Recent posts

#1

26.7 Series / Re: Deny or Isolate any and al...

Last post by Patrick M. Hausen - Today at 05:53:29 PM

Also, it does not even work over different APs, only for devices connected to the same AP.

Or a bunch of Mikrotik APs managed by the same CAPsMAN with traffic processing on-capsman instead of on-cap. That feature turns them into a single AP, essentially. I have finally got it to work and I can show you on Friday. I run on-cap, though, i.e. traffic is processed on each managed AP.

#2

26.7 Series / Re: Deny or Isolate any and al...

Last post by meyergru - Today at 05:04:11 PM

Having done 802.1x for ~200.000 clients in an enterprise environment, I think the real benefits are unachievable in a private environment:

You need RADIUS-capable switching equipment for that (implemented correctly, unlike with some Unifi switches in the recent past) and also, MAC-based 802.1x can certainly be circumvented. Some client devices do not even work with that.

On the other hand, "secure" certificate-based 802.1x is hard to handle and you need client OS support, which many IoT devices essentially lack.

The situation is a little better for WiFi, since it has inherent access limiting capabilities.

But @Patrick: device isolation is useless in many contexts, IMHO: think of media sharing and broadcast-based traffic. I just had a Miele hib not contacting its extractor hood because of client isolation. Also, it does not even work over different APs, only for devices connected to the same AP.

#3

26.7 Series / Re: Gateways for OPNsense box ...

Last post by netotter - Today at 05:02:00 PM

Does not seem a big issue if no one else is facing this. Must be something with my setup then I guess. Any ideas where to start digging?

#4

26.7 Series / Re: Deny or Isolate any and al...

Last post by Patrick M. Hausen - Today at 04:44:33 PM

you need client support

Not for VMPS. That's the good part. It "simply" does dynamic MAC address <> VLAN mapping.

802.1x is a different matter, correct.

#5

26.7 Series / Re: Router Dead After Latest U...

Last post by (MARLOO) - Today at 04:21:43 PM

Reinstalled yesterday. Ran the update. Everything worked fine. I ran the update on a backup server. Everything worked fine. The only detail that might be of any use is the last thing that appeared before the crash was the refresh.sh script. That's where the system appeared to hang and never came back. I even waited about ten minutes thinking that something complicated might be going on.

Things appear to be back to normal.

In my case the update itself completed normally and the system ran fine afterwards. The problem appeared later: a brief LAN link loss, followed by a scheduled reboot that hung with very high CPU usage. After a manual power cycle it booted normally, and a manual GUI reboot also completed successfully.

#6

26.7 Series / Re: Deny or Isolate any and al...

Last post by pfry - Today at 04:15:39 PM

VMPS - very Cisco specific 😉[...]

Some of my switches offer some similar functionality via 802.1x (with RADIUS), but implementations differ, you need client support, and topology choices are limited.

#7

26.7 Series / Re: missing wireguard automati...

Last post by HIT - Today at 04:15:21 PM

I have the same problem. On a freshly installed OPNSense 26.7, the automatic route isn't set either.
If you try to set it manually via the GUI, the following message appears in the log (even though the "Tunnel address" field isn't empty):

ROUTING: refusing to set interface route on addressless opt1(wg0)

My workaround so far is the following command via the shell:

route add -net 192.168.1.0/24 -interface wg0

But this only lasts until the next service or firewall restart.
Even an update to version 26.7.7 didn't fix the problem.

Maybe this information will be helpful.

#8

26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...

Last post by (MARLOO) - Today at 04:08:39 PM

IMHO your first post could be easily added to the OPNsense Documentation or perhaps you could put it online somewhere like GitHUB ?
It would be easy to point people to when they ask what to use or maybe still need to migrate from ISC to one of them!

Thanks for the suggestion. I have created a post and added it to the FAQs.

It is only intended as a concise summary of the main practical differences between Dnsmasq and Kea, not as a complete guide. I hope it can be useful as a quick reference.

https://forum.opnsense.org/index.php?topic=53150.0

I am not sure why, but I like the first post in this topic more than that topic :D

Anyway...

Just noticed you always mention this about DNSmasq :

dynamically register DHCP client hostnames in Unbound.

But it's actually registered in DNSmasq's own DNS and you can tell Unbound to look up records for specific domains there : https://docs.opnsense.org/manual/dnsmasq.html#dhcpv4-with-dns-registration

DNSmasq can als run in HA Mode but with some disadvantages : https://docs.opnsense.org/manual/dnsmasq.html#dhcpv4-for-small-ha-setups

And to be honest...
This : https://docs.opnsense.org/manual/dnsmasq.html#dnsmasq-as-primary-dns-resolver
Would always be my preferred setup for DNSmasq and Unbound because it simply makes more sense to me :)

You are right: Dnsmasq registers DHCP client hostnames in its own DNS, and Unbound can be configured to forward/look up those specific local domains there. I will correct that wording in the FAQ.

Also fair point on HA: Dnsmasq can do it using split pools and DHCP reply delay, but it has no lease synchronization, requires non-overlapping pools, and is mainly intended for small/medium setups without fast failover requirements.

Kea remains preferable for larger or more demanding DHCP HA deployments.

Thanks for the feedback

#9

26.7 Series / Re: Router Dead After Latest U...

Last post by pholt - Today at 03:58:52 PM

Reinstalled yesterday. Ran the update. Everything worked fine. I ran the update on a backup server. Everything worked fine. The only detail that might be of any use is the last thing that appeared before the crash was the refresh.sh script. That's where the system appeared to hang and never came back. I even waited about ten minutes thinking that something complicated might be going on.

Things appear to be back to normal.

#10

26.7 Series / Re: Deny or Isolate any and al...

Last post by Patrick M. Hausen - Today at 03:53:39 PM

Sounds like a job for RADIUS but ALL of your networking equipment needs to support it :)

VMPS - very Cisco specific 😉

And yes, FreeRADIUS has got a backend for that.