Messages

I expect nat reflection is enabled (Firewall: Settings: Advanced) in which case https://github.com/opnsense/core/commit/25b2716325951a7cbd93bc42ca21179f46519c10 is likely the culrpit.

To install use the following:

Code Select Expand

opnsense-patch 25b2716325


We currently don't offer the option indeed (https://github.com/search?q=repo%3Aopnsense%2Fcore%20tls-crypt-v2&type=code)

Best check which process is busy first, from the (ssh) console, you can use the following command:

Code Select Expand

ps -axfu


https://docs.opnsense.org/troubleshooting/hardening.html#spectre-and-meltdown ?

You can not, but as far as I can find the documentation also doesn't suggest you can.

Hi,

You can nest aliases and exclude addresses in the inherited alias, see https://docs.opnsense.org/manual/aliases.html#nesting (and the FireHOL_with_exclusions example)

Best regards,

Ad

Hi Steve,

If I'm not mistaken, the disable serial console option is not available in the menu.
When you are able to reach the bios, make sure to check these settings https://docs.opnsense.org/hardware/serial_connectivity.html#legacy-uart-vs-uefi-serial , older OPNsense versions handled eif differently.


Best regards,

Ad

best check from the gui, if it doesn't crash there, it's in.

It looks like we missed a spot there, the delete action wasn't implemented. Just added it in https://github.com/opnsense/core/commit/59b4defd5b8de19f886d57ef55d0a3a05f048ec9

Best regards,

Ad

Hi Patrick,

The DEC[2]6XX range uses a bios indeed and no efi payload, it doesn't require changes for serial console access.

On older versions (or older settings), the shutdown backup+restore hook made upgrades hang or take an awful long time, but I think I already mentioned that.

When using functionality like Network Insight with a bit larger databases, you likely don't want to enable the tarbals being created on shutdown and reimported on startup. You can check your settings in "System: Settings: Miscellaneous".

Best regards,

Ad

Hi Patrick,

Sorry to hear you're having issues, but given the time frame (21.7 and 24.7) it's difficult to predict which type of issues you might run into.

One of the things that might explain the weird efi behavior is an earlier change in FreeBSD which required a setting in the bios, which is documented here https://docs.opnsense.org/hardware/serial_connectivity.html#legacy-uart-vs-uefi-serial

One other topic that previously was problematic in older versions was the automatic restore of items as Network Insights, which sometimes didn't complete at all or just took so long that people expected the box to have died in between. A reboot fixes this, but is annoying.


Best regards,

Ad

klopt, het is een "master/detail" view

Als het goed is zouden de locations zichtbaar moeten zijn voor de gateway die bovenin geselecteerd is, mij zijn geen problemen bekend.

In het geval je de configuratie handmatig wil controleren, kan je altijd even de config dowloaden (via System: Configuration: Backups) en in het xml bestand zoeken naar `<Apache`.

Mocht het niet functioneren, laat dan even weten welk versie nummer van OPNsense je gebruikt en deel wellicht even een paar screenshots van het gateway scherm.

Mvg,

Ad

As stated on the top of this thread, next week. (https://forum.opnsense.org/index.php?topic=41342.msg202804#msg202804)

And yes, we are taking it serious, FreeBSD's patch is a precaution, which is obviously fine, but FreeBSD doesn't use glibc and OPNsense is also not available on 32bit systems.

Best regards,

Ad

Hi Patrick,

This will be addressed next week from our end.
Looking briefly at the report https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt?ref=upstract.com, at a first glance exploitation on amd64 seems to be rather difficult (and time consuming) by the way.

Best regards,

Ad