Recent posts

#1

General Discussion / Re: Let'sencrypt with duckdns....

Last post by bookie56 - Today at 05:04:33 PM

Hi Seimus!
Yes, on my PRIVATE_LAN
Ok... nslookup that gives me
Defaulut server which is the host name of my OPNSense and the gateway of the LAN I am on...
I always work from the PRIVATE_LAN and connecting to my firewall



bookie

#2

General Discussion / Re: Let'sencrypt with duckdns....

Last post by Seimus - Today at 04:48:05 PM

You try to connect to it from LAN?
Do a nslookup from the PC you try to connect from, what IP you get for that domain?

Regards,
S.

#3

Tutorials and FAQs / Re: HOWTO - Redirect all DNS R...

Last post by Bob.Dig - Today at 04:47:43 PM

See

Hm, let's see what reputable source you linked too. Wait, you linked to yourself. And it doesn't make any sense.

#4

26.1, 26,4 Series / Re: PHP2Shell security fix for...

Last post by tracker - Today at 04:42:05 PM

I wouldn't have chosen tracker's rather harsh wording either. But I do think he has a point about how people communicate with each other in technical forums.

I REGRET NUTHING!!! (Ok, maybe a regret a little...)

Weilander explained my feelings in the matter in a much more polite way, but the message stands.

We all know that upgrading to the latest version is the best approach, and in theory (an ideal world) is the way to go.

In practical terms, there are factors that are beyond one's ability to apply the theory fully, and THAT is when people ask for help... and they need a solution, a workaround, not sarcasm and someone stating the obvious path that they already know they cannot follow.

This past month has been a nightmare of left-field security issues, botched patches, botched upgrades, botched timezone changes, one after another... and if you work in the industry, it compounds and overwhelms the already stressed.

My apologies for the harsh delivery, but the message stands: Help people if you can, and if you cannot, don't mock, criticize, diminish, or otherwise add to their problem.

I am going back to my cave.

#5

General Discussion / Let'sencrypt with duckdns.org

Last post by bookie56 - Today at 03:15:33 PM

Hi guys!
I have created a subdomain with duckdns.org
I have created an acount...
I have created a challenge type with DNS-01 and used DuckDNS and my api token...
I have created and automation for restart of OPNSense web gui...
I have created a certificate and my common name is my subdomain.duckdns.org I have may alt name is the same.
I have set my ssl certificate in web gui admin the alt name here is the HostnameSubdomain.duckdns.org.
I can ping my Hostname.Subdomain.duckdns.org from pc on network but I cannot login with Hostname.Subdomain.duckdns.org only ip address?
Where do I start to see what is wrong?


bookie56

#6

German - Deutsch / Re: Frage zu Interfaces: Assig...

Last post by viragomann - Today at 03:11:59 PM

Habe aktuell eine Sense die fleißig in Nutzung ist, nebst OpenVpn, aber ich sehe keine unassigned Interfaces

Du meinst, als Device unter "Assign a new interface"?
Da tauchen die Instanzen bei mir ebenfalls auf und ich kann sie zuweisen.

Symptom: " AEAD Decrypt error: bad packet ID (may be a replay)" Also UDP-Pakete die in der falschen Reihenfolge eintrudeln

Soweit ich mich mit diesem Problem beschäftigt habe, dürfte es auf ein Netzwerkproblem auf der Clientseite hindeuten. Verursacht bspw. durch eine lahmes oder überlastetes WLAN.
Habe aber auch gelesen, dass ein MSS-Clamping Abhilfe schaffen könnte. Heißt also, dass es durch zu große Pakete verursacht werden kann.
Möglicherweise helfen die OpenVPN Optionen "TUN device MTU" (bspw. 1400 od. noch kleiner testen), "MSS fix" oder "Fragment size".

Allerdings hatte sich mein "Problem-Client" nach dem ersten Vorschlag nicht mehr gemeldet, so kann ich das nicht bestätigen.

#7

Tutorials and FAQs / Re: HOWTO - Redirect all DNS R...

Last post by nero355 - Today at 02:58:23 PM

to re-direct DNS you use DNAT/SNAT Rules

You don't use SNAT rules.

You do and pretty much every tutorial for whatever Router does from what I have seen :)

See : https://forum.opnsense.org/index.php?topic=9245.msg259581#msg259581

There are also some posts about it in this topic IIRC...

#8

26.7 Series / Re: Invalid argument errors wh...

Last post by nero355 - Today at 02:48:19 PM

You can also try a newer drive database without replacing the installed one:

fetch -o /root/smart_drivedb.h https://raw.githubusercontent.com/smartmontools/smartmontools/main/drivedb/drivedb.h
smartctl -B +/root/smart_drivedb.h -a /dev/ada0

Let us know whether any of the Unknown_Attribute names change.

It's an old SSD model so I am guessing there are no changes coming for those in the future...

smartctl -i /dev/ada0 :

Code Select Expand

Device Model:     MTFDDAT128MAZ-1AE1ZABHA

A good old MLC SSD : NICE! :)

fetch -o /root/smart_drivedb.h https://raw.githubusercontent.com/smartmontools/smartmontools/main/drivedb/drivedb.h
smartctl -B +/root/smart_drivedb.h -a /dev/ada0

I don't think that will change everything considering it's age to be honest...

But this does worry me :

Code Select Expand

SMART Attributes Data Structure revision number: 32
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x002f   100   100   050    Pre-fail  Always       -       12
181 Program_Fail_Cnt_Total  0x0022   100   100   000    Old_age   Always       -       11643680983326
188 Command_Timeout         0x0032   100   100   000    Old_age   Always       -       2794
195 Hardware_ECC_Recovered  0x003a   100   100   000    Old_age   Always       -       3772716375
199 UDMA_CRC_Error_Count    0x0022   100   100   000    Old_age   Always       -       2

Are you sure the SATA Controller of your device is 100% OK ?!

Keep an eye on those numbers please!

And this one :

Code Select Expand

196 Reallocated_Event_Count 0x0032   100   100   000    Old_age   Always       -       16

Can be ignored, because it looks like it's the same default value before any firmware update that the Crucial M500 Series had at the time.
After the first firmware update the value was reset to 0 again so I am guessing the same goes for this Micron SSD.

#9

Tutorials and FAQs / Re: HOWTO - Redirect all DNS R...

Last post by Bob.Dig - Today at 02:48:03 PM

To re-direct DNS you use DNAT/SNAT Rules

You don't use SNAT rules.

#10

Tutorials and FAQs / Re: HOWTO - Redirect all DNS R...

Last post by nero355 - Today at 02:28:32 PM

Is this guide still valid after the "change" to DNSmasq?

Re-directing DNS is re-directing DNS independent of the service used or the location of the service in your network :)

My setup basically is: Only IPv4, and I want to avoid DNS "bleeding".
In my original setup I just used the guide for that, but I used unbound (without dnsmasq) and "the old" DHCP - hence my question.

In the new default setup it's pretty much the same aside from Unbound also asking DNSmasq about your private domain.

But again :
To re-direct DNS you use DNAT/SNAT Rules and those are the most important part of the setup.
Which DNS Service you are re-directing and the location of it is not important.

I don't want to use some "external service" (like pihole), I want my Sense to care for all of that.

Pi-Hole is never external : You always run it yourself on your own network.

It's never some kind of "Cloud Service" as the popular kids call it these days ;)