Recent posts

#1

German - Deutsch / Re: Glasfaser ONT

Last post by k0ns0l3 - Today at 07:34:50 PM

Danke ;))

lg k0ns0l3

#2

Virtual private networks / Re: Need help with routing all...

Last post by BoNetTech - Today at 07:34:25 PM

Hi,

I have not tested this exact setup with IVPN, so these are suggestions for what to check.

1) Find out whether the problem is DNS or routing. From a client on the VLAN, try to reach a public IP address directly, then try a name. If the IP works and the name does not, it is DNS only. If the IP does not work either, the routing or the outbound NAT is the problem.

2) Rule order on the VLAN. If your VLAN has a rule that sends everything through the VPN gateway, it may also send the traffic meant for the firewall itself, such as DNS to the VLAN address, into the tunnel. Put a pass rule above it, without a gateway, that allows the VLAN to reach the firewall address on the DNS port. Then use the tunnel DNS address only for the traffic that really has to go through the VPN.

3) The tunnel DNS address. 172.16.0.1 is inside the tunnel, so it is only reachable if the traffic is routed through the VPN gateway. Check that your peer allows all addresses, and that the gateway for the WireGuard interface is up in System, Gateways.

4) The endpoint name. The firewall resolves the endpoint hostname with its own DNS settings, not through the VLAN. If it fails there, check the DNS servers in System, Settings, General. Using the IP address as the endpoint also works, with the drawback that you have to update it if the provider changes it.

5) To see what really happens, run a packet capture on the WireGuard interface while a client tries to resolve a name. If you see the queries leave and no answers come back, the problem is on the tunnel side; if you see nothing, the traffic is not reaching the tunnel.

Which one is it in your case, the IP test or the name test?

Sergio

#3

26.7 Series / Re: Wireguard vs. DNS resoluti...

Last post by oc - Today at 07:31:55 PM

But while it works it's a quite cool setup

I don't think so.

I agree that it's a bit convoluted, but it does follow various segmentation/filtering best practices (from the logical standpoint). For instance, I can control what reaches the Flint, and what the Flint can reach (except what's flowing through the encrypted tunnels, but that's flowing through different VLANs through opnsensee, so it's contolled at that point). But by having the Flint2 (which is also enabled as a wireguard server) behind the opnsense, I have limited IPs/countries/blacklists that can/not reach it inbound, and that it can/not reach when reaching out. The result - very very clean logs on the Flint.

Notwithstanding that, I'm always open to improve the model(s). What would you recommend/change?

None the less, what happens if you don't monitor the gateway? There is often no point in monitoring it anyway. 

Unfortunately, that won't resolve the issue - I have tried that. Apparently, even with ongoing monitoring disabled, dpinger still looks at the health of the gateway at boot time. So the results have been mixed, whether ongoing monitoring is enabled or disabled. Sometimes some routes are active after a reboot, other times they are not (same routes). It's really quite random. But, as mentioned, I can live with that, as a compromise. But I'd like to get this fixed, as long as it doesn't imply any changes that are likely to be undone at the next (big) opnsense update.

Thanks, and have a good weekend,
OC

#4

German - Deutsch / Re: [Gelöst] Unbound-DNS Erw...

Last post by k0ns0l3 - Today at 07:30:44 PM

Vielen Dank für die ausführliche erklärung :)

lg k0ns0l3

#5

General Discussion / Re: weird issues with network

Last post by curiousgeorge - Today at 07:24:15 PM

I have a 8 core, 16 thread AMD ryzen 5 with 32GB RAM. Of this, 14 threads are assigned to the opnsense along with 28GB of RAM.

Why use Proxmox at all when almost all of it is OPNsense ?!


About your issue itself :
How do you know it's OPNsense and not something else ?!

I can imagine WiFi compatibility issues between the Omada Accesspoints and the car and the new PC you mentioned for example.

Another very easy thing to check is WiFi Channels or complete Accesspoints overlapping because 2.4 GHz is very annoying to tune down :
Even the 4dBi on Ubiquiti UniFi products and 7 dBi with the antenna gain included on TP-Link Omada products is sometimes not low enough !!
I ended up completely disabling it on one Accesspoint to avoid connection issues ;)

Have you tried a different Router instead of OPNsense ?
Did you capture the traffic of the Clients having issues and analyse it in Wireshark ?
You can do that both at your Switches and OPNsense to compare/check different stages of communication.

I'm using proxmox to fully backup the initial install after updates and config restore. It's much easier than reinstall and restore. Since proxmox can't be accessed from anything except a separate NIC which remains disconnected, it's about as safe as a vm host can get.

I can set a port to tee all traffic to a port and connect to that port. Great suggestion.

#6

26.7 Series / Re: [SOLVED] Quectel EC25‑E / ...

Last post by nero355 - Today at 07:16:32 PM

I have decided to use a different approach for WAN2 (4G/LTE failover):
An external LTE router with its own SIM slot, external SMA antenna connectors and an Ethernet WAN/LAN port.
This also avoids the USB power limitations of the mini-PC.

I am curious : Which one did you buy exactly ?

#7

French - Français / Re: Les MAJ vous les faites di...

Last post by OneTimePad - Today at 04:21:20 PM

Ça dépend de la taille de la mise à jour.

Pour les petits correctifs de la série en cours je les lance assez vite. Ils sont courts et souvent ciblés sur la sécurité. Pour un passage de version majeure, laisse passer une ou deux semaines. Il y a presque toujours un correctif qui sort juste après et les retours sur le forum sont utiles.

Dans tous les cas fais une sauvegarde de la config avant (Système, Configuration, Sauvegardes, télécharger). Si ton install est en ZFS, un snapshot de l'environnement de démarrage te permet de revenir en arrière en deux minutes. Lis aussi les notes de version, surtout ce qui change sur le filtrage et les interfaces.

Comme ta box est ton routeur et que ton serveur est publié, lance la mise à jour à un moment où dix minutes de coupure ne gênent personne. Et ne coupe pas l'alimentation pendant que ça tourne, même si ça paraît long.

Antony

#8

French - Français / Bonjour, passage rapide

Last post by OneTimePad - Today at 04:07:13 PM

Bonjour à tous.
Antony, 29 ans, en Normandie.
Je travaille dans la cybersécurité.
Je ne suis pas un expert OPNsense, je découvre.
Je m'intéresse au filtrage, au VPN et à la protection des petits réseaux d'entreprise.
Je vais lire et j'interviendrai quand j'ai quelque chose d'utile à dire.
Merci pour le boulot sur le projet.

#9

26.7 Series / Re: Cannot Reach Public Addres...

Last post by rosencrantz247 - Today at 03:28:30 PM

Hey everyone, thanks for the attempts at repairing this!  I think we can mark this as CLOSED.

After reading Nero's message, I went down that route, as there didn't seem to be anything blatantly wrong on my end.  Called in to activate the modem again and the ISP made it seem like they forgot something and put me on hold for awhile.  Came back, said everything should be good.  Still didn't have internet access.

So I decided to just put the ISP's modem/router/switch/AP combo unit back in and called to reactivate - the rest of the family was getting too upset at the lack of internet access during troubleshooting.  SAME ISSUE occurs with this one.  Call again, new person gets on, says they need to 'send an additional signal' (likely this portal activation part Nero mentioned) and now it is finally working and I have access.  It seems that they just don't try very hard when it's a customer device instead of one they control (I cannot change settings to their device through the web GUI nor SSH - I have to install an app on my phone to get access.  absolutely insane).  So i plan to just slap it in bridge mode and hook the rest of my network back up like before

#10

Virtual private networks / Need help with routing all tra...

Last post by user12314 - Today at 03:13:51 PM

So i mostly followed this guide: https://www.ivpn.net/setup/router/opnsense-wireguard/ but as that guide is for routing all traffic of the whole network over the VPN, i made some adjustments. Those are the following:

1. Instead of setting MSS to 1412 on my LAN interface, i set it on the specific VLAN that I want to use for this.

2. The guide is made for opnsense 24.1.6, i'm on 26.7.7 so the NAT settings look different. I clicked source NAT, selected Hybrid source NAT rule generation, and made a new rule: - network interface ivpn (this is the wireguard instance i made for ivpn), version ipv4, protocol *, source <the vlan i want to use> network, port *, dest *, port *, translate source ip "interface address", translate source port *

3. Instead of configuring the wg dns server 172.16.0.1 on DCHP, i configured it within the clients by replacing the text in /etc/resolv.conf with "nameserver 172.16.0.1"

4. in my peer, i put in the eindpoint the IP of the ivpn wg server i want to connect to. It only successfully handshakes with the IP, not with the hostname. none of the DNS seem to work in the vlan im doing this on, so that tracks.

So currently i have no DNS whatsoever working on this VLAN. That seems to be the problem.
I'm kind of stuck at this point, if anyone knows something i can try it'd be great. Thanks!