"Recent posts
#1
Zenarmor (Sensei) / Upgraded to newer version of Z...
Last post by kwo1 - Today at 06:55:16 PMHi,
Since December of last year, I've been troubleshooting what I originally thought was an OPNsense upgrade issue, but I have now instead determined to be a Zen Armor-specific upgrade issue.
My current OPNsense setup:
I was on Zen Armor version 2.1.1. If I upgrade to the newest version available, currently 2.3.2, I can no longer reach the OPNsense web URL https://192.168.2.251. I've included screenshots below which shows the live sessions page, before and after the upgrade. Before the upgrade, you can see my workstation (192.168.2.99) is able to reach the web URL of .251. After the upgrade, the workstation is blocked from accessing the same .251 IP. Besides upgrading Zen Armor, nothing else changed. I did not make any changes to the policy, the IPs, firewall rules, nothing at all.
You cannot view this attachment.
You cannot view this attachment.
I don't think this is specific to the latest version of Zen Armor. I only know that it began with a version after 2.1.1.
Post-upgrade, if I turn off "Block all internet access" on my MGMT_Policy, my workstation (192.168.2.99) can once again access https://192.168.2.251.
Can someone provide insight as to why an upgrade to Zen Armor would change the behavior of the policy?
Thank you
Since December of last year, I've been troubleshooting what I originally thought was an OPNsense upgrade issue, but I have now instead determined to be a Zen Armor-specific upgrade issue.
My current OPNsense setup:
- Multiple interfaces - LAN, MGMT, WAN
- Zen Armor has been installed since late summer 2025
- The MGMT network has its own Zen Armor policy assigned to it named MGMT_Policy, which has "Block all internet access" turned ON.
- I manage OPNsense through it's MGMT interface IP - https://192.168.2.251/
I was on Zen Armor version 2.1.1. If I upgrade to the newest version available, currently 2.3.2, I can no longer reach the OPNsense web URL https://192.168.2.251. I've included screenshots below which shows the live sessions page, before and after the upgrade. Before the upgrade, you can see my workstation (192.168.2.99) is able to reach the web URL of .251. After the upgrade, the workstation is blocked from accessing the same .251 IP. Besides upgrading Zen Armor, nothing else changed. I did not make any changes to the policy, the IPs, firewall rules, nothing at all.
You cannot view this attachment.
You cannot view this attachment.
I don't think this is specific to the latest version of Zen Armor. I only know that it began with a version after 2.1.1.
Post-upgrade, if I turn off "Block all internet access" on my MGMT_Policy, my workstation (192.168.2.99) can once again access https://192.168.2.251.
Can someone provide insight as to why an upgrade to Zen Armor would change the behavior of the policy?
Thank you
#2
German - Deutsch / Re: Hardware Suche N150 mit In...
Last post by meyergru - Today at 06:40:05 PMDu bekommst bei Amazon solche Mini-Firewalls als Barebones zwar für < 200€. Leider sind inzwischen die Preise für RAM stark gestiegen, weshalb Modelle mit RAM und SSD meist bei > 300€ landen. Der billigste 8 GByte SODIMM DDR5 kostet schon ca. 100€, eine 256 GByte SSD ca. 50€ - unter 300€ wirst Du wohl nur noch gebraucht landen.
Es gibt aber manche Modelle mit N100 (kaum langsamer), die noch DDR4 einsetzen, dann wird es etwas billiger:
https://www.amazon.de/dp/B0F5GJ2JHP
https://www.amazon.de/dp/B09F4CT8LV
https://www.amazon.de/dp/B07BL2WXB9
Ich habe auch einen mit N150 gefunden: https://www.amazon.de/dp/B0FCY3CFW7, allerdings sieht die Kühlung da schlechter aus.
Ich würde immer die Selbstaufrüstung vorziehen, weil Du dann keine No-Name-Bauteile bekommst.
Es gibt aber manche Modelle mit N100 (kaum langsamer), die noch DDR4 einsetzen, dann wird es etwas billiger:
https://www.amazon.de/dp/B0F5GJ2JHP
https://www.amazon.de/dp/B09F4CT8LV
https://www.amazon.de/dp/B07BL2WXB9
Ich habe auch einen mit N150 gefunden: https://www.amazon.de/dp/B0FCY3CFW7, allerdings sieht die Kühlung da schlechter aus.
Ich würde immer die Selbstaufrüstung vorziehen, weil Du dann keine No-Name-Bauteile bekommst.
#3
General Discussion / [SOLVED Mysterious "sendto: P...
Last post by akurmann - Today at 06:36:06 PMHi,
Did you ever solve the problem? I had the same problem after I have added some new firewall rules, that ping to an external ip address like 8.8.8.8 did not work any more, i.e. I got also "sendto: Permission denied"
Solution: I have just rebooted OpnSense and the problem has vanished.
I have noticed, that the firewall of OpnSense does sometimes not work properly anymore after having done some (more than 5) changes to the firewall rules. A reboot always helps.
Andreas
Did you ever solve the problem? I had the same problem after I have added some new firewall rules, that ping to an external ip address like 8.8.8.8 did not work any more, i.e. I got also "sendto: Permission denied"
Solution: I have just rebooted OpnSense and the problem has vanished.
I have noticed, that the firewall of OpnSense does sometimes not work properly anymore after having done some (more than 5) changes to the firewall rules. A reboot always helps.
Andreas
#4
General Discussion / Looking for local Minnesota co...
Last post by ericlandfill - Today at 06:29:02 PMHey All,
I've got a burgeoning industrial facility that wants to setup a new fiber network with two sites to start, along with several VLANs. I've got a enough skills to be dangerous but we need to make sure it's secure.
Anyone have local contacts in Minnesota?
I've got a burgeoning industrial facility that wants to setup a new fiber network with two sites to start, along with several VLANs. I've got a enough skills to be dangerous but we need to make sure it's secure.
Anyone have local contacts in Minnesota?
#5
25.7, 25.10 Series / Re: in dnsmasq dhcp: leases: b...
Last post by pseudonym3k - Today at 06:11:56 PMI am in similar situation and hoping for a straightforward, clean solution.
I have some devices I need a reserved DHCP address assigned. The wifi mac is not printed anywhere, I have to connect to ethernet or wifi first to get that. I set up a reserved IP assignment in DNSMasq, then reboot the device. It just gets the dynamic IP back. The devices have no options to do anything else.
If I use the magnifier glass next to the dynamic lease in DNSmasq it takes me to the static assignment record. But still the device IP doesn't change until the lease expires.
The workarounds I have used:
1. Stop DNSMasq, edit the DNSMasq active leases file and remove unwanted leases or change the lease time, then start DNSMasq again. I haven't seen any side effects but I don't like editing files as I'll never know when it might cause a problem.
2. After the static assignment is in place, do a factory reset on the device then configure it again. Doable but not really desirable. And doesn't always work; some devices STILL get the dynamic active lease back.
3. Set the default lease time to something short *before* I connect the new device for the first time. I also need to wait until some devices (that tend to behave badly during lease renewals) are not going to be renewing during this time. If I forget to alter the default lease time then it's back to #1 or #2 or have to wait for the lease to expire, before I can finish setting up the new device.
Are there any other options I can use, to get the reserved IP assigned when the device can't cause it to happen?
I did read in Github and elsewhere that adding a delete lease function is not planned, for reasons such as possible inconsistencies. Could the active lease time be edited in the GUI to some minimum time, like five minutes, so DNSMasq could expire it in a normal way and assign the reserved IP?
I have some devices I need a reserved DHCP address assigned. The wifi mac is not printed anywhere, I have to connect to ethernet or wifi first to get that. I set up a reserved IP assignment in DNSMasq, then reboot the device. It just gets the dynamic IP back. The devices have no options to do anything else.
If I use the magnifier glass next to the dynamic lease in DNSmasq it takes me to the static assignment record. But still the device IP doesn't change until the lease expires.
The workarounds I have used:
1. Stop DNSMasq, edit the DNSMasq active leases file and remove unwanted leases or change the lease time, then start DNSMasq again. I haven't seen any side effects but I don't like editing files as I'll never know when it might cause a problem.
2. After the static assignment is in place, do a factory reset on the device then configure it again. Doable but not really desirable. And doesn't always work; some devices STILL get the dynamic active lease back.
3. Set the default lease time to something short *before* I connect the new device for the first time. I also need to wait until some devices (that tend to behave badly during lease renewals) are not going to be renewing during this time. If I forget to alter the default lease time then it's back to #1 or #2 or have to wait for the lease to expire, before I can finish setting up the new device.
Are there any other options I can use, to get the reserved IP assigned when the device can't cause it to happen?
I did read in Github and elsewhere that adding a delete lease function is not planned, for reasons such as possible inconsistencies. Could the active lease time be edited in the GUI to some minimum time, like five minutes, so DNSMasq could expire it in a normal way and assign the reserved IP?
#6
German - Deutsch / Re: Umstellung auf IPsec Conne...
Last post by viragomann - Today at 06:11:21 PMQuote from: osmom on Today at 04:18:52 PMBei den neuen Connections wird ESP nicht mehr unterstüzt.Das glaub ich nicht. Da würde meine VPN auch nicht mehr funktionieren.
Quote from: osmom on Today at 04:18:52 PMZur Authentifizierung nutze ich dabe EAP-Radius und EAP-MSCHAPv2.Sind nicht beide Methoden zur Client Authentifizierung gedacht und alternativ in der Remote-Konfiguration zu verwenden?
Jedenfalls hatte ich mich vor ein paar Wochen damit beschäftigt, als ich einen Road Warrior Server eingerichtet hatte, und das so im Kopf behalten.
Ich nutze am Server (Local) einfach ein TLS Zertifikat.
In der Remote muss auf jeden Fall EAP Radius rein, wenn der Prozess den NPS nutzen soll.
Und in VPN: IPsec: Mobile & Advanced Settings > eap-radius muss dieser ausgewählt werden.
In Remote wird konfiguriert, wie sich der Client beim Server authentifiziert.
In Local, wie sich der Server beim Client authentifiziert.
#7
German - Deutsch / Re: Hardware Suche N150 mit In...
Last post by carepack - Today at 06:03:28 PMQuote from: newbe on January 12, 2026, 09:12:44 PMMan findet reichlich Mini PCs mit 2x LAN Schnittstellen, Blackview, SOYO Mini, GMKtec...:
Mini-PC SOYO M4 Mini Intel Twin Lake N150 Prozessor LPDDR5 12 GB RAM 512 GB ROM Windows 11 Pro WiFi 5
https://de.aliexpress.com/item/1005010734755262.html
138,75€
Ich habe u.a. Blackview und kann nicht meckern, auch welche die seit Monaten 24/7 laufen.
Nutzererfahrung findest du auch hier: https://www.mydealz.de/gruppe/mini-pc
Hi,
mein Thema war nicht einen Mini-PC zu finden sondern einen der Dual LAN mit Intel Netzwerkchipsätzen hat...
Danke dir!
#8
German - Deutsch / Re: Multiwan mit DSL und Starl...
Last post by Monviech (Cedrik) - Today at 06:03:11 PMJa das geht mit policy based routing:
https://docs.opnsense.org/manual/how-tos/multiwan.html
Mit den richtigen Firewall und NAT regeln kann man das machen.
https://docs.opnsense.org/manual/how-tos/multiwan.html
Mit den richtigen Firewall und NAT regeln kann man das machen.
#9
German - Deutsch / Re: Hardware Suche N150 mit In...
Last post by carepack - Today at 06:02:20 PMQuote from: Patrick M. Hausen on January 12, 2026, 04:28:57 PMDer Beelink EQ14 hätte z.B. definitiv Intel-Schnittstellen (KTI226-V). Ich hab einen ME-Mini von denen als NAS und bin recht zufrieden.
https://www.bee-link.com/de/products/beelink-eq14-n150
Hallo Patrick,
besten Dank dir! Leider übersteigt die Empfehlung etwas mein Budget. Kennst du einen, der unter 300€ liegt?
Dankeschön:-)
#10
German - Deutsch / Re: Eigener DNS bei einer IPv6...
Last post by meyergru - Today at 05:55:34 PMQuote from: n3 on Today at 04:33:50 PMSchlimm wenn es nicht die eine Lösung gibt ;-) Verstehe ich es grob richtig, dass aktuelle zwei Ansätze diskutiert werden. Der eine zielt möglichst auf IPv6 only ab und bindet IPv4 dort ein, wo nötig. Führt aber zu einer komplexeren Konfiguration.
Der andere Ansatz ist Dual-Stack, was vielleicht nicht optimal ist, jedoch einfacher zu konfigurieren/betreiben.
Welche Vorteile hat Ansatz 1 und welche Nachteile Ansatz 2?
Gibt es einen Favoriten für mein Szenario (der initiale Aufwand mal außen vor gelassen):
- HomeLab
- Feste/Dynamisch IP Adresse möglich
- Mehrere Interfaces (Consumer-Clients, Server, Kameras, Außennetzwerk)
- proxmox mit opnsense, homeassistant, nextcloud, AdGuard, etc.
- Consumer-Clients sollten von am besten nahtlos von Außen auf homeassistant, nextcloud zugreifen können
- nextcloud sollte aber auch für Dritte verfügbar sein
- Prio 1 Sicherheit, Prio 2 Stabilität und Prio 3 Maintenance
P.S. Hab mich geirrt. Die feste IP kostet 10€ und ab dem 7. Monat dann 23€/mtl.
Wenn Du ein von außen erreichbares Homelab betreiben willst wäre eine feste IP von Vorteil (aber nicht zwingend - ich habe keine, nutze nur DynDNS für IPv4 und IPv6, da full Dual Stack). Ich betreibe alle die von Dir beschriebenen Sachen wie im Howto beschrieben. Sicherheit durch Betrieb der von außen erreichbaren Services in einer separaten DMZ, außerdem in den meisten Fällen per Reverse Proxy. Falls kein HTTPS, über Port forwarding (IPv4 und IPv6). Dadurch sind nur WAN IPv4 und IPv6 exponiert. Im LAN keine ULA, nur GUA per SLAAC und IPv4 ("old style"). Konkret über RADVD und Kea DHCP mit Unbound.
Das erlaubt IPv4-only Clients (und Server - die müssen bis auf nicht-proxy-fähige Dienste ja sowieso nur IPv4 können, weil ich im Reverse Proxy eh nur IPv4 nach innen nutze).
Sicher, keine Tricksereien, kein Tayga, kein NAT66, VLANs straightforward mit IPv4/24 und IPv6/64, keine Pflege von internem DNS mit IPv6 (nur IPv4). Funktioniert auch für IPv4-Clients.
Potentielle Nachteile:
a. Geräte, die keine Privacy Extensions unterstützen, telefonieren mit Ihrer festen EUI-64 nach außen
b. old style, d.h. nicht "IPv6 first"
DS-Lite ist ein separates Thema, weil man sich dann Gedanken machen muss, wie man Dienste nach außen per IPv4 verfügbar macht, was auf Tunnellösungen hinausläuft.
