Recent posts

#1

26.1, 26,4 Series / Problem with IPv6 traffic sinc...

Last post by odites999 - Today at 06:30:19 PM

After trying many things due to the TLS handshake error I mentioned in another post, the only way I could get Opnsense working normally was by disabling IPv6.

I replicated the same configuration (VLANs, PPPoE, IPv6 over PPPoE) on another virtual machine on the same host but with OpenWrt, and everything works fine: IPv4 and IPv6 traffic, and test-ipv6.com (it recognizes my provider correctly and passes the test with a perfect score of 10/10). Therefore, I understand that something caused IPv6 to stop working with my configuration during the upgrade from version 26.1.5 to version 26.1.6. Is there a way to revert to a previous version by downgrading the version packages if necessary to try and pinpoint the problem?

Thanks in advance.

#2

26.1, 26,4 Series / Old Rules --> New rules

Last post by Jimmy007 - Today at 06:19:07 PM

Greetings - Now we have the "new" rules menu, is there a way to remove the "old" rules menu? I apologise if this has not been asked already.

#3

General Discussion / Re: 2nd LAN Port has no Intern...

Last post by kc9joy - Today at 06:07:06 PM

I went back through my firewall and interfaces and rebuilt the ports.  I now have been able to get the internet to work.  Thanks for the help

#4

26.1, 26,4 Series / Re: 26.1.6_2 - All traffic blo...

Last post by troplin - Today at 05:40:29 PM

I'm not yet familiar with the new rules, but http/https as source port seems wrong to me. Shouldn't that be ,,*"?

#5

General Discussion / stop my ISP from eves dropping...

Last post by robertkwild - Today at 05:27:37 PM

Hi all,

what other steps can i take to stop my ISP eves dropping on me and seeing what im doing, i have enabled DoT, what else is there to enable to make my connections secure so they cant see what im doing apart from getting a VPN ?

Thanks,
Rob

#6

German - Deutsch / Re: Öffentlicher IPv6-Suffix ä...

Last post by psychofaktory - Today at 04:54:34 PM

Die Telekom gibt bei Aktivierung der festen IP-Adresse mehrere IPv6-Subnetze vor.
Einmal "Öffentlich/WAN": Diese wäre hier 2003:xxxx:xx7f:b9ae:0000:0000:0000:0000
Und dann "Kundennetz/LAN): hier 2003:xxxx:xx39:ae00:0000:0000:0000:0000

Bei meiner OPNsense ist seit jeher ein VLAN7 auf dem WAN-Interface (hier igb0) angelegt. Damit verknüpft sind die PPPoE-Einwahldaten.
Die Konfiguration des WAN-Interface sieht dann wie im Screenshot aus:
You cannot view this attachment.


Die IPv6 Adresse des WAN-Inferfaces wird dann automatisch aus der von der Telekom vorgegebenen WAN-Subnetz sowie der MAC-Adresse nach dem EUI-64-Format generiert.
Die LAN-/VLAN-Schnittstellen stehen dann jeweils bei IPv6 auf "Track Interface" mit "WAN" als übergeordnete Schnittstelle. Diesen IPv6-Adressen dieser Schnittstellen werden dann aus der von der Telekom vorgegebenen LAN-Subnetz, einer von mir für jedes Subnetz vorgegebene Präfix-ID, sowie der MAC-Adresse der LAN-Schnittstelle (hier igb1) nach dem EUI-64-Format generiert.

Bei den LAN-Schnittstellen funktioniert das auch wunderbar und die Adressen bleiben gleich.
Nur beim WAN wechselt der aus der MAC-Adresse generierte Anteil immer wieder zwischen der MAC von igb0 und igb1.




Ich habe mir das nun auch nochmal bei anderen Instanzen (alle bei der Deutschen Telekom), und konnte jeweils ein ähnliches Muster erkennen.

OPNsense 2:
WAN-Interface: igb1
EUI-64-Adresse mit MAC von igb0

OPNsense 3 (keine feste IP):
WAN-Interface: igb1_vlan7
EUI-64-Adresse mit MAC von igb0

OPNsense 4 (Business):
WAN-Interface: igb1_vlan7
EUI-64-Adresse mit MAC von igb2

Allerdings kann ich bei diesen Maschinen nicht beurteilen ob die Adresse sich ebenfalls sporadisch ändert.

Welche Logik steckt hier dahinter?

#7

26.1, 26,4 Series / Re: Business Edition pf CVE-20...

Last post by franco - Today at 04:53:27 PM

If the day had 32 hours things would be different but for now we have to settle for a business fix for tomorrow.

This is our usual strategy to start fixing community and then move to business and due to surprise timing coupled with lots of changes in critical areas (OS in particular) it isn't good to not follow the good strategy.


Cheers,
Franco

#8

26.1, 26,4 Series / Re: NetBird Interface breaks b...

Last post by benniekiss - Today at 04:29:21 PM

Try this:

opnsense-patch -a sopex -c plugins cba50f0f5f34aa67b468f3d37ca5ec84234663ca

commit

Thank you!

#9

German - Deutsch / Re: Öffentlicher IPv6-Suffix ä...

Last post by mooh - Today at 04:04:06 PM

Deutsche Telekom usually hands out a static public address for your router plus a prefix. The public address is not from the prefix range. Maybe you can show how exactly the WAN interface is configured?

Upps, falsche Sprache: Die Telekom gibt normalerweise öffentliche Adressen für den Router aus und ein Präfix für. Dies Routeradresse ist nicht aus dem Präfix. Vielleicht zeigst Du mal die geneue Konfiguration des WAN Interface?

[Warning]

#10

26.1, 26,4 Series / Re: 26.1.6_2 - All traffic blo...

Last post by thormir84 - Today at 03:46:29 PM

If you have traffic hitting the "Default deny / state violation rule", this is almost certainly due to not having an active rule to match the action you want.

On my test device, I performed a clean installation using OPNsense-26.1.6-serial-amd64.img. After configuring the system using the Wizard, Kea DDNS is disabled by default. Is yours disabled in Kea?

To see what issues Kea encountered, open Services -> Kea DHCP -> Log File. It will probably open and list events of type Warning. Set the history to show the Last week or Last month. If nothing is presented, select event type Informational or Debug. You should now see events listed. Review these and advise what it was Kea encountered when it fell over.

First post, screenshot called "rules 2.jpg"; the rules are there. The problem, as already mentioned, occurs only under Kea DHCP, while with ISC it does not; if the rules were missing, it would not work at all.