26 PM
I'm migrating from EdgeMax to opnsense (DEC695).
I have a couple of iOS devices that can currently connect to the EdgeMax to create a VPN connection to my LAN. But I can't get opnsense configured so that they can keep connecting when I switch the EdgeMax for opnsense.
These are set like this on iOS:
I can get a connection from the iOS device it seems, but not completely.
IPsec debug log shows (this seems to be the problem):
In full:
I have a couple of iOS devices that can currently connect to the EdgeMax to create a VPN connection to my LAN. But I can't get opnsense configured so that they can keep connecting when I switch the EdgeMax for opnsense.
These are set like this on iOS:
- Description: whatever
- Server: the reverse-DNS-able DNS name of the fixed IP address
- Account: username
- RSA SecurID: <off>
- Password: userpassword
- Secret: PSK-key
- Send All Traffic: <on>
- Proxy: <off>
I can get a connection from the iOS device it seems, but not completely.
IPsec debug log shows (this seems to be the problem):
Code Select
2022-11-27T18:00:33 Informational charon 11[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
In full:
Code Select
2022-11-27T18:00:35 Informational charon 11[IKE] <con1|1> deleting IKE_SA con1[1] between 213.125.118.50[213.125.118.50]...77.63.95.239[0.0.0.0]
2022-11-27T18:00:35 Informational charon 11[IKE] <con1|1> received DELETE for IKE_SA con1[1]
2022-11-27T18:00:35 Informational charon 11[ENC] <con1|1> parsed INFORMATIONAL_V1 request 3005588752 [ HASH D ]
2022-11-27T18:00:35 Informational charon 11[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (108 bytes)
2022-11-27T18:00:33 Informational charon 11[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:33 Informational charon 11[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:30 Informational charon 14[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:30 Informational charon 14[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:27 Informational charon 14[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:27 Informational charon 14[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:25 Informational charon 14[IKE] <con1|1> sending keep alive to 77.63.95.239[30476]
2022-11-27T18:00:24 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:24 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:20 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:20 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:17 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:17 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:14 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:14 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:11 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:11 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:08 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:08 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:05 Informational charon 13[NET] <con1|1> sending packet: from 213.125.118.50[4500] to 77.63.95.239[30476] (92 bytes)
2022-11-27T18:00:05 Informational charon 13[ENC] <con1|1> generating INFORMATIONAL_V1 request 2505490210 [ HASH N(INVAL_ID) ]
2022-11-27T18:00:05 Informational charon 13[IKE] <con1|1> no matching CHILD_SA config found for 77.63.95.239/32[udp/61811] === 213.125.118.50/32[udp/l2f]
2022-11-27T18:00:05 Informational charon 13[ENC] <con1|1> parsed QUICK_MODE request 112451562 [ HASH SA No ID ID NAT-OA NAT-OA ]
2022-11-27T18:00:05 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:04 Informational charon 14[NET] <con1|1> sending packet: from 213.125.118.50[4500] to 77.63.95.239[30476] (92 bytes)
2022-11-27T18:00:04 Informational charon 14[ENC] <con1|1> generating ID_PROT response 0 [ ID HASH ]
2022-11-27T18:00:04 Informational charon 14[IKE] <con1|1> maximum IKE_SA lifetime 28465s
2022-11-27T18:00:04 Informational charon 14[IKE] <con1|1> scheduling reauthentication in 27925s
2022-11-27T18:00:04 Informational charon 14[IKE] <con1|1> IKE_SA con1[1] established between 213.125.118.50[213.125.118.50]...77.63.95.239[0.0.0.0]
2022-11-27T18:00:04 Informational charon 14[CFG] <1> selected peer config "con1"
2022-11-27T18:00:04 Informational charon 14[CFG] <1> looking for pre-shared key peer configs matching 213.125.118.50...77.63.95.239[0.0.0.0]
2022-11-27T18:00:04 Informational charon 14[ENC] <1> parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
2022-11-27T18:00:04 Informational charon 14[NET] <1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (108 bytes)
2022-11-27T18:00:04 Informational charon 14[NET] <1> sending packet: from 213.125.118.50[500] to 77.63.95.239[30475] (396 bytes)
2022-11-27T18:00:04 Informational charon 14[ENC] <1> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
2022-11-27T18:00:04 Informational charon 14[IKE] <1> remote host is behind NAT
2022-11-27T18:00:04 Informational charon 14[IKE] <1> local host is behind NAT, sending keep alives
2022-11-27T18:00:04 Informational charon 14[ENC] <1> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
2022-11-27T18:00:04 Informational charon 14[NET] <1> received packet: from 77.63.95.239[30475] to 213.125.118.50[500] (380 bytes)
2022-11-27T18:00:04 Informational charon 14[NET] <1> sending packet: from 213.125.118.50[500] to 77.63.95.239[30475] (160 bytes)
2022-11-27T18:00:04 Informational charon 14[ENC] <1> generating ID_PROT response 0 [ SA V V V V ]
2022-11-27T18:00:04 Informational charon 14[CFG] <1> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
2022-11-27T18:00:04 Informational charon 14[IKE] <1> 77.63.95.239 is initiating a Main Mode IKE_SA
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received DPD vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received FRAGMENTATION vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-04 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-05 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-06 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-07 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-08 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received NAT-T (RFC 3947) vendor ID
2022-11-27T18:00:04 Informational charon 14[ENC] <1> parsed ID_PROT request 0 [ SA V V V V V V V V V V V V ]
2022-11-27T18:00:04 Informational charon 14[NET] <1> received packet: from 77.63.95.239[30475] to 213.125.118.50[500] (788 bytes)
2022-11-27T17:58:05 Informational charon 01[CFG] added configuration 'con1'
2022-11-27T17:58:05 Informational charon 01[CFG] adding virtual IP address pool 192.168.2.160/27
2022-11-27T17:58:05 Informational charon 01[CFG] received stroke: add connection 'con1'
2022-11-27T17:58:05 Informational charon 00[JOB] spawning 16 worker threads
2022-11-27T17:58:05 Informational charon 00[LIB] loaded plugins: charon aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs12 pgp dnskey sshkey pem openssl pkcs8 fips-prf curve25519 xcbc cmac hmac kdf gcm drbg attr kernel-pfkey kernel-pfroute resolve socket-default stroke vici updown eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam whitelist addrblock counters
2022-11-27T17:58:05 Informational charon 00[CFG] loaded 0 RADIUS server configurations
2022-11-27T17:58:05 Informational charon 00[CFG] expanding file expression '/usr/local/etc/ipsec.secrets.opnsense.d/*.secrets' failed
2022-11-27T17:58:05 Informational charon 00[CFG] loaded IKE secret for %any
2022-11-27T17:58:05 Informational charon 00[CFG] loaded IKE secret for gerbeniphone
2022-11-27T17:58:05 Informational charon 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'
2022-11-27T17:58:05 Informational charon 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'
2022-11-27T17:58:05 Informational charon 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'
2022-11-27T17:58:05 Informational charon 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'
2022-11-27T17:58:05 Informational charon 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'
2022-11-27T17:58:05 Informational charon 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'
2022-11-27T17:58:05 Informational charon 00[NET] enabling UDP decapsulation for IPv6 on port 4500 failed
2022-11-27T17:58:05 Informational charon 00[KNL] unable to set UDP_ENCAP: Invalid argument
2022-11-27T17:58:05 Informational charon 00[DMN] Starting IKE charon daemon (strongSwan 5.9.8, FreeBSD 13.1-RELEASE-p2, amd64)
2022-11-27T17:58:01 Informational charon 00[DMN] SIGINT received, shutting down #31
General Discussion / Can I create a VLAN with its own 192.168.x.x/24 range and DHCP?
November 27, 2022, 05:26:30 PM
I'm new to opnsense and I'm migrating from EdgeMax/EdgeOS.
My Wifi network has a couple of SSIDs, each of which are coupled to a classic VLAN. On the EdgeMax, I've created a solution where a VLAN 99 is given its own 192.168.3.x network (my main LAN is 192.168.2.x), and the EdgeMax router only allows 192.168.3.x to send traffic outside. The devices on the 192.168.3.x network have their own DHCP setup.
Can I recreate this on opnsense?
My Wifi network has a couple of SSIDs, each of which are coupled to a classic VLAN. On the EdgeMax, I've created a solution where a VLAN 99 is given its own 192.168.3.x network (my main LAN is 192.168.2.x), and the EdgeMax router only allows 192.168.3.x to send traffic outside. The devices on the 192.168.3.x network have their own DHCP setup.
Can I recreate this on opnsense?
#32
General Discussion / SOLVED: How should I configure 5 fixed IP addresses on my WAN?
November 27, 2022, 12:04:20 AM
I'm trying to get OPNsense working (new DEC695 device). I'm currently in the situation that when I connect it to my IP's modem, it is able to update itself (so router-WAN works) and I am able to configure it (so LAN-router works). What doesn't work is simple stuff like doing an DNS query from the LAN to 8.8.8.8 and get a result back. I've turned all the logging on I could find, so far without luck. I see a log entry that allows the traffic to go to 8.8.8.8, but an answer is never received and no log message gives me a clue what is wrong. It is now the perfect firewall, nothing goes through.
One thing I had to guess a but because the documentation doesn't have this explicitly was the configuration of my WAN interface. I have the following IP-range: a.b.c.48/29, a.b.c.49 is the provider's modem, I can use a.b.c.50-54, and a.b.c.55 is the broadcast address.
My LAN is a 192.168.x.x. range. I have already configured a few outgoing NAT rules (set to do source NAT manually, like I do with my old EdgeMax router that this machine has to replace).
I have configured my WAN as a.b.c.50/29 with a.b.c.49 as the gateway, and set up 4 IP aliases for a.b.c.51-54. Is that the correct way to do it? Is there an example somewhere of setting up OPNsense with a range of fixed IP addresses? Anything else I might easily have gotten wrong or a way to find out what is wrong?
One thing I had to guess a but because the documentation doesn't have this explicitly was the configuration of my WAN interface. I have the following IP-range: a.b.c.48/29, a.b.c.49 is the provider's modem, I can use a.b.c.50-54, and a.b.c.55 is the broadcast address.
My LAN is a 192.168.x.x. range. I have already configured a few outgoing NAT rules (set to do source NAT manually, like I do with my old EdgeMax router that this machine has to replace).
I have configured my WAN as a.b.c.50/29 with a.b.c.49 as the gateway, and set up 4 IP aliases for a.b.c.51-54. Is that the correct way to do it? Is there an example somewhere of setting up OPNsense with a range of fixed IP addresses? Anything else I might easily have gotten wrong or a way to find out what is wrong?
#33
Tutorials and FAQs / SOLVED: Giving each mobile VPN device its own LAN IP
November 26, 2022, 02:28:03 PM
I am migrating from EdgeMax/EdgeOS to OPNSense (so, newbie at OPNsense).
In my EdgeOS setup I have an IPsec/L2TP setup for a couple of devices (macOS) that can connect to my LAN. The EdgeOS setup has an IP pool (which is outside the LAN DHCP pool), and I can set a static IP address for each user inside that pool as well. Each user has their own password and they share the secret key.
This way, these individual VPN connections each get an internal static IP in my LAN when they connect their VPN. This enables me to have very specific firewall rules for each user (device).
Given that the users are non-technical and at a large distance, I need to move them over to OPNsense as is, before I can build a better setup that I then can remotely configure for them on their macOS device.
So, I want to recreate that setup, but after reading the documentation and searching I haven't found a way to do that. Is it possible? It seems like a standard L2TP/IPsec setup, but the documentation seems not to handle it.
In my EdgeOS setup I have an IPsec/L2TP setup for a couple of devices (macOS) that can connect to my LAN. The EdgeOS setup has an IP pool (which is outside the LAN DHCP pool), and I can set a static IP address for each user inside that pool as well. Each user has their own password and they share the secret key.
This way, these individual VPN connections each get an internal static IP in my LAN when they connect their VPN. This enables me to have very specific firewall rules for each user (device).
Given that the users are non-technical and at a large distance, I need to move them over to OPNsense as is, before I can build a better setup that I then can remotely configure for them on their macOS device.
So, I want to recreate that setup, but after reading the documentation and searching I haven't found a way to do that. Is it possible? It seems like a standard L2TP/IPsec setup, but the documentation seems not to handle it.
#34
Tutorials and FAQs / SOLVED: How do I create a source NAT for a specific internal server?
November 26, 2022, 12:50:53 PM
I am migrating from EdgeOS (EdgeMax) to OPNsense. I don't understand the OPNsense UI/documentation on Source NAT.
In EdgeOS I have a simple rule that says:
I have to recreate this on OPNsense, e.g. because the internal MTA must be outside DNS-correct when it connects to an MTA somewhere on the internet. When I edit an outbound NAT rule, I want to enter 192.168.x.x in some way in Source address, but I can't.
How do I create an outgoing NAT rule for a specific internal server (and destination port) and source-NAT it to a specific WAN IP address?
In EdgeOS I have a simple rule that says:
- for inside source LAN address 192.168.x.x
- for destination port 25
- translate on WAN to IP one of my 5 fixed IP addresses
I have to recreate this on OPNsense, e.g. because the internal MTA must be outside DNS-correct when it connects to an MTA somewhere on the internet. When I edit an outbound NAT rule, I want to enter 192.168.x.x in some way in Source address, but I can't.
How do I create an outgoing NAT rule for a specific internal server (and destination port) and source-NAT it to a specific WAN IP address?
#35
Intrusion Detection and Prevention / Newbie question: 'in' on WAN versus 'out' on LAN for IDS?
November 25, 2022, 06:43:34 PM
I am trying to understand the IDS/IPS concept in more detail (I only have a basic idea, not specific, but I'm now going to turn this on at some point). I am using NAT.
As far as I understand it, in / out is defined per interface. So, traffic from the internet to an internal machine is 'in' on the WAN interface and 'out' on the LAN interface. Am I correct?
So, if I want to detect for instance compromised internal systems on the LAN, I would need 'in' rules on the LAN interface. Correct? I could also use 'out' on the WAN interface, but then I lose whatever I know about which internal system is compromised because of NAT. Correct?
And if I want to detect incoming bad stuff, I need to detect it in the 'in' traffic on the WAN interface. Or I can detect it on the 'out' traffic on the LAN. Is there a difference (it seems to me that NAT is not a real problem, but I might be missing something here)?
Is there some tutorial what to do to get a basic IDS running? Like, a standard recipe of which ruleset to apply on which interface?
As far as I understand it, in / out is defined per interface. So, traffic from the internet to an internal machine is 'in' on the WAN interface and 'out' on the LAN interface. Am I correct?
So, if I want to detect for instance compromised internal systems on the LAN, I would need 'in' rules on the LAN interface. Correct? I could also use 'out' on the WAN interface, but then I lose whatever I know about which internal system is compromised because of NAT. Correct?
And if I want to detect incoming bad stuff, I need to detect it in the 'in' traffic on the WAN interface. Or I can detect it on the 'out' traffic on the LAN. Is there a difference (it seems to me that NAT is not a real problem, but I might be missing something here)?
Is there some tutorial what to do to get a basic IDS running? Like, a standard recipe of which ruleset to apply on which interface?
#36
Tutorials and FAQs / Basic question about port aliases
November 25, 2022, 01:55:22 PM
Opnsense newbie here (coming from EdgeOS)
Suppose I create a single port alias for both ports 25 and 587 (smtp server). Kan I simplify my rules by using this in both destination port and redirect target port?
I doubt this would work because
Suppose I create a single port alias for both ports 25 and 587 (smtp server). Kan I simplify my rules by using this in both destination port and redirect target port?
I doubt this would work because
- a destination port range from 25,587 to 25,587 is weird
- a redirect target port range of 25,587 looks ambiguous
