Recent posts

#1

26.7 Series / Re: Interfaces: Virtual IPs: S...

Last post by Monviech (Cedrik) - Today at 07:37:52 AM

Now that sounds more like it.

It means that for IPFW dummynet shaping it needs an additional tunable.

But that also means without that tunable, shaping via PF should also work (which is available in the new Rules, you can attach pipes via PF there so PF sends it to dummynet, IPFW is not needed then. But its still a bit wonky probably)

#2

26.7 Series / Re: Planning update from 26.7....

Last post by santi.benejam - Today at 07:02:40 AM

I just updated right now, it looks like everything works the right way.

Thanks all

#3

High availability / Re: CARP / HA with dual WAN fa...

Last post by nuverashaikh - Today at 05:28:02 AM

Hello,
drift boss
I have two OPNsense servers, each with its own dedicated WAN connection, configured with CARP/HA. Failover works as expected if the primary server fails, becomes unresponsive, or is taken offline for maintenance.

The issue I'm seeing is that there is no failover when only the primary server's WAN connection goes down. The primary firewall remains the CARP master, so traffic doesn't switch to the secondary firewall even though its WAN connection is still up.

Can anyone point me in the right direction on what I should be checking or configuring to ensure the backup server takes over when the primary server loses WAN connectivity? Any suggestions would be greatly appreciated.

You may need to configure gateway monitoring or a trigger that increases the CARP demotion level when the WAN goes down. Are you currently using dpinger for WAN monitoring?

#4

Tutorials and FAQs / Re: how do you get PIA VPN Imp...

Last post by comet424 - Today at 05:15:09 AM

seems maybe opnsense has a bug in it..

if i create a new authority give it a name leave it as create new internal cert and leave the issuer as self-signed  it fails to create a self-signed issuer so i guessing its not working

but if you do the same create a new authority give it a name and create  a new internal cert.. but you change the issuer to one of those other authoritys i have in the screen shot.. then it will show up as issuer of that other authority...so thats kinda messed up... and if its blank i guess thats why its not working with openvpn for pia vpn

[1]

#5

Documentation and Translation / Re: It would appear that FE80:...

Last post by drosophila - Today at 02:55:14 AM

Good find, /10 must be correct, or rather, /8 cannot be, because "FE80" requires 9 bits (1111111010000000).

#6

General Discussion / Re: OPNsense 26.7.2_2: TLS err...

Last post by drosophila - Today at 02:38:45 AM

I found an issue on my network/gateway/router.
It was not an OPNsense problem.

MTU / MSS perchance? :)

#7

26.7 Series / Re: Planning update from 26.7....

Last post by drosophila - Today at 02:19:27 AM

The most problematic update (microcode / bootloader) is the one that goes from 26.1 to 26.7. Since you're on 26.7 already, I wouldn't expect any major issues.

#8

26.7 Series / Re: Another 26.7 "Upgrade Fail...

Last post by drosophila - Today at 02:03:47 AM

Wait, does it need to reach the internet to do this?

It shouldn't need to, but IDK for sure. Try it, if it needs it, it'll stall then fail, hopefully with some descriptive message. :)

Edit: looks like it might do a live lookup, at least it detects version mismatches that stem from a not-yet done update. :\ Unless it uses the last-downloaded database.

If that doesn't come up clean, then the next thing would be to do what this post does (needs terminal and internet access):
https://forum.opnsense.org/index.php?msg=273063

I'll be off updating from 26.7.1_1 to latest now, so hopefully both of us will be running 26.7.2_2 tonight. :)

#9

26.7 Series / Re: Another 26.7 "Upgrade Fail...

Last post by Kevin G. - Today at 01:59:19 AM

Got stuck in a "rebooting now" and returning to the Lobby/Dashboard loop, assumed the update failed. (...) manually reboot the Opnsense box

The update very likely was not complete. Do a health audit (System->Firmware->Status-Run an Audit), I bet it'll come up unclean.

I'll look at this now...thanks.
Wait, does it need to reach the internet to do this?

[AND]

#10

26.7 Series / Re: Another 26.7 "Upgrade Fail...

Last post by Kevin G. - Today at 01:58:42 AM

SO, where do I go from here?

Thinking more of a fresh install...but hate the thought of rebuilding everything. Which begs the original questions...

If I fresh install, will my config file bring everything over including Legacy ISC AND Legacy Rules?
OR will a fresh install of 26.7 include the Rule Migration Tool? OR does a fresh 26.7 install have all of it's own basic rules?