Recent posts

#1

26.7 Series / Re: VLAN devices are on LAN IP...

Last post by dseven - Today at 03:51:35 PM

So... damned if you do, damned if you don't 🤣🤣

#2

26.1, 26,4 Series / Re: IPv6 breaks after a while ...

Last post by DWM89 - Today at 03:37:49 PM

I dug deep into many sources, many attempts to configure my opnsense, completely reinstalling it, running it directly from installer medium and so on.

My findings:
1) the unwanted address seems to be the vodafone kabel net that seems to be configured automatically via slaac (that i cannot deactivate since freebsd kernel apparently auto-accepts slaac RAs on interfaces)
2) the reason why i have ipv6 working in the beginning and after a while it stops could be that the docsis modem potentially ignores the prefix delegation lease request. since it is not extended it just silently expires and i have not working ipv6 anymore eventhough i still have this "seemingly valid" slaac configured provider address.

I even managed to completely reset my opnsese to factory and the v6 seemed to work at first...but after i made enough changes to have the config i used to have (multiple wireguard instances, a couple of outboud nat rules in hybrid outbound nat setup, dnsmasq deactivated, kea configured to serve dhcpv6 based on interface v6 subnet, RAs configured to WAN: router only, LAN: assisted, at some point i loose the ipv6 connectivity. PLUS my static gateway for one of my wireguard interfaces and respective firewall rule stopped routing traffic from 1 client (1 internal host that should only use the wireguard tunnel for all outbound traffic) through the wireguard but instead route it through wan even though i configured it correctly as before (i even tried the whole thing with ablank firewall and then import the old firewall configuration i previously exported to csv)

my current other problem (even on 25.7.11_9) is, that since i get these two provider IPs , my LAN network works with ipv6, but my opnsense cant communicate with ipv6 outside my own networks since it defaults to use the wrong ipv6 interface address (the x:8101:... address) instead fo the correct one.
i know, i could use nat66 to pin all outbound traffic from my opnsense itself to use the correct IPv6 address, but somehow that breaks as well after a while (i guess, when the lease expires)

things i still haven'T tried:
deactivate slaac on WAN/the whole system all together (i dont want to deactivate it completely, but maybe only for wan?) in tunables. maybe someone could give me some advice whether i should trie that as well?

best regards

#3

26.7 Series / Re: No Web_GUI if LAN is DHCP ...

Last post by nero355 - Today at 03:27:10 PM

But still, it should also work with a DHCP address on that interface.

IMHO that should always be a Backup Configuration and not the Primary Configuration.

However since we are talking about a Router here then there is only the Primary Configuration.

The Backup Configuration can be the Serial Console or some kind of IPMI/iDRAC/iLO-like solution...

#4

26.7 Series / Re: VLAN devices are on LAN IP...

Last post by nero355 - Today at 03:23:35 PM

You also can do "all tagged" on Unifi APs and switches as well, but the default is that they normally expect their management VLAN to be untagged, so adopting a new one in an otherwise "all tagged" network setup would require a special "adoption port" on the switch and after adoption, you would have to move the AP.

Using TAGGED for Management Network purposes in combination with Ubiquiti UniFi products IMHO falls in this category too :

and accept that you'll burn in hell for it

LOL! :P

[opnsense (port 1 - igc1 VLANs) -> switch (port 5 only TAGGED) -> openwrt (wan port TAGGED and untagged)]

#5

26.7 Series / Re: Multiple VLANs - sometimes...

Last post by nero355 - Today at 03:12:36 PM

Exactly that -> `Setting the correct Management IP Address for the webGUI of the Switch?`

OK, then you need to do this :

However... in some cases... you need to also add one Untagged VLAN in order to have a Management IP Address for Switches and Accesspoints and this subnet comes from a seperate Untagged NIC in the case of OPNsense as I was trying to explain to your earlier on !!

There are two ways it can be done :

1. When a Switch like let's say most CISCO and HPE models supports TAGGED VLAN traffic for it's Management IP Address then things can stay the way they currently are and you just configure that on the Switch and you are DONE!

2. When you are dealing with more Consumer oriented Switches like the TP-105GE/108GE models you can probably only use an UNTAGGED connection to reach it's webGUI so in case of OPNsense you need this setup :
- Pick one NIC on your OPNsense that will ONLY be used for the Interface that carries the Management Network.
- Configure the subnet settings you are currently using for VLAN 25.
- Connect this NIC to a Switch Port that has UNTAGGED VLAN 1.
- Since the webGUI of the Switch uses VLAN 1 it should be reachable now.
The Switch should also be able to use it's Static IP Address to connect to the Internet via OPNsense and also receive a DHCP IP Address should it lose it's Static IP Address for whatever reason.
- If you have more devices that need this "VLAN 25 Subnet" then you can get it to them via both UNTAGGED and TAGGED Switch Port configurations depending on what those devices like to use but the subnet lives now in VLAN 1 so you will have to use that instead of VLAN 25 :)

I dont understand. So do you mean other ports on the opnsense device should be used only for different switches/APs?

- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration.

Are you talking particular about that?

No, this is all because of the whole "Don't mix UNTAGGED and TAGGED on a Single FreeBSD NIC Interface" issue so you have to work your way around it by using 1 Switch Port for UNTAGGED Management Network Traffic and 1 Switch Port for TAGGED VLAN Networks Traffic ;)

I just wanted to mentioned that the tagged from opnsense (port 1 - igc1 VLANs) -> switch (port 5 only TAGGED) -> openwrt (wan port TAGGED and untagged) works so far.

NICE! :)

Well, I thought PVID takes care to tell opnsense that this switch would like to go with VLAN 25 but this seems to be not the case so I think the only option is to use a static IP address.

It's a matter of the device you are connect to your network :
- Whole NIC configured with an IP Address = UNTAGGED Interface Port.
- NIC activated, but without any IP Address and just used to assign VLAN Interfaces to it = TAGGED VLANs Interface Port.

I've also a few proxmox server and other switches etc I'll see how that will work.
I think on proxmox for example I had to set up IPv4/CIDR which should take care of that.

The Switches configuration depends on what they like as mentioned above.

Proxmox simply needs it's Bridge Interface (vmbr0 for example) to be 'VLAN Aware' and then you can do whatever you like on the VM and LXC side of the setup :)

Maybe, I was just lucky before that the switches took the right VLAN in the first place :D I'm not so familiar with VLAN, I'm not setting it up every day or even years. Once its done, its done ;)

I think it's simply because OpenWRT = Linux based => You are allowed to mix UNTAGGED and TAGGED traffic on the same NIC.

I think it's more my way of thinking about all that especially the PVID is probably the key issue in my brain here :D

To be honest :

The whole 'Create a VLAN Interface and then assign it to a NIC' is indeed a bit weird!

It would be a lot more logical if you could pick the NIC you want to add a VLAN  Interface to while creating the VLAN Interface instead of doing it afterwards...

That's after all what you do in something like let's say /etc/network/interfaces in Debian :
- Scroll to the NIC you want add a VLAN Interface to.
- Add the configuration lines under that section of the config file.

Imagine having to create a VLANinterface0.conf
And then go back to /etc/network/interfaces and tell the OS about it...

#WEIRD!!! :P

Ohh... wait... this all looks a bit too familiar : It's a bit what SystemD uses when configuring the network via the damn thing! LOL! ^_^

#6

French - Français / Un cabinet d'expertise comptab...

Last post by LucienRainer - Today at 02:55:44 PM

Salut tout le monde,

Je travaille en freelance pour quelques petites structures, et y'a environ trois semaines j'ai eu une mission un peu inattendue dans un cabinet d'expertise comptable à la périphérie de Lyon. Ils ont voulu reprendre la main sur leur infra réseau suite à un incident avec leur ancien prestataire (données qui transitaient n'importe comment, règles de firewall quasiment inexistantes). Le responsable m'a sorti qu'il voulait passer sur OPNsense pour centraliser la gestion des flux et cloisonner les postes comptables du reste du réseau. Honnêtement j'étais surpris, c'est pas le type de structure qu'on imagine derrière un firewall open source.
Ma question c'est surtout sur le cloisonnement VLAN dans ce genre de contexte : est-ce que vous monteriez des VLANs dédiés par type de poste (compta, accueil, serveur de fichiers) ou vous préférez une approche plus simple avec juste des règles strictes sur une seule interface ? Curieux d'avoir vos retours là-dessus.

#7

26.7 Series / Re: Upgrade to 26.7 from 26.1....

Last post by nero355 - Today at 02:36:15 PM

I did fresh install of 26.7.1 & reloaded backup config file.
This was less hassle than spending more time on borked upgrade.

OK, but could you post the exact RealTek NIC models then and which driver you are using for them ?

For others who might find this topic via the Forum Search or a random Search Engine and stuff... ;)

#8

26.1, 26,4 Series / Re: SERVFAIL when domain has ...

Last post by nero355 - Today at 02:32:44 PM

My problem is that a website used by a Windows laptop and a Windows desktop references a domain name – dms.xxxxxx.com - generates a SERVFAIL because:

1) "all servers for this domain failed, at zone up.railway.app at [a valid IPv6 address] no server to query nameserver addresses not useable"; and per Services : Unbound DNS : Log File -

2) there is no public DNS records for the domain name – dms.xxxxxx.com – available per DNSchecker's "DNS Lookup" service (all worldwide authoritive servers including ICANN's agree on this).

Domains involved have been placed on the Services : Unbound DNS : Blocklists : Allowlist Domains to no effect.

When the Windows desktop bypasses OPNsense by directly by a dedicated use one of the AT&T Fiber's modem/firewall ports, the SERVFAIL does not occur!

What happens when you grab one of your working and not working Clients and use :
- nslookup
- tracert
In combination with the domain ?!

The same for when connected to the ISP supplied Router and then OPNsense and eventually compare all the different outputs ?

#9

General Discussion / Re: Captive Portal Not Working

Last post by somanet - Today at 02:30:24 PM

Yes have seen where the error is it doesn't auto populate this link https://192.168.1.1:8000 on the browser. You have to type it manually
and enter username and password

#10

Virtual private networks / Re: IPSEC VPN Traffic being al...

Last post by n2so - Today at 01:29:10 PM

Hello guys,

I was wondering if any of you were ever able to find a solution or identify the root cause of this issue.

I am seeing very similar behavior, where the same IPsec traffic appears to be both passed and blocked by the same firewall rule, and I haven't been able to determine why. If anyone figured out what was causing it or found a workaround, I'd really appreciate hearing about it.

Thanks!