"Recent posts
#1
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by BoNetTech - Today at 09:09:46 AMYes, that is the right page, and that is the right rule: destination "This Firewall", port domain (53), no gateway. The order is fine too.
Proton: if the what's-my-IP site shows the Proton endpoint, your traffic goes through the tunnel, so that part works. It doesn't test DNS, though.
How to test DNS (from the laptop on PERSONAL20):
Open a terminal or command prompt and run nslookup example.com. The line "Server:" should show 192.168.20.1 (your firewall). If it shows something else, the laptop is not using your firewall's DNS.
Open dnsleaktest.com and run the extended test. It should show Quad9 servers, not your ISP's.
In OPNsense: Services > Unbound DNS > Log File, or Reporting > Unbound DNS. You should see your queries there.
DNSSEC, far gateway, DNS over TLS:
– DNSSEC enabled is fine; Unbound will validate the answers.
– "Far gateway" belongs to System > Gateways. As far as I know, it is normally needed for WireGuard tunnels where the gateway address is outside the tunnel subnet. Since traffic goes out through Proton, it is working.
– Your DNS over TLS entries look correct: 9.9.9.9 and 149.112.112.112, port 853, Verify CN dns.quad9.net.
Next: copy the DNS rule to XBOXS10 and GUEST30, and to MGNT99 if you want DNS from the management network. Then test the kill switch by disabling the WireGuard instance briefly: pages from the VLANs should stop loading.
Sergio
Proton: if the what's-my-IP site shows the Proton endpoint, your traffic goes through the tunnel, so that part works. It doesn't test DNS, though.
How to test DNS (from the laptop on PERSONAL20):
Open a terminal or command prompt and run nslookup example.com. The line "Server:" should show 192.168.20.1 (your firewall). If it shows something else, the laptop is not using your firewall's DNS.
Open dnsleaktest.com and run the extended test. It should show Quad9 servers, not your ISP's.
In OPNsense: Services > Unbound DNS > Log File, or Reporting > Unbound DNS. You should see your queries there.
DNSSEC, far gateway, DNS over TLS:
– DNSSEC enabled is fine; Unbound will validate the answers.
– "Far gateway" belongs to System > Gateways. As far as I know, it is normally needed for WireGuard tunnels where the gateway address is outside the tunnel subnet. Since traffic goes out through Proton, it is working.
– Your DNS over TLS entries look correct: 9.9.9.9 and 149.112.112.112, port 853, Verify CN dns.quad9.net.
Next: copy the DNS rule to XBOXS10 and GUEST30, and to MGNT99 if you want DNS from the management network. Then test the kill switch by disabling the WireGuard instance briefly: pages from the VLANs should stop loading.
Sergio
#2
26.1, 26.4 Legacy Series / Re: os-kea-ubnd-ddns v0.98 — K...
Last post by kevindd992002 - Today at 09:08:08 AM@tkreagan I'm just wondering, is your plugin compatible with the latest 26.7.8 opnsense? Also, a couple of questions:
1) Do you recommend enabling full sync?
2) Do you recommend enabling log watcher? If so, how do I change the DEBUG log level of Kea DHCP to 50?
3) How does your plugin compare to the os-kea-unbound plugin by JameZUK?
1) Do you recommend enabling full sync?
2) Do you recommend enabling log watcher? If so, how do I change the DEBUG log level of Kea DHCP to 50?
3) How does your plugin compare to the os-kea-unbound plugin by JameZUK?
#3
26.7, 26.10 Series / KEA DHCP to Unbound DDNS Plugi...
Last post by kevindd992002 - Today at 08:46:42 AMWhich is better between these two plugins?
os-kea-ubnd-ddns
os-kea-unbound
I have the first one installed in my new opnsense box until I saw the second one with a more recent release. The first one has more settings too.
os-kea-ubnd-ddns
os-kea-unbound
I have the first one installed in my new opnsense box until I saw the second one with a more recent release. The first one has more settings too.
#4
General Discussion / Re: Suricata and Crowdsec
Last post by JamesFrisch - Today at 07:43:51 AMDisclaimer: I don't know anything about Surricata.
I think you got them switched.
Crowdsec you can use multiple "parsers" (which logs it should read) and what "scenarios" it will look for.
Since this is all not "live" it isn't taxing on system resources and it won't affect your traffic speed or latency. It will block by using "bouncers" which can be pf (Opnsense), nftables or even nginx proxies.
AFAIK surricata is IPS. Resource intensive, because live.
So to get back to your question, since Surricata is live and faster already than crowdsec and does it's own blocking, why even bother sharing the information with crowdsec and vice versa? IMHO there is no point in doing that. But again, don't know much about it so happy to hear from others.
I think you got them switched.
Crowdsec you can use multiple "parsers" (which logs it should read) and what "scenarios" it will look for.
Since this is all not "live" it isn't taxing on system resources and it won't affect your traffic speed or latency. It will block by using "bouncers" which can be pf (Opnsense), nftables or even nginx proxies.
AFAIK surricata is IPS. Resource intensive, because live.
So to get back to your question, since Surricata is live and faster already than crowdsec and does it's own blocking, why even bother sharing the information with crowdsec and vice versa? IMHO there is no point in doing that. But again, don't know much about it so happy to hear from others.
#5
General Discussion / Re: Dnsmasq authoratative only...
Last post by stefanpf - Today at 06:08:10 AMHost overrides should have a higher priority than domain overrides.
Try the following:
- Add a domain override for bar.com with the IP address 8.8.8.8
- Add a host override for foo.bar.com with, for example, 192.168.1.1
It worked here in a quick test.
Since my internal domain is internal.bar.com, this behavior might not be directly applicable.
(Dnsmasq is still a mystery to me.)
Try the following:
- Add a domain override for bar.com with the IP address 8.8.8.8
- Add a host override for foo.bar.com with, for example, 192.168.1.1
It worked here in a quick test.
Since my internal domain is internal.bar.com, this behavior might not be directly applicable.
(Dnsmasq is still a mystery to me.)
#6
General Discussion / Suricata and Crowdsec
Last post by FyreWall - November 07, 2026, 11:45:35 PMTrying out running Suricata as an IDS and Crowdsec as an IPS.
I have both enabled with Suricata set to just alert.
I see a lot of alerts in Suricata for port scans but no action from Crowdsec regarding the Suricata alerts.
Is that normal or should Crowdsec be taking action on the Suricata alerts?
I have both enabled with Suricata set to just alert.
I see a lot of alerts in Suricata for port scans but no action from Crowdsec regarding the Suricata alerts.
Is that normal or should Crowdsec be taking action on the Suricata alerts?
#7
26.7, 26.10 Series / Re: Wireguard packet loss
Last post by hysteriward - November 07, 2026, 08:44:07 PMThanks. I use an IONOS VPS. It's $15 a month with 2 statics. I ended up using 2 Wireguard tunnels to simplify the routing. In my area the only way to get a static ip is through a business account. It was costing me $170 per month for 20 up and 250 down. Now with residential service I get 500Mbs symmetrical for $40. It's well worth doing and it's working flawlessly. I took the trouble to learn nftables which is the replacement for iptables which is now deprecated on many Linux flavors. It took a while to get my head around it but it is easier to use. I'm willing to share my setup with the understanding that although it works, it may not be the best way to do it.
#8
General Discussion / Dnsmasq authoratative only for...
Last post by nintendoeats - November 07, 2026, 07:59:05 PMBonjour,
I am using Dnsmasq for both DNS and DHCP. All has been well so far, but now I want to globally override a public server with my own mirror. Problem is, I am not mirroring the whole domain, only part of it. I would like to prevent upstream requests for bar.foo.com and baz.foo.com, but not *.foo.com like the Local option does.
I'm getting the impression that this behaviour is just outside the scope of Dnsmasq, and that the expectation is you will set up a different nameserver to differentiate these queries. Am I mistaken?
Thanks
I am using Dnsmasq for both DNS and DHCP. All has been well so far, but now I want to globally override a public server with my own mirror. Problem is, I am not mirroring the whole domain, only part of it. I would like to prevent upstream requests for bar.foo.com and baz.foo.com, but not *.foo.com like the Local option does.
I'm getting the impression that this behaviour is just outside the scope of Dnsmasq, and that the expectation is you will set up a different nameserver to differentiate these queries. Am I mistaken?
Thanks
#9
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - November 07, 2026, 07:08:08 PMOK I've done what you said, is this the page you were talking about? (The top rule)
Update: I put the rules in exactly this order and it worked to reach what's my IP website, it showed the proton endpoint address.
That's a good thing right it means proton is working 👍😁👍? I don't know how to test DNS though.
I will add this rule to the other vlans
I enabled (DNSsec)and some other options like (far gateway) during the initial setup using the 9.9.9.9 but I'm not sure if I did that right. I know I put the proper information in the Services>Unbound DNS> DNS over TLS.
Update: I put the rules in exactly this order and it worked to reach what's my IP website, it showed the proton endpoint address.
That's a good thing right it means proton is working 👍😁👍? I don't know how to test DNS though.
I will add this rule to the other vlans
I enabled (DNSsec)and some other options like (far gateway) during the initial setup using the 9.9.9.9 but I'm not sure if I did that right. I know I put the proper information in the Services>Unbound DNS> DNS over TLS.
#10
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by BoNetTech - November 07, 2026, 04:15:49 PMThanks, these screenshots answer most of my questions.
Confirmed:
– VLAN tags 10/20/30/99 match your switch. Good.
– Your PERSONAL20 "via Proton" rule has gateway Proton_Gway and sets the local tag NO_WAN_EGRESS, so your kill switch is built correctly. We'll test it at the end.
– Domain (53) is the right port for the test rule, and Gateway = None is right.
A correction from me: I told you to add "Localhost" in Unbound. I see now that this list has no such entry, so please ignore that. Keep the four VLANs selected, and no, don't add LAN (it has no IPv4 address).
One thing to check: on the new DNS rule, Destination must be "This Firewall" and Source "PERSONAL20 net". The dropdown covered those fields in your screenshot. If Destination is "any" with Gateway None, DNS queries could leave outside the tunnel without the kill switch tag. Please post a screenshot of the Source and Destination part of that rule.
Order: if it works below the block rule, leave it there. I can't tell why it failed above it; if you want to find out, post a screenshot of the rule list after moving it.
Next steps: if DNS works on PERSONAL20, copy the same rule to XBOXS10 and GUEST30. Then test the kill switch: disable the WireGuard instance for a moment (VPN > WireGuard), try to load a page from PERSONAL20 (it should fail), and enable it again.
Sergio
Confirmed:
– VLAN tags 10/20/30/99 match your switch. Good.
– Your PERSONAL20 "via Proton" rule has gateway Proton_Gway and sets the local tag NO_WAN_EGRESS, so your kill switch is built correctly. We'll test it at the end.
– Domain (53) is the right port for the test rule, and Gateway = None is right.
A correction from me: I told you to add "Localhost" in Unbound. I see now that this list has no such entry, so please ignore that. Keep the four VLANs selected, and no, don't add LAN (it has no IPv4 address).
One thing to check: on the new DNS rule, Destination must be "This Firewall" and Source "PERSONAL20 net". The dropdown covered those fields in your screenshot. If Destination is "any" with Gateway None, DNS queries could leave outside the tunnel without the kill switch tag. Please post a screenshot of the Source and Destination part of that rule.
Order: if it works below the block rule, leave it there. I can't tell why it failed above it; if you want to find out, post a screenshot of the rule list after moving it.
Next steps: if DNS works on PERSONAL20, copy the same rule to XBOXS10 and GUEST30. Then test the kill switch: disable the WireGuard instance for a moment (VPN > WireGuard), try to load a page from PERSONAL20 (it should fail), and enable it again.
Sergio
