"Recent posts
#1
26.7 Series / Re: Wireguard Gateways online ...
Last post by DEC740airp414user - Today at 11:58:59 AMhave you converted to the new firewall rules and shared nat addressing? if not I would try that
opnsense has a tool, backup your configuration, run the export. import and then reset states and see if its fixed
opnsense has a tool, backup your configuration, run the export. import and then reset states and see if its fixed
#2
26.7 Series / Re: Bug: Static route ignored ...
Last post by Patrick M. Hausen - Today at 11:56:46 AMWhy don't you add that network to the AllowedIPs of your WG peer? WG will set up the route for you, then.
#3
General Discussion / Re: OPNsense 26.7.2_2: TLS err...
Last post by meyergru - Today at 11:49:48 AMNo problem here, neither with opening the site in Edge nor with the given command - it returns 200.
So that is not an OpnSense problem. I would rather suspect a geoip issue, because Youtube has distributed servers. You may have hit a defective one.
So that is not an OpnSense problem. I would rather suspect a geoip issue, because Youtube has distributed servers. You may have hit a defective one.
#4
Zenarmor (Sensei) / Re: How to block Firefox VPN
Last post by Seimus - Today at 11:19:38 AMIt's honestly a bother because the Custom apps allowed more granular block or allow for stuff ZA didn't recognized such as DTLS, which is currently categorized as QUIC.
The feature is broken close for a year. I hope it will be fixed...
Regards,
S.
The feature is broken close for a year. I hope it will be fixed...
Regards,
S.
#5
General Discussion / OPNsense 26.7.2_2: TLS error w...
Last post by S1ardust - Today at 10:47:26 AMHello,
I am new to OPNsense and I'm experiencing a strange HTTPS/TLS issue. (Version: 26.7.2_2)
On my Windows 11 Client behind OPNsense, I was missing thumbnails on the YouTube website.
When I try to open the URL "https://i.ytimg.com/vi/FLH1aARTpMg/hq720.jpg" i get the error "ERR_SSL_PROTOCOL_ERROR" in Edge-Browser:
You cannot view this attachment.
After a lot of troubleshooting, with some help from ChatGPT, I was able to reproduce the issue directly from the OPNsense shell.
Most HTTPS traffic works normally. For example:
returns:
200
However, connecting to the YouTube image server directly from OPNsense fails:
results in:
curl: (35) TLS connect error:
error:0A00010B:SSL routines::wrong version number
000
DNS resolution works correctly, and the same i.ytimg.com IP is reachable. The URL also works normally when the client connects directly through the router instead of OPNsense.
Has anyone seen a similar TLS issue with OPNsense 26.7.x / FreeBSD 15.x?
Any hints on where to investigate further would be greatly appreciated.
EDIT: No Plug-Ins, No relevant Firewall rules, fresh Install
Thank you very much for your support!
I am new to OPNsense and I'm experiencing a strange HTTPS/TLS issue. (Version: 26.7.2_2)
On my Windows 11 Client behind OPNsense, I was missing thumbnails on the YouTube website.
When I try to open the URL "https://i.ytimg.com/vi/FLH1aARTpMg/hq720.jpg" i get the error "ERR_SSL_PROTOCOL_ERROR" in Edge-Browser:
You cannot view this attachment.
After a lot of troubleshooting, with some help from ChatGPT, I was able to reproduce the issue directly from the OPNsense shell.
Most HTTPS traffic works normally. For example:
Code Select
curl -4 -sS -o /dev/null -w '%{http_code}\n' \
https://www.google.com
returns:
200
However, connecting to the YouTube image server directly from OPNsense fails:
Code Select
curl -4 -sS -o /dev/null -w '%{http_code}\n' \
https://i.ytimg.com/vi/FLH1aARTpMg/hq720.jpg
results in:
curl: (35) TLS connect error:
error:0A00010B:SSL routines::wrong version number
000
DNS resolution works correctly, and the same i.ytimg.com IP is reachable. The URL also works normally when the client connects directly through the router instead of OPNsense.
Has anyone seen a similar TLS issue with OPNsense 26.7.x / FreeBSD 15.x?
Any hints on where to investigate further would be greatly appreciated.
EDIT: No Plug-Ins, No relevant Firewall rules, fresh Install
Thank you very much for your support!
#6
German - Deutsch / Two Factor Authentication (2FA...
Last post by jd7 - Today at 10:37:01 AMHallo zusammen,
ich nutze OPNsense schon seit einigen Jahren und schätze die integrierte 2FA sehr. Allerdings empfinde ich das Anfügen des OTP-Tokens an das Passwortfeld in der Praxis als etwas umständlich.
Ich habe mir daher Gedanken über ein zusätzliches, eigenes Eingabefeld für den 2FA-Code auf der Login-Seite gemacht.
Damit das Ganze Hand und Fuß hat, habe ich dafür eine Sicherheits- und Risikoanalyse (TARA) durchgeführt. Der Vorteil einer solchen systematischen Überprüfung ist, dass dabei nicht nur das neue UI-Feld betrachtet wird, sondern auch direkte Sicherheitsgewinne für die gesamte Log-in-Logik abfallen:
* Schutz vor Timing-Angriffen: Die Antwortzeiten verraten nicht mehr, ob ein Benutzer existiert oder ob 2FA aktiv ist.
* DDoS-Schutz fürs WebUI: Blockaden (Rate Limiting) greifen, bevor rechenintensive Passwort-Prüfungen das System belasten.
* Keine Token-Wiederverwendung: Bereits genutzte OTP-Codes werden sofort für die weitere Verwendung gesperrt.
* Saubere Log-Einträge & Absicherung: Besserer Schutz gegen Log-Fälschungen und fehlerhafte Fehleingaben.
Im Anhang findet ihr die TARA-Analyse sowie einen beispielhaften PHP-Code-Prototypen.
Wie seht ihr das? Wäre ein separates Feld inkl. dieser Backend-Anpassungen aus eurer Sicht ein Mehrwert oder eher unnötiger Aufwand für die Entwicklung?
Ich freue mich auf euer Feedback!
Viele Grüße
jd
ich nutze OPNsense schon seit einigen Jahren und schätze die integrierte 2FA sehr. Allerdings empfinde ich das Anfügen des OTP-Tokens an das Passwortfeld in der Praxis als etwas umständlich.
Ich habe mir daher Gedanken über ein zusätzliches, eigenes Eingabefeld für den 2FA-Code auf der Login-Seite gemacht.
Damit das Ganze Hand und Fuß hat, habe ich dafür eine Sicherheits- und Risikoanalyse (TARA) durchgeführt. Der Vorteil einer solchen systematischen Überprüfung ist, dass dabei nicht nur das neue UI-Feld betrachtet wird, sondern auch direkte Sicherheitsgewinne für die gesamte Log-in-Logik abfallen:
* Schutz vor Timing-Angriffen: Die Antwortzeiten verraten nicht mehr, ob ein Benutzer existiert oder ob 2FA aktiv ist.
* DDoS-Schutz fürs WebUI: Blockaden (Rate Limiting) greifen, bevor rechenintensive Passwort-Prüfungen das System belasten.
* Keine Token-Wiederverwendung: Bereits genutzte OTP-Codes werden sofort für die weitere Verwendung gesperrt.
* Saubere Log-Einträge & Absicherung: Besserer Schutz gegen Log-Fälschungen und fehlerhafte Fehleingaben.
Im Anhang findet ihr die TARA-Analyse sowie einen beispielhaften PHP-Code-Prototypen.
Wie seht ihr das? Wäre ein separates Feld inkl. dieser Backend-Anpassungen aus eurer Sicht ein Mehrwert oder eher unnötiger Aufwand für die Entwicklung?
Ich freue mich auf euer Feedback!
Viele Grüße
jd
#7
26.7 Series / Re: Wireguard Gateways online ...
Last post by dseven - Today at 10:32:06 AMThere was a gateway issue fixed in 26.7.1_1. I don't remember if the upgrade from 26.1 to 26.7 takes you straight to the latest update (now 26.7.2_2), but check that you are up to date...
#8
26.7 Series / Bug: Static route ignored afte...
Last post by wind9643 - Today at 10:30:55 AMI'm using a static route to a remote network through a wireguard tunnel, and since I migrated to 26.7, it does not survive a reboot.
The entry is still there but I have to manually click on "Apply" ever time after boot for it to work.
I migrated from 25.7 and everything was fine then.
The entry is still there but I have to manually click on "Apply" ever time after boot for it to work.
I migrated from 25.7 and everything was fine then.
#9
26.7 Series / Re: Migrating for ISC DHCPd to...
Last post by Stormscape - Today at 10:13:19 AMdnsmasq makes more sense for home setups. Just make sure to configure it as a forward resolver for whatever your local domain is in Unbound, or you'll be very confused as to why local name resolution doesn't work.
#10
Web Proxy Filtering and Caching / Nginx and opnsense.domain "Ser...
Last post by danman - Today at 03:08:11 AMHey
I'm currently setting up opnsense with nginx.
I've already set up ACME which works fine and now I'm trying to use opnsense.domain instead of 192.168.20.1:10443.
Which means I changed GUI port to 10443 and disabled web gui redirect. I deleted LAN and created a bunch of VLANs and 192.168.20.1 is one of it.
I created an upstream server (not mentioned options means defaults):
upstream
Location
HTTP Server
The error is:
I didin't do anything with Naxsi if it is related to that?
Hope someone can push me to the right direction.
I'm currently setting up opnsense with nginx.
I've already set up ACME which works fine and now I'm trying to use opnsense.domain instead of 192.168.20.1:10443.
Which means I changed GUI port to 10443 and disabled web gui redirect. I deleted LAN and created a bunch of VLANs and 192.168.20.1 is one of it.
I created an upstream server (not mentioned options means defaults):
Code Select
Description opnsense.domain
Server 192.168.20.1
Port 10443
Server Priority 1
upstream
Code Select
Description opnsense.domain
Server Entries opnsense.domain
Enable TLS (HTTPS) enabled
Location
Code Select
Description opnsense.domain
URL Pattern /
Upstream Servers opnsense.domain
Force HTTPS enabled
HTTP Server
Code Select
HTTP Listen Address 80
HTTPS Listen Address 443
Server Name opnsense.domain
Locations opnsense.domain
TLS Certificate opnsense.domain (ACME Client)
HTTPS Only enabled
The error is:
Code Select
Server Error
Sorry, but something went wrong on our side.
There is nothing you can do except waiting until we fix the issue.
Web Application Protection by OPNsense
OPNsense Logo I didin't do anything with Naxsi if it is related to that?
Hope someone can push me to the right direction.
