"Recent posts
#1
26.7 Series / Re: Critical PHP vuln: php2she...
Last post by nero355 - Today at 05:52:05 PMQuote from: stefan00 on Today at 01:21:22 PMtodays fancy multi-factor-auth systemsThat crap being forced upon me where I have ZERO need for it is seriously annoying to be honest! :(
I don't want to check my e-mail for a code!
I don't want to involve my phone with logging in somewhere!
Leave me alone...
Not everything is that important for everyone :)
Quote from: s5n on Today at 02:47:57 PMThere's been no need to reboot for the PHP packages update AFAIC.After each update/upgrade the webGUI is restarted so in this case that should be enough : No reboot needed!
#2
Development and Code Review / Ports build error fetching pat...
Last post by none - Today at 05:04:53 PMHi,
this happened to me here, I would like to know if is just me.
I am building 26.7.7 again for post PHP issue images, so this happened here:
and
I then downloaded manually the patches and updated the distinfo data as well. The ports build now runs as usual here.
Thanks,
none
this happened to me here, I would like to know if is just me.
I am building 26.7.7 again for post PHP issue images, so this happened here:
Code Select
[20261022135603] ===> License PHP301 accepted by the user
===> php85-zlib-8.5.12 depends on file: /usr/local/sbin/pkg - not found
[20261022135603] ===> License BSD2CLAUSE accepted by the user
[20261022135603] => 65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch doesn't seem to exist in /usr/ports/distfiles.
[20261022135603] => Attempting to fetch https://github.com/opnsense/pkg/commit/65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch
fetch: https://github.com/opnsense/pkg/commit/65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch: size mismatch: expected 2827, actual 2831
[20261022135604] => Attempting to fetch http://distcache.FreeBSD.org/ports-distfiles/65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch
fetch: http://distcache.FreeBSD.org/ports-distfiles/65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch: Not Found
[20261022135605] => Couldn't fetch it - please try to retrieve this
[20261022135605] => port manually into /usr/ports/distfiles and try again.
*** Error code 1
Stop.
make[1]: stopped making "install" in /usr/ports/opnsense/pkg
*** Error code 1
Stop.
make: stopped making "install" in /usr/ports/archivers/php85-zlib
[20261022135608] ===> Cleaning for pkg-2.8.4_1
[20261022135609] ===> Cleaning for php85-zlib-8.5.12
[20261022135613] ===> License BSD3CLAUSE accepted by the user
===> snappy-1.3.1 depends on file: /usr/local/sbin/pkg - not found
[20261022135613] ===> License BSD2CLAUSE accepted by the user
[20261022135613] => 65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch doesn't seem to exist in /usr/ports/distfiles.
[20261022135613] => Attempting to fetch https://github.com/opnsense/pkg/commit/65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch
fetch: https://github.com/opnsense/pkg/commit/65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch: size mismatch: expected 2827, actual 2831
[20261022135613] => Attempting to fetch http://distcache.FreeBSD.org/ports-distfiles/65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch
fetch: http://distcache.FreeBSD.org/ports-distfiles/65e6bddc5ffb3edb71e240f7bbaf58fb00b7002e.patch: Not Found
[20261022135614] => Couldn't fetch it - please try to retrieve this
[20261022135614] => port manually into /usr/ports/distfiles and try again.
*** Error code 1
Stop.
and
Code Select
[20261022141943] ===> License BSD2CLAUSE accepted by the user
[20261022141943] => 6a8c6d4bfc5fef41a055952ab2f6fd5e8c6348cb.patch doesn't seem to exist in /usr/ports/distfiles.
[20261022141943] => Attempting to fetch https://github.com/opnsense/pkg/commit/6a8c6d4bfc5fef41a055952ab2f6fd5e8c6348cb.patch
fetch: https://github.com/opnsense/pkg/commit/6a8c6d4bfc5fef41a055952ab2f6fd5e8c6348cb.patch: size mismatch: expected 3036, actual 3038
[20261022141944] => Attempting to fetch http://distcache.FreeBSD.org/ports-distfiles/6a8c6d4bfc5fef41a055952ab2f6fd5e8c6348cb.patch
fetch: http://distcache.FreeBSD.org/ports-distfiles/6a8c6d4bfc5fef41a055952ab2f6fd5e8c6348cb.patch: Not Found
[20261022141945] => Couldn't fetch it - please try to retrieve this
[20261022141945] => port manually into /usr/ports/distfiles and try again.
I then downloaded manually the patches and updated the distinfo data as well. The ports build now runs as usual here.
Thanks,
none
#3
General Discussion / Re: How to handle firewall hos...
Last post by viragomann - Today at 04:56:14 PMI've added all my interfaces to an interface group, called it "Internal", where I've defined common rules for DNS, NTP and alike.
And yes I've forwarded DNS and NTP requests to the loopback address. This means, you can also use the interface group in port forwarding rules.
And yes I've forwarded DNS and NTP requests to the loopback address. This means, you can also use the interface group in port forwarding rules.
#4
General Discussion / Re: How to handle firewall hos...
Last post by bimbar - Today at 04:47:00 PMInstead of an unused interface, use a loopback interface.
#5
General Discussion / How to handle firewall hosted ...
Last post by mooh - Today at 04:34:32 PMI'm planning a network with >100 LAN networks on VLANs. Every network needs access to DNS, NTP and possibly other services on the firewall.
The easy solution is of course, to create a floating rule, so that any firewall interface except WAN(s) can be reached from any network. But that would allow nosy users and internal attackers to easily get an idea of the topology of the network. Alternatively, creating more specialised rules for every interface would be a pain. The best I have come up with so far is to create an otherwise unused interface, have all the firewall services listen on that and to create one floating rule for everyone to access the services there. That adds a bit of fiddling with DHCP.
Is there a more elegant way, i.e. secure and low maintenance, to provide services for every network on the FW yet keep the networks seperate?
The easy solution is of course, to create a floating rule, so that any firewall interface except WAN(s) can be reached from any network. But that would allow nosy users and internal attackers to easily get an idea of the topology of the network. Alternatively, creating more specialised rules for every interface would be a pain. The best I have come up with so far is to create an otherwise unused interface, have all the firewall services listen on that and to create one floating rule for everyone to access the services there. That adds a bit of fiddling with DHCP.
Is there a more elegant way, i.e. secure and low maintenance, to provide services for every network on the FW yet keep the networks seperate?
#6
General Discussion / Unbound DNS over TLS
Last post by user12314 - Today at 04:17:54 PMHi everyone. I set up Unbound DNS, my setup is my devices -> pihole -> Unbound DNS.
I checked the "DNSSEC" box, but to be honest I don't know that much about DNS over TLS. Is this everything I have to do to enable DNS over TLS outside of my home network, or is there anything else?
thank you
I checked the "DNSSEC" box, but to be honest I don't know that much about DNS over TLS. Is this everything I have to do to enable DNS over TLS outside of my home network, or is there anything else?
thank you
#7
General Discussion / Re: New WAN failover configura...
Last post by bob9999 - Today at 04:17:30 PMI fixed the adguard home access problem by editing its configuration file, adguardhome.yaml. I gave it a different administrative port. The accepted standard is port 3000. Apparently, that port conflicts with some aspect of the setup of gateway groups, according to some search engine research. Wikipedia says the port number I gave it is unused.
The DNS LAN rule mentioned in the reference post above was already above the LAN rule in question. It was originally very difficult to create because Opnsense kept telling me that 192.168.1.1/32 did not exist. On a random follow up attempt it accepted the address. I was trying to follow the example in the Opnsense documentation.
It still fails with DNS access. Even after a router reboot. Everything returns to life after I back out the changes to the rules.
Although Adguard Home as a DNS forwarder works very well. My DNS queries are in the 12 ms range consistently.
Using Unbound as a forwarder to the DNS servers on the main system setup page, the queries were in the 20 ms range or slightly better.
Using Unbound only, the queries were in the 30 ms to 50 ms range. That was a surprise as I always believed Unbound was a sort of superior standard.
On the plus side, ignoring Unbound on an Adguard Home install, leaving Unbound disabled, should make Adguard Home a no brainer to install. Getting Adguard Home to coordinate with Unbound was also a frustrating problem. I fail to see how Unbound is 'superior', which I also believed until I went through all this.
I will keep playing with the Failover / LoadBalance configurations and eventually figure it out.
DNS access is the problem. Advice from people who have already went through this is wanted.
Quick Edit:
Could someone tell me where the graph is that shows historical traffic levels through the WAN interfaces? I saw one that showed how much data was going through WAN1 and WAN2, but I can't seem to find it again. Is this my imagination?
The DNS LAN rule mentioned in the reference post above was already above the LAN rule in question. It was originally very difficult to create because Opnsense kept telling me that 192.168.1.1/32 did not exist. On a random follow up attempt it accepted the address. I was trying to follow the example in the Opnsense documentation.
It still fails with DNS access. Even after a router reboot. Everything returns to life after I back out the changes to the rules.
Although Adguard Home as a DNS forwarder works very well. My DNS queries are in the 12 ms range consistently.
Using Unbound as a forwarder to the DNS servers on the main system setup page, the queries were in the 20 ms range or slightly better.
Using Unbound only, the queries were in the 30 ms to 50 ms range. That was a surprise as I always believed Unbound was a sort of superior standard.
On the plus side, ignoring Unbound on an Adguard Home install, leaving Unbound disabled, should make Adguard Home a no brainer to install. Getting Adguard Home to coordinate with Unbound was also a frustrating problem. I fail to see how Unbound is 'superior', which I also believed until I went through all this.
I will keep playing with the Failover / LoadBalance configurations and eventually figure it out.
DNS access is the problem. Advice from people who have already went through this is wanted.
Quick Edit:
Could someone tell me where the graph is that shows historical traffic levels through the WAN interfaces? I saw one that showed how much data was going through WAN1 and WAN2, but I can't seem to find it again. Is this my imagination?
#8
German - Deutsch / Re: Glasfaser ONT
Last post by Patrick M. Hausen - Today at 04:04:59 PM- VLAN einrichten (evtl. - hängt vom Provider ab), PPPoE einrichten (evtl. - hängt vom Provider ab) - fertig.
- Oder DHCP einrichten (evtl. - hängt vom Provider ab) - fertig.
Informationen, welche Alternative zutrifft, gibt es bei deinem Provider.
- Oder DHCP einrichten (evtl. - hängt vom Provider ab) - fertig.
Informationen, welche Alternative zutrifft, gibt es bei deinem Provider.
#9
Portuguese - Português / Re: Failover dual-WAN automáti...
Last post by seolinkbuilder5678 - Today at 04:04:52 PMTestar a comutação automática na prática é essencial, principalmente para verificar o tempo de convergência e se conexões ativas continuam sem cair. Quanto ao toque pessoal nos textos, usar caracteres especiais e letras estilizadas dá um destaque incrível a bios e títulos digitais. Para quem quer explorar novos estilos de tipografia além das opções padrão, o Letras Diferentes é uma ferramenta fantástica e muito fácil de usar no dia a dia.
#10
German - Deutsch / Re: Glasfaser ONT
Last post by k0ns0l3 - Today at 03:59:46 PMHallo,
Geplant ist Kombi 600 Mbit/s Internet & TV und ONT direkt an OPNSense.
Ein Medienkonverter wird nicht gebraucht.
Lg k0ns0l3
Geplant ist Kombi 600 Mbit/s Internet & TV und ONT direkt an OPNSense.
Ein Medienkonverter wird nicht gebraucht.
Lg k0ns0l3
