Messages

Short answer: no.

Longer answer: each interface needs its own network - a so called "broadcast domain" or "prefix".

Lan1 - 192.168.1.x
Lan2 - 192.168.2.x
Lan3 - 192.168.3.x

HTH
Patrick

Is it possible to access the same opnsense gui by both 192.168.1.x and by 192.168.3.x ?

For example I already access by Lan1 192.168.1.x (as set in the setup wizard)
But I also want to access by plugging into physical interface 3 aka Lan3 and I can use https://192.168.3.1 (or https://192.168.1.1) to access the same guy?

[insists on using an external DNS server for some reason]

The DHCP server tells all clients to use the resolver running on OPNsense by default. In case some misconfigured/misbehaving client does not use DHCP or insists on using an external DNS server for some reason, the redirect rule will send these rogue requests to OPNsense instead. So they can be properly put through blocklists, logged, whatever ...

Great got it thanks!!

But if I allow clients to set their own DNS (such as in their device's network settings), or a different DNS set in the interface's DHCP, then I wouldn't want this... to catch & redirect all DNS requests... right..?

(Or perhaps if you do not check "quick" client's own/DHCP DNS settings will still go through first, and the rest will be caught by this?)

The DNS redirect to OPNsense is optional.

Thanks. Why do people put the Firewall rules DNS redirect to OPNsense if it is already handled by OPNsense by default? Sorry a knowledge gap is missing and I have been doing a lot of reading.

...rule created according to step 9 is NOT quick...

okay, thanks for the tip. I have read the OPNsense documentation and a few articles and videos on this to understand... so I just want to make sure I understand correctly..

So the non-quick rules are processed last. Therefore now FLOATING rules have the effect of being processed last?

Therefore, is this amended graphic about right?

Based on the thread, it appears that Unbound cannot use the wireguard gateway since there is no IP address in the wireguard interface. As a result, some outbound queries use the wireguard address as the source (root domains as the target) but are routed through the WAN interface using the default route. The rule in step 9 forces these packets to be routed through the wireguard gateway.

Is the description above correct?

In my VPN's setup documentation, to prevent DNS leaks:

1. Go to Services: Unbound: General

2. Scroll to Outgoing Network Interfaces and select the VPN Interface (e.g. OPENVPN_Gateway). Please note that this setting is very important as it prevents DNS leaks.

3. You must disable DNSSEC support (optional based on suggestion from your VPN provider)

4. Save & Apply

So now all DNS requests from interfaces checked in  Services: Unbound: General > Network Interfaces, will be routed through the VPN.

So, I think it covers that case (?) probably?
(But without the steps above, I would therefore assume that one would need rule 9 as well.)

[If unbound is now the DNS resolver in 23.1, do Firewall rules need to be made, or are they already made by OPnsense by default?A lot of the guides I am reading adds firewall rules to redirect dns requests to internal DNS (127.0.0.1) but I gather this was before the Unbound was the default resolver?]

If unbound is now the DNS resolver in 23.1, do Firewall rules need to be made, or are they already made by OPnsense by default?

A lot of the guides I am reading adds firewall rules to redirect dns requests to internal DNS (127.0.0.1) but I gather this was before the Unbound was the default resolver?

Also, is this the correct way to think about the DNS processing order/hierarchy in OPNsense?
The most overriding one being on the left hand side.



If not, what changes should be made?

[But it's a floating rule...]

Okay, I'm still a bit confused. does this rule cover requests for the local network at all? I think it doesn't because of the rule in step #8 right —
Action: Pass
Quick: Checked
Interface: Whatever interface you are configuring the rule on
Direction: in
TCP/IP Version: IPv4
Protoco: any
Source / Invert: Unchecked
Source: Select the relevant hosts Alias you created above in the dropdown (eg WG_VPN_Hosts )
Destination / Invert: Checked
Destination: Select the RFC1918_Networks Alias you created above in the dropdown
Destination port range: any
Description: Add one if you wish to
Gateway: Select the gateway you created above (eg WAN_VPNProviderName )


But it's a floating rule... so it's processed before the rule above. So does that mean it prevents any clients from accessing the local network?

And also doesn't the rule above (in Step #8) also cover services like Unbound etc, running on the machine because Gateway is specified already.

thank you so much

Did you follow the doc closely and also select the gateway in your regular Firewall rules?
if you follow the doc exactly honestly you should be golden.

Part A: I would like 2 VLANs (VLAN 1 & VLAN 2) to use OPNsense's own Unbound. VLAN 1&2 are using a VPN gateway. 
Part B: I would like 2 other non-VPN VLANs (VLAN 3 & VLAN 4) to use another external DNS, for example, Cloudflare. Or whatever is set on the client's device.

I would also like optionally in both Part A & B if any of the clients set its own DNS on their device, for that external DNS to be honoured. If it is not possible in Part A, then definitely in Part B.

Can anyone point me in the right direction to do this?

[uncheck]

Sorry couldn't google foo find an answer anywhere...

For OpenVPN & Wireguard, what if the connection fails or stops (for any reason), is there any auto reconnect feature in OPNsense?

Is it possible to create a monit script that is called when pings fail, that will restart the VPN connections?

Btw, I have in System: Gateways: Single, in each interface:
- Disable Gateway Monitoring -- uncheck

So what is this rule saying exactly?

Anything that is from the Wireguard address that is not going to the Wireguard network should be routed through the Wireguard gateway?

Doesn't seem to make sense...

[ticked]

OH MY GOSH the craziness. I sort of found a half answer.

anyway if this helps anyone out...

For the VLAN30 which I wanted to have its own DNS

I had to:
In System: Settings: General
- has no DNS server set, all the dns servers fields are blank.
- 'Do not use the local DNS service as a nameserver for this system' is ticked.

In DHCPv4: VLAN30: I manually put in the DNS I wanted.

So it's DNS related. But not working.

from this post

However, the other VLAN20 DNS still struggling. It has no manual DNS set (I want it to use Unbound DNS)
And none of the other VLANs seem to use Unbound either.

Follow this guide exactly.

https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html

And instead of the phrase "WG_VPN_Hosts" just replace it with VLAN2.
So when you create the FW alias, instead create a Network and type in 192.168.2.1/24 or your VLAN2
So therefore Anywhere that it says "WG_VPN_Hosts", that is just your VLAN2 network.

I think that's what you're asking...

[still]

I have 2 VLANs routed through Wireguard & OpenVPN connection to a VPN provider. But now all other non-VPN VLANs now don't have internet access anymore. I want internet access.

I've basically followed the Wireguard Selective routing Guide to T!

Confusing! I don't think in the firewall rules for each non-VPN VLAN, I need to specify the WAN gateway do I? Well, I've done it anyway, and even for the non-VPN VLANs, there is *still* no internet access.

Sorry I'm new here, I don't know if people post configs or whatever. This is what I've done so far.

I have:
- Created a FW rule in the FW Group with VLAN_20 + VLAN_30 called FGVPN_VLANS. These are to be routed through the VPN
- Created a Gateway Group called GG_VPN_Gateways with WRGD as Tier 1, OVPM as Tier 2

- Created a FW rule in the FW Group that is:
Interface: FGVPN_VLANS
direction: in
Source: FGVPN_VLANS
Destination invert: checked
Destination: RFC1918_Networks
Gateway: GG_VPN_Gateways
Tag: NO_WAN_EGRESS

- Created NAT Outbound rule:
Interface: GGVPN_Gateway
TCP/IP: IPv4
Protocol: any
Source: FGVPN_VLANs net
Destination: any


- DNS
Settings: General no DNS listed (so it's blank)

- Fixed DNS leaks
In Services → DNS Resolver
Network Interfaces Interfaces: LAN, VLAN_20,  VLAN_30
Outgoing Network Interfaces: OVPN, WRGD (both checked)

Is there something I need to do or check?