Recent posts

#1

26.7 Series / Re: HA-Sync stopped working in...

Last post by krawum - Today at 03:39:57 PM

Thank you so much for fixing it so quickly!
Actually, the firewall is set to "Development"... It's our sandbox/test cluster — who knows which colleague was messing around with it...

@nero355: Sorry, looks like I'm just more of a linux dude... ;-)

#2

26.7 Series / Re: Port forwarding settings u...

Last post by franco - Today at 03:34:24 PM

To be frank the main change was to release the old "associated" rules into the manual scope and replace them with a pluggable rule using "register" which neatly follows the destination NAT rule always and can be updated by the system in the future.

Manual makes sense also, especially if you have a wider range of forwards that you want to handle with a single firewall pass rule instead.

Like always: it depends.  ;)


Cheers,
Franco

#3

Announcements / OPNsense 26.7.7 released

Last post by franco - Today at 03:19:19 PM

Here we go again...

This release is mainly for the brave Hyper-V users who fought kernel panics
since 26.7, which got fixed in 26.7.6 only to cause segmentation faults for
others.  Thanks all for testing and correcting the problem in FreeBSD!

The other reason are fixes in the new interfaces settings API so that it
more closely matches the behaviour of the legacy page.

Both the iPerf and the FRR plugin have been reworked substantially.  In case
of FRR please read the migration notes linked below before updating.

Here are the full patch notes:

o interfaces: add missing validation for "configurable" and "spoofmac" in new settings API
o interfaces: only store "dhcp6_norequest_dns" in DHCPv6 mode in new settings API
o interfaces: only store "track6-interface" in ID association / Track interface modes in new settings API
o interfaces: do not render "none" to configuration in new settings API
o interfaces: move promiscuous mode to advanced in new settings API
o interfaces: fix index into $todo for proper flag check during apply in new settings API
o interfaces: provide better option group labels to DeviceField
o interfaces: add proper local/remote IP support to PPPoE IPCP
o interfaces: move legacy apply cache to /var/lib/php/tmp
o firewall: destination NAT: fix typo in parseRdrRules() causing faulty rules not being disabled
o firewall: aliases: validate that port aliases always have content
o firewall: revert a clone rule change so that cloned rules to appear adjacent to the original rule again
o mvc: UidField: add isolated updateValue() for installer user
o ui: bootgrid: sync columnselect-input state with (un)setColumns
o ui: sync expanded state for selected submenus
o ui: close mobile menu when a menu entry opens another tab of the current page (contributed by Greelan)
o plugins: os-ddclient 1.33[1]
o plugins: os-frr 2.0[2]
o plugins: os-iperf 2.0[3]
o src: pf: send syncookies from the receiving thread
o src: hyperv: fix two regressions in previous upstream patch
o src: pcib: only apply ARI translation to the own secondary bus of a bridge
o src: ktls CBC decrypt: avoid creating zero length iovec entries
o src: route/fib_algo: respect immediate_sync in fd_ref_nhop
o src: route/fib_algo: fix FIB_ALGO without ROUTE_MPATH option
o src: sysctl: retire SYSCTL_NODE_CHILDREN()


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/26.7/dns/ddclient/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/26.7/net/frr/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/26.7/benchmarks/iperf/pkg-descr

#4

26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...

Last post by Patrick M. Hausen - Today at 03:18:49 PM

My printer has a static address, a DNS entry, and is managed via SNMP. 🙂

#5

26.7 Series / Re: HA-Sync stopped working in...

Last post by nero355 - Today at 03:04:23 PM

Code Select Expand

pkg install nano

You don't need nano because FreeBSD has edit a.k.a. ee by default and it's pretty much the same thing, maybe even easier than nano for some ;)

#6

26.7 Series / Re: Port forwarding settings u...

Last post by nero355 - Today at 02:59:34 PM

I'm not sure where I got the following impression from, but my understanding of current NAT/Rule linkage is, choosing 'firewall rule' creates a rule for you but the association is not maintained (where it may have been before the overhaul). i.e. now, if you edit the port forward, the generated firewall rule does not get modified. I haven't tested this assumption as I tended to maintain firewall rules, even those associated with NAT, manually.

IIRC you could be right, because there were some changes to that "logic" this year.

But as you can read @ https://docs.opnsense.org/ these days :
You are pretty much meant to create both NAT and Firewall Rules MANUALLY from now on to avoid any kind of misunderstandings/issues in the future !!

#7

26.7 Series / Re: HA-Sync stopped working in...

Last post by tuto2 - Today at 02:54:21 PM

Should be fixed with https://github.com/opnsense/core/commit/00afadefce308c2a701ad2c9d5baeacec668c136

# opnsense-patch 00afade

#8

26.7 Series / Re: how to recover using an ol...

Last post by nero355 - Today at 02:54:14 PM

It sucks that we can't automatically store the config on an ftp server or send it by email at least once daily when it has been changed.  If that were possible I would have set that up and I'd have the current config now.

Wrong statement: There are several plugins that provide configuration backup service. I personally use 'os-sftp-backup' and works perfectly. You even have 'os-git-backup', so you can trace every single modification in a git server.

[TL:DR] Do no blame others for your own lazyness/lack of knowledge.

Apart from that, you should always make a backup before any upgrade, so your last config would be on the last-1 version. Plus you should also take a snapshot, assuming your system uses zfs, which it's the recommended.

Make a backup before and after you make important changes. It can also help to find which change was wrong by just making a 'diff' between them.
Gonna play with firewall rules? Have a backup before just in case you even get to lose connectivity with the machine. It will take almost no time to go back.

If you follow those well-known basic advices, you won't have any problem recovering from even the total disaster. Of course, everyone is free to not make regular backups, snapshots before upgrades, or any prevention measure at all, but must be conscious of the risk it implies and don't cry if/when sh*it hits the fan.

Last but not least, being polite with the people usually gets best results when asking for help.

AMEN! :)

It's soo easy to Export all sorts of Configuration Backups in OPNsense these days that it's a real shame not to use them!

- Configuration itself : config.xml
- Static DHCP Mappings : .CSV file
- Firewall Rules : .CSV file
- NAT Rules : .CSV file

Just to name a couple of big ones :)

#9

26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...

Last post by nero355 - Today at 02:49:54 PM

I don't want dynamic DHCP clients polluting my carefully maintained DNS zone.

Why would I want "Paddys-Macbook-Pro" in my DNS?

Because in your case you run AdGuard and want to see all Clients listed there and what they are up to ?!

I do the same with Pi-Hole and check for weird traffic from time to time :)

It's also easier when you need to Whitelist some domain for someone : Click on the Client's Hostname and start troubleshooting!

It lets me reach laptops, VMs, phones and IoT devices by name without maintaining a static DNS entry for every temporary client.

I actually do maintain Local DNS Records in Pi-Hole that match Static DHCP Mappings based on the MAC Address in KEA in OPNsense.

Being able to resolve client hostnames is also useful for SSH, SMB, printing, Home Assistant integrations, remote access, and quickly reaching a VM or laptop without looking up its current IP.

My favorite is reaching the Printer's webGUI to check errors and statistics :)

Both approaches are valid.

Ofcourse!


IMHO your first post could be easily added to the OPNsense Documentation or perhaps you could put it online somewhere like GitHUB ?
It would be easy to point people to when they ask what to use or maybe still need to migrate from ISC to one of them!

#10

26.7 Series / Re: HA-Sync stopped working in...

Last post by tuto2 - Today at 02:43:13 PM

Hi,

Thanks for the report. FWIW it's likely this is only reproducible when the deployment type is set to "development" in System -> Settings -> Administration, otherwise these warnings should be silenced.