"Recent posts
#1
26.7 Series / Re: OpenVPN CLient Export fail...
Last post by NeoV00 - Today at 04:46:59 PMAre you trying to export the server certificate for the client config? We hit the same thing on several firewalls – that stopped working with 26.7 (still fine in 26.1). You'll need to issue a separate client certificate from the same CA and use that in the Client Export.
#2
26.1, 26,4 Series / ACME Letsencrypt certificate i...
Last post by TimmiORG - Today at 04:34:26 PMHi all,
I'm actually not sure if this is expected hence the question here:
I have created a new Letsencrypt certificate with the key-length ec-384. Before I always used RSA-4096.
The older certificates have been listed with the type "Server Certificate". The new one is listed as "Client Certificate".
Hope the picture will help to understand my point.
Let me know if you need more information. Also happy to file a ticket on github if wanted.
Best regards
Tmmmi
I'm actually not sure if this is expected hence the question here:
I have created a new Letsencrypt certificate with the key-length ec-384. Before I always used RSA-4096.
The older certificates have been listed with the type "Server Certificate". The new one is listed as "Client Certificate".
Hope the picture will help to understand my point.
Let me know if you need more information. Also happy to file a ticket on github if wanted.
Best regards
Tmmmi
#3
26.1, 26,4 Series / Re: With IPv6, how to get both...
Last post by funtowne - Today at 01:41:11 PM@espenu - I think I have found a close enough solution after a bit of trial and error. I wanted a similar home setup with stable v6 and v4 addressing so win win! I use unbound for resolution and forward local network DNS queries to DNSMASQ. Here's the basic steps:
I'll use fd00::/64 as my sample range for this example, sub in your Prefixes as you see fit
1.) Set a ULA Virtual IP with a /64 on the interface(s) where you want ULA stable addressing. Reboot so that the IPs are correctly applied. I ran into an issue where rebooting was the only way to get this to apply correctly.
2.) Set RADVD to "assisted", configure other options as you see fit; set router advertisement prio to "high" in radvd
3.) In DNSMASQ set up a DHCP range for your interface(s) as shown below.
Interface: Your interface for the ULA assignment (eg: where the virtual IP is set).
Start Address: Set the ULA Prefix + Start address of your desired range (ex: fd00::1000)
End Address: Set the ULA Prefix + End address of your desired range (ex: fd00::2000)
Constructor: None
Prefix Length: 64
RA Mode: ra-names
RA Prio: Normal
4.) Reboot your clients to force soliciting new addresses if needed.
Set the rest of the settings for the lease time etc. as needed for your environment. The net result is as follows:
1.) My clients receive only SLAAC GUAs. The prefix assigned by my ISP is in practice not stable, thus DHCPv6 is not a great client option for the GUA. I also prefer radvd for announcements as it also sends a shutdown, deprecate and remove route announcement if a prefix changes. The shutdown, deprecate announcement and remove route options are configurable in the advanced settings.
2.) My clients also receive a SLAAC ULA and, if client is able, a DHCPv6 ULA.
3.) Local name resolution for IPv6 will only return ULAs. A lookup of a local client will return either the SLAAC IP, the DHCPv6 IP, or both.
Note: Enabling both SLAAC and DHCPv6 addresses for the ULA range covers all bases for clients' quirks to get at least one ULA address registered in DNS. For example, Apple devices prefer a "secure" SLAAC-generated IP which cannot be registered via ra-names, but the DHCPv6 address is registered since that is assigned by DNSMASQ. Some of my containers and other clients etc. are only SLAAC and will probably stay that way, therefore SLAAC addresses are registered in DNS for these clients and able to be resolved.
I'll use fd00::/64 as my sample range for this example, sub in your Prefixes as you see fit
1.) Set a ULA Virtual IP with a /64 on the interface(s) where you want ULA stable addressing. Reboot so that the IPs are correctly applied. I ran into an issue where rebooting was the only way to get this to apply correctly.
2.) Set RADVD to "assisted", configure other options as you see fit; set router advertisement prio to "high" in radvd
3.) In DNSMASQ set up a DHCP range for your interface(s) as shown below.
Interface: Your interface for the ULA assignment (eg: where the virtual IP is set).
Start Address: Set the ULA Prefix + Start address of your desired range (ex: fd00::1000)
End Address: Set the ULA Prefix + End address of your desired range (ex: fd00::2000)
Constructor: None
Prefix Length: 64
RA Mode: ra-names
RA Prio: Normal
4.) Reboot your clients to force soliciting new addresses if needed.
Set the rest of the settings for the lease time etc. as needed for your environment. The net result is as follows:
1.) My clients receive only SLAAC GUAs. The prefix assigned by my ISP is in practice not stable, thus DHCPv6 is not a great client option for the GUA. I also prefer radvd for announcements as it also sends a shutdown, deprecate and remove route announcement if a prefix changes. The shutdown, deprecate announcement and remove route options are configurable in the advanced settings.
2.) My clients also receive a SLAAC ULA and, if client is able, a DHCPv6 ULA.
3.) Local name resolution for IPv6 will only return ULAs. A lookup of a local client will return either the SLAAC IP, the DHCPv6 IP, or both.
Note: Enabling both SLAAC and DHCPv6 addresses for the ULA range covers all bases for clients' quirks to get at least one ULA address registered in DNS. For example, Apple devices prefer a "secure" SLAAC-generated IP which cannot be registered via ra-names, but the DHCPv6 address is registered since that is assigned by DNSMASQ. Some of my containers and other clients etc. are only SLAAC and will probably stay that way, therefore SLAAC addresses are registered in DNS for these clients and able to be resolved.
#4
26.7 Series / Re: WAN IP and the gateway IP ...
Last post by mr_mcbride - Today at 12:51:30 PMQuote from: dseven on August 10, 2026, 06:09:16 PMYes - the gateway is an upstream router that is your next hop to "the internet", presumably belonging to your ISP.
Thank you.
#5
Intrusion Detection and Prevention / Add a local repository server ...
Last post by rob9999 - Today at 12:22:05 PMHello all,
is it possible to add my own local repository server with downloaded rule sets, for example et open to suricata ? Can´t find an option in the gui to add my url?
Thank you.
is it possible to add my own local repository server with downloaded rule sets, for example et open to suricata ? Can´t find an option in the gui to add my url?
Thank you.
#6
26.7 Series / Re: Upgrade 26.1 -> 26.7 faile...
Last post by franco - Today at 12:18:08 PM> Surprised this wasn't handled automatically.
Are we seriously still doing this?
Are we seriously still doing this?
#7
German - Deutsch / Re: Hagezi DNS Listen & GitHub
Last post by Patrick M. Hausen - Today at 12:10:54 PMDanke!
#8
26.7 Series / Re: OpenVPN CLient Export fail...
Last post by SchengFui - Today at 12:09:25 PMi'm pretty sure i do it right, because of the fact that choosing the right ca (and not leave it selfsigned) autofills most of the lines under general. i noticed that every time i created a new cert.
i'll ivestigate further. i have both (the working and non-working) installations as VMs.
i'll ivestigate further. i have both (the working and non-working) installations as VMs.
#9
26.7 Series / Re: OpenVPN CLient Export fail...
Last post by Monviech (Cedrik) - Today at 11:43:24 AMI just created a new CA + a server and client certificate and I could export the client.
Maybe something you are doing is wrong, post exact instructions (step by step) how to reproduce your issue.
I think you might be accidentally missing the issuer in the server or client certificate and its accidentally on "self-signed" instead of the previously created CA.
Maybe something you are doing is wrong, post exact instructions (step by step) how to reproduce your issue.
I think you might be accidentally missing the issuer in the server or client certificate and its accidentally on "self-signed" instead of the previously created CA.
#10
26.7 Series / Re: OpenVPN CLient Export fail...
Last post by SchengFui - Today at 11:19:41 AMfor testing purposes i created an new ca, created a server and a client cert from this ca and the error occured when trying to export...
maybe i'll investigate further when i find some time, but to be honest i'm not familiar with openssl...
maybe i'll investigate further when i find some time, but to be honest i'm not familiar with openssl...
