Recent posts

#1

Intrusion Detection and Prevention / Re: High RAM usage after upgra...

Last post by rosebl - Today at 09:22:54 AM

I've noticed higher Suricata RAM usage after upgrades too. You might want to compare your Suricata settings with the latest recommendations: https://docs.opnsense.org/ ragdoll hit

#2

26.7 Series / Re: nginx plugin -> security h...

Last post by MiRei - Today at 09:20:04 AM

Thank you very much muchacha_grande,

these two patches solved my problem.

#3

Hardware and Performance / Re: Network setup with OPNsens...

Last post by Snoopy913 - Today at 08:53:04 AM

I have tried to illustrate the setup at the side of the track on the airstrip, I would place 2 APs at one station to cover around 180 Degree with the 2,4Ghz Antennas. With 200m between each station, an AP would have to cover 100-150m distance, which I would hope is possible with acceptable upload speed.

currently I would tend to the U7 Outdoor, because they seem to have the same antenna as the UMA-D and it would be cheaper then getting the UAP-AC-M together with the directional antenna. But maybe I find some used.

#4

26.7 Series / Re: slow dhcp on wan -> broken...

Last post by sternchen45 - Today at 08:51:56 AM

attacking the slow dhcp
-replace the cable
-is the AutoNeg not working properly
-some kind of incompatibility on the network interface side?

#5

26.1, 26,4 Series / Re: Rules migration - has some...

Last post by Monviech (Cedrik) - Today at 08:48:20 AM

They are just visible there, because they are active in the system. Imagine it like the automatic rules that can be seen.

They have not been migrated.

Just follow the migration assistant step by step (dont think too much, just follow it), or install the os-firewall-legacy plugin to continue using the old rules screen.

#6

26.1, 26,4 Series / Rules migration - has somethin...

Last post by ZPrime - Today at 08:33:22 AM

I'm on 26.1.11_10

I checked out the Rules (new) section and all of my rules from the legacy section appear to have been added over there already. I don't recall doing any export -> import dance... but searching this forum I'm seeing references that the migration "wizard" is 100% manual.

Has this changed and things have now been migrated automatically? Or is the only way to see things in "Rules (new)" from a manual import? (it's possible I did this late one night then forgot... nobody else logs in to this OPNsense system but me though.)

#7

26.1, 26,4 Series / Re: DEC840 slow upload test wh...

Last post by JamesFrisch - Today at 08:16:37 AM

ahh, no?

https://www.fs.com/products/185594.html

And bevor you ask, friend of mine his XGS-PON with that and OPNsense ;)

@tedhugehes I you would at least only slop your own thread, instead of someone elses. *old man yelling at cloud* Back in my days, we called that thread hijacking.

#8

26.7 Series / Re: Services widget

Last post by opnsenseuser - Today at 07:34:54 AM

If you stretch the individual widget to make it wider, the row also shifts upwards.

#9

26.7 Series / Re: slow dhcp on wan -> broken...

Last post by lmoore - Today at 07:26:31 AM

So I could configure the WAN IF as static IP and then have the bridged IF get a SLAAC address

In message #8, I mentioned I only have an IPv4 environment, someone with an IPv6 environment may be able to answer this question.

The WAN IF would be configured as per how you would normally configure it, then add it as a member of the bridge. The bridge is simply allowing another interface to exist for the ONT management network to be attached. In an earlier post I mentioned it is like a "simple switch", more correctly, it's like a hub as all traffic will be seen on the interfaces but with the added benefit that firewall rules can be applied to the interfaces.

Ideally, I would use a virtual Ethernet interface for the ONT network and add it as member of the bridge. The bridge would then remain unnumbered. However, as vether-kmod is not available in OPNsense, nor FreeBSD 15 & 16, putting the IP address on the bridge was my only choice.

Does bridge mode create overhead?

There will be an overhead, however, with my slow DSL service there is no observed performance issue and buffer-bloat is handled well by the traffic shaper.

Perhaps someone with a high-speed internet service can test and compare performance when a bridge is used and report back.

I've read that it puts its members into promiscuous mode

Message #19 shows the interface details. Yes, the bridge members are put in to promiscuous mode - see ifconfig(8).

In my WAN rules, my last inbound rule will capture any packet arriving which isn't handled by another rule - I've not seen anything untoward from this rule, just the usual probes.

#10

Development and Code Review / Re: Blocky DNS (Alternate to A...

Last post by Firewire - Today at 06:02:59 AM

New Blocky Update available:
https://github.com/0xERR0R/blocky/releases/tag/v0.34.0