Recent posts

Pages1 2 3 ... 10
#1
26.7 Series / VLANs on bridges in 26.7 — cor...
Last post by endric9 - Today at 07:44:11 PM
Hi all,

I just upgraded to 26.7 and noticed the new "VLANs on bridges" support in the changelog. I'd like to use it but I'm not sure about the intended configuration workflow.

My setup is fairly simple: a bridge interface (bridge0) with two physical ports as members, and I want to run a couple of tagged VLANs on top of that bridge.

A few questions:

Should the VLAN interface be created with the bridge (bridge0) as its parent, or does it need to be assigned differently now?
Is there a required order — e.g. create the bridge first, then the VLANs, then assign — or does the order not matter after this change?
Are there any known caveats with hardware VLAN filtering / offloading that I should disable on the member NICs?

I couldn't find much in the docs yet, so any pointers or a working example config would be appreciated. Thanks!
Sincerely, harucash
#2
26.7 Series / Re: os-upnp plugin not working...
Last post by BondiBlueBalls - Today at 07:31:47 PM
Here's my current working UPnP setup for comparison. In my case, Games is the VLAN/interface where my PS5 lives, and 10.251.4.20 is the PS5's static/reserved IP, so obviously substitute your own interface, subnet, and device IP as needed.

UPnP settings

UPnP IGD and PCP/NAT-PMP are both enabled. WAN is the external interface and Games is the only internal interface.

I'm using:

Code Select
UPnP IGD compatibility: IGDv1 (IPv4 only)
Allow third-party mapping: Disabled
Disable IPv6 mapping: Enabled

The other advanced options are left at their defaults.

Access Control List

I have Default deny enabled with a single ACL entry allowing only the PS5:

Code Select
allow 1024-65535 10.251.4.20/32 1024-65535

Firewall rule

On the Games interface, I have a TCP/UDP rule allowing:

Code Select
Source:      Games net
Destination: Games address
Port:        upnp_ports

The upnp_ports alias is a Port(s) alias containing:

Code Select
1900
2189
5351

That firewall rule is above my RFC1918 block rule so clients on the Games network can actually reach the UPnP daemon.

Outbound NAT

I'm using Hybrid outbound NAT with a manual WAN rule for the Games network:

Code Select
Interface:   WAN
Source:      Games net
Destination: any
NAT address: Interface address
Static Port: YES

The Proton VPN rule shown in the screenshot is unrelated to UPnP, as are the automatically generated rules below it.

With this setup, UPnP mappings are working correctly for me. Yes, I'm seeing "NAT type: Open" in MW3.
#3
26.7 Series / State limits and the virusprot...
Last post by Jimbo218297 - Today at 07:12:47 PM
I noticed that you can create state limits using the virusprot alias in firewall rules to help prevent against potential abuse or attacks but I'm a bit confused about the set up process.

In the advanced setting on firewall rules I'm assuming you enter the maximum source connections then below that you set the virusprot alias as the overload table option. But I've noticed that all my IP type aliases are also listed as options for the overload table?

What I'm confused about is what the virusprot alias actually is? It's listed as dynamic when viewed with the list of aliases I've created myself.

Also what would happen if I put an IP type alias I've created as an option for the overload table when creating a state limit? Would it limit maximum states only for those source networks/IPs?

I see there is also an automatically generated rate limit rule that is created when the checkbox 'Disable rate limit rule' is unchecked (default) which also uses the virusprot alias as the source address.

Thanks in advance for any help as I'm by no means an expert. I've recently moved from pfSense and it's great to be able to support the project directly so I've been donating €10/month to show my appreciation.
#4
26.7 Series / Re: Lenovo M720q randomly hang...
Last post by userunkn4wn - Today at 06:44:02 PM
Yes, a display emulator would be a relatively easy but not a really satisfying fix, but yeah, I will consider this when I run out of options.
#5
German - Deutsch / Re: IPU662 defekt - Hilfe benö...
Last post by Snoopy - Today at 06:19:24 PM
Nein hat es nicht.
Ich habe mir jetzt mal bei Amazon nen RAM und die SSD bestellt und werde damit testen.
#6
German - Deutsch / Re: IPU662 defekt - Hilfe benö...
Last post by Patrick M. Hausen - Today at 06:16:40 PM
Hat das Board einen Anschluss für einen Lausprecher? Die meisten BIOSe signalisieren defektes/fehlendes RAM durch Töne.
#7
26.7 Series / Re: 26.7 plug-in AdGuardhome n...
Last post by Patrick M. Hausen - Today at 06:15:32 PM
Uninstall the microcode update plugin before upgrading. Reinstall when on the latest 26.7.x.
#8
26.7 Series / After upgrade to 26.7.3_8 adva...
Last post by hajdusz - Today at 05:00:06 PM
I just upgraded to 26.7.3_8 I have some port-forward NAT rules to two computers behind the firewall the RDP port is open on one of them before the upgrade I had the option  Max new connections [c] set to 1 Max new connections set to 30 and the Overload table to virusport and that worked well the bots got locked out. After the upgrade I noticed in Live view that the port is flooded with bots same IP address multiple times the connection limit is not working? Someone in the same situation maybe? Something changed in the advanced firewall rule options?
#9
26.7 Series / Re: Lenovo M720q randomly hang...
Last post by MoonbeamFrame - Today at 04:35:13 PM
Not quite your problem, but I've had some Linux servers/clients where not having a monitor connected caused issues.

I resolved them but using a display emulator plugged into a video port.

e.g. DisplayPort display emulator/EDID emulator Plug


#10
Virtual private networks / Re: wireguard assignment with ...
Last post by pawalan - Today at 03:35:19 PM
I encountered the same issue but deleting/re-adding the wgX assignment didn't solve it for me.

In my case, it turned out there was a
Code Select
<dhcpd>...</dhcpd> section in the
Code Select
/conf/config.xml file that contained a legacy ISC-DHCPD configuration from waaaay back when I used that - despite having migrated to Kea DHCP already ages ago. It seems OPNsense does not delete configuration for services/tools that are being disabled/uninstalled - maybe that's for a restore scenario where you re-install/re-enable that service... who knows.

Root cause for the error message:

Back in the days when I used ISC-DHCPD, one of my networks was configured on the
Code Select
opt4 identifier, which later got freed up by a network redesign and then got re-used when I set up Wireguard.

It appears that when attempting to enable the new Wireguard interface, OPNsense still evaluated the old ISC-DHCPD configuration for the
Code Select
opt4 identifier - which (obviously) had DHCP enabled and therefore threw the error:

Code Select
The following input errors were detected:

The DHCP Server is active on this interface and it can be used only with a static IP configuration. Please disable the DHCP Server service on this interface first, then change the interface configuration.
The solution was to SSH into the OPNsense box, manually edit
Code Select
/conf/config.xml and remove the
Code Select
<opt4>...</opt4> section that was nested inside the
Code Select
<dhcpd>...</dhcpd> section of the XML code.

With this fix in place, I was able to enable the Wireguard interface.
Pages1 2 3 ... 10