Recent posts

#1

General Discussion / Re: Free GeoIP Database to use...

Last post by cookiemonster - Today at 10:30:59 PM

I see the intended use, thanks Patrick. Indeed is a redistribution.

#2

General Discussion / Re: Free GeoIP Database to use...

Last post by Patrick M. Hausen - Today at 10:25:43 PM

They are providing a database that could be used by the builtin functionality. As an alternative to Maxmind or IPinfo.

Not sure if this is a permitted use of Internet registry info, though.

#3

General Discussion / Re: Free GeoIP Database to use...

Last post by cookiemonster - Today at 10:19:32 PM

What's wrong with using the built-in functionality https://docs.opnsense.org/manual/aliases.html#geoip ?

#4

General Discussion / Re: opnsense wont boot on APU2...

Last post by robertkwild - Today at 09:43:10 PM

Hey nice one viragomann thanks I got them off using msata reader with freebsd laptop

#5

26.7 Series / Re: [26.7] UPnP/NAT-PMP leaks ...

Last post by nero355 - Today at 08:37:03 PM

About 60 internal hosts running ZeroTier, which request port mappings via NAT-PMP all the time

As in Servers or as in Clients ?

If you are talking about Clients you could try this : https://forum.opnsense.org/index.php?topic=52419.msg275740#msg275740
ZeroTier Documentation is mentioning P2P so that should work too for just Clients I guess ?!

#6

Intrusion Detection and Prevention / Suricata Issue - 26.7.7

Last post by spetrillo - Today at 07:37:38 PM

Hello all,

I have built a bare metal Lenovo M720q Tiny into an OPNsense firewall. The Lenovo unit has 8 gig of RAM, a 128 gig NVMe drive, and a dual port Intel E610 10 gig card in the PCIe slot. I am running 26.7.7 currently but the problem I am facing has been happening since I built the unit. I have Suricata configured to use the network driver names(ix0/ix1) instead of the VLAN interface names. It is configured to use Netmap with Hyperscan. When I enable Suricata it takes about 20-30 seconds before the firewall hangs. I literally have to turn it off and back on, and then disable Suricata to keep the firewall operational.

Has anyone run into this problem? I am completely baffled by this bc if I configure Suricata to use the VLAN interface names the firewall stays operational. All the documentation I have read is when the firewall is bare metal you should use the physical driver names instead. Is this still correct?

Thanks,
Steve

#7

26.7 Series / Re: ACME 4.14 Certicate Renew ...

Last post by defcon999 - Today at 05:26:39 PM

Yes. The certificate renewal went through without any issues. Everything looks fine in the ACME log. However, the new certificate is not being applied or displayed by OPNsense.

#8

General Discussion / Free GeoIP Database to use wit...

Last post by Tonton Jo - Today at 04:11:02 PM

Hi!

Not sure if it's the right place, but i wanted to share this:

I've vibecoded a script that generate a geoIP database from scratch that matches the requirements in terms of format for Opnsense.

• It's fully open sources
• Based on the internet registries database
• Automatically updated everyday using a workflow
• PS and Bash scripts to self host / build yourselves available.

The database can be downloaded here and will be automatically updated:
https://github.com/Tontonjo/opnsense/releases/download/geoip/GeoLite2-Country-CSV.zip

Find the scripts for both bash and Powershell usage if you need to self-host here:
https://github.com/Tontonjo/opnsense/tree/main/geoip

Let me know if you find this usefull :)

PS: Sorry for the repost

Regards

Jo

#9

Hardware and Performance / Re: [solved] Intel i226 Firmwa...

Last post by Meditux - Today at 03:46:36 PM

i had success with my protectli vp2440, both the X710 and i226v nics. first i updated the X710

https://kb.protectli.com/kb/how-to-update-intel-nic-nvm-firmware-on-protectli-vaults/

downloaded the complete driver pack.

Code Select Expand

fetch https://downloadmirror.intel.com/869912/Release_30.5.1.zip
unzip'd the 700 series, for freebsd, ran nvmupdate64e and for the x710, everything was automatically detected and updated to 9.55

for the i226, downloaded the 2.32 2MB firmware. mine had 2.17 to begin with.

Code Select Expand

fetch https://github.com/BillyCurtis/Intel-I226-V-NVM-Firmware/raw/refs/heads/main/I226-V/2.32/FXVL_125C_V_2MB_2.32.bin

then setup the nvm.cfg.. i had to modify the EEPID and REPLACES sections to match my setup (got that info from dmesg and trying to update, failing and looking at the log output).

Code Select Expand

CURRENT FAMILY: 1.0.0
CONFIG VERSION: 1.14.0

; NIC device
BEGIN DEVICE
DEVICENAME: Intel(R) Ethernet Controller I226-V
VENDOR: 8086
DEVICE: 125C
SUBVENDOR: 8086
SUBDEVICE: 0000
NVM IMAGE: FXVL_125C_V_2MB_2.32.bin
EEPID: 80000422
RESET TYPE: REBOOT
REPLACES: 80000303
END DEVICE
then for each i226 nic by mac address, i ran

Code Select Expand

./nvmupdate64e -b -l nvm-6462662505A5.log -m 6462662505A5 -u -c nvm.cfg
./nvmupdate64e -b -l nvm-6462662505A6.log -m 6462662505A6 -u -c nvm.cfg
reboot

Code Select Expand

# sysctl dev.igc.{0,1}.fw_version dev.ixl.{0,1}.fw_version
dev.igc.0.fw_version: EEPROM V2.32-0 eTrack 0x80000422
dev.igc.1.fw_version: EEPROM V2.32-0 eTrack 0x80000422
dev.ixl.0.fw_version: fw 9.155.78849 api 1.15 nvm 9.55 etid 8000fe27 oem 0.0.0
dev.ixl.1.fw_version: fw 9.155.78849 api 1.15 nvm 9.55 etid 8000fe27 oem 0.0.0
edit: this also worked on my Odroid H4 ultra, i226v shipped with v2.22

Vielen Dank dirtyfreebooter,

das Update der NVM-Version 2.17-0 → 2.32-0 funktioniert somit auch sauber auf allen vier i226-V-Ports, direkt unter OPNsense (FreeBSD) für eine HUNSN Micro Firewall RJ42.
Den LAN-Port zuletzt flashen, da das Interface danach bis zum Reboot down ist! Die Firmware FXVL_125C_V_2MB_2.32.bin und die nvm.cfg passen exakt!
Auch das nvmupdate64e Tool aus der 700Series_NVMUpdatePackage_v9_55_FreeBSD.tar.gz passt super :-)

# sysctl dev.igc.{0,1,2,3}.fw_version
dev.igc.0.fw_version: EEPROM V2.32-0 eTrack 0x80000422
dev.igc.1.fw_version: EEPROM V2.32-0 eTrack 0x80000422
dev.igc.2.fw_version: EEPROM V2.32-0 eTrack 0x80000422
dev.igc.3.fw_version: EEPROM V2.32-0 eTrack 0x80000422

Gruß Meditux

#10

26.7 Series / Re: ACME 4.14 Certicate Renew ...

Last post by jumpythrottle01 - Today at 03:17:57 PM

Looks like issuance is fine and only the local import path is choking on missing data.