"Recent posts
#1
26.7, 26.10 Series / Re: ISC➞Kea migration
Last post by Monviech (Cedrik) - Today at 06:24:44 PMstaticarp
https://github.com/opnsense/core/pull/11026
Its not a feature of KEA, its just an interface flag.
Dont know why you loose lifetime. Reservations are export from isc and import to kea via csv, both available in the gui.
https://github.com/opnsense/core/pull/11026
Its not a feature of KEA, its just an interface flag.
Dont know why you loose lifetime. Reservations are export from isc and import to kea via csv, both available in the gui.
#2
26.7, 26.10 Series / ISC➞Kea migration
Last post by chemlud - Today at 05:56:00 PMHello again,
currently I'm underway moving my static leases from ISC to KEA (**sigh**, so much lifetime lost on absolutely unproductive work...) and found this here:
https://forum.opnsense.org/index.php?topic=48854.0
I have static ARP enabled on many interfaces, so that only reserved MAC-IPs can talk to the sense. What will happen with these static ARP configurations when I disable ISC and enable KEA in the future? Will the "static ARP" on the interface persist?
Guess this still is a show-stopper for KEA, as it doesn't have this feature, or?
PS: Also found and read this here:
https://forum.opnsense.org/index.php?topic=49029.0
But the "discussion" ended nowhere in this thread, too.
Any help highly appreciated!
currently I'm underway moving my static leases from ISC to KEA (**sigh**, so much lifetime lost on absolutely unproductive work...) and found this here:
https://forum.opnsense.org/index.php?topic=48854.0
I have static ARP enabled on many interfaces, so that only reserved MAC-IPs can talk to the sense. What will happen with these static ARP configurations when I disable ISC and enable KEA in the future? Will the "static ARP" on the interface persist?
Guess this still is a show-stopper for KEA, as it doesn't have this feature, or?
PS: Also found and read this here:
https://forum.opnsense.org/index.php?topic=49029.0
But the "discussion" ended nowhere in this thread, too.
Any help highly appreciated!
#3
General Discussion / Re: nfSensei ( fork pfsense )
Last post by RobertoZ - Today at 05:47:19 PMQuote from: Greg_E on <strong>Today</strong> at 05:19:27 PMI will ask a question... If they are forking Mono (let's go back to the start) and OPNsense by derivative, does the current license require making the code open and available? I haven't looked at the code license for OPN, so not sure which method was chosen.
nfSensei is not a fork. The developer of nfSensei, Scott Ullrich was involved with forking Monowall many years ago which became pfSense.
#4
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - Today at 05:35:41 PMHi, thanks for responding. I've been struggling to get opnsense working with wireguard on my vlans. I'm a beginner/ intermediate when it comes to networking and not a tech wizard as some others may be 😅 please keep that in mind. I used chat gpt to use opnsense documentation to make a step by step guide for set all this setup so I'm not sure its 100℅
I have a modem from ISP in bridge mode to the mini PC (WAN)re0 then mini PC (LAN)re1 to switch port 1. I've set up the pvids and vlans pages on the switch as was working before.
I was trying to do this whole setup offline then test the connection afterwards with wireguard. I have 4 vlans that I don't want talking to each other. Wireguard for everything in and out with quad9. I want to have no fallback to ISP once setup. I want the mgnt vlan to just be direct wired offline connection. I don't know how to do that though..
Port 1 default
Ports2,6- Vlan20 pvid20
Ports3,4,5 - Vlan10 pvid 10
Port7 - Vlan 30 pvid30
Port8 - vlan99 pvid99
Opnsense 26.7.8_2
I have setup the interfaces and assignments for vlans and wireguard, I have a handshake as well. The problem I think is dnsmasq dhcp. I dont know what I'm doing to be fair when it comes to this. I changed something on LAN removing a 127.0.0.1 and I lost access to the web ui.
The only way I can get back in is by the mini PC shell (pfctl -d), log back in then (pfctl -e) and it works, but once I close my browser it deletes cookies and data and won't load, keeps timing out, whereas before it didn't do that.
I've set up the ranges on DNS but I'm lost when it comes to the IPS and such. I can ping test 1.1.1.1 or 9.9.9.9 but I can't reach the web on any vlan.
Another thing is to make a floating rule on WAN with no egress tag for kill switch but when I click apply it disappears from floating rules and ends up under WAN rules, I'm not sure if that's supposed to do that or if its a bug..
I'm not sure what else you'd want to know but I can get into the nitty gritty if need be or if its better should I just restart and reinstall? Any help would be much appreciated
I have a modem from ISP in bridge mode to the mini PC (WAN)re0 then mini PC (LAN)re1 to switch port 1. I've set up the pvids and vlans pages on the switch as was working before.
I was trying to do this whole setup offline then test the connection afterwards with wireguard. I have 4 vlans that I don't want talking to each other. Wireguard for everything in and out with quad9. I want to have no fallback to ISP once setup. I want the mgnt vlan to just be direct wired offline connection. I don't know how to do that though..
Port 1 default
Ports2,6- Vlan20 pvid20
Ports3,4,5 - Vlan10 pvid 10
Port7 - Vlan 30 pvid30
Port8 - vlan99 pvid99
Opnsense 26.7.8_2
I have setup the interfaces and assignments for vlans and wireguard, I have a handshake as well. The problem I think is dnsmasq dhcp. I dont know what I'm doing to be fair when it comes to this. I changed something on LAN removing a 127.0.0.1 and I lost access to the web ui.
The only way I can get back in is by the mini PC shell (pfctl -d), log back in then (pfctl -e) and it works, but once I close my browser it deletes cookies and data and won't load, keeps timing out, whereas before it didn't do that.
I've set up the ranges on DNS but I'm lost when it comes to the IPS and such. I can ping test 1.1.1.1 or 9.9.9.9 but I can't reach the web on any vlan.
Another thing is to make a floating rule on WAN with no egress tag for kill switch but when I click apply it disappears from floating rules and ends up under WAN rules, I'm not sure if that's supposed to do that or if its a bug..
I'm not sure what else you'd want to know but I can get into the nitty gritty if need be or if its better should I just restart and reinstall? Any help would be much appreciated
#5
General Discussion / Re: nfSensei ( fork pfsense )
Last post by Greg_E - Today at 05:19:27 PMI will ask a question... If they are forking Mono (let's go back to the start) and OPNsense by derivative, does the current license require making the code open and available? I haven't looked at the code license for OPN, so not sure which method was chosen.
#6
Hardware and Performance / Re: Semi parts bin new build
Last post by Greg_E - Today at 05:15:32 PMI have a brand new Protectli waiting for time to install, it's an i5 and 16GB of ram. The only thing I don't like is lack of a second drive slot so I could make a ZFS mirror for the system, based on 6x i226 because I don't need faster for the foreseeable future. I'll probably spin this up when I renew my OPNsense Business in a few months. Might test in lab for a little while before if I can find time.
#7
Zenarmor (Sensei) / purchasing this product
Last post by Greg_E - Today at 05:09:52 PMI emailed the hi@ email about a month ago and no answer, I just sent another message through the web contact form. Can you have sales take a look for it? I have money now and trying to force this into my future budgets, having it now would strengthen getting it into future budgets. Purchase time frame is as quick as I can get supervisor approval, and we've already started talking about it, so pretty quick.
Look for an education based email and you'll find me.
Look for an education based email and you'll find me.
#8
High availability / Re: Aliases to support "No XML...
Last post by Monviech (Cedrik) - Today at 04:19:49 PMWell I wrote an alternative into the ticket, you can use different firewall rules that have the nosync flag. They can reference different aliases. I don't see the point of also excluding aliases via nosync.
Also if you use desaster recovery configuration, OPNcentral might be better. It already retains manually created aliases on the target.
HA configuration and XMLRPC sync are mostly for "same" devices that run in HA.
Other kind of syncs are better suited for OPNcentral in my opinion.
https://docs.opnsense.org/vendor/deciso/opncentral.html
Also if you use desaster recovery configuration, OPNcentral might be better. It already retains manually created aliases on the target.
HA configuration and XMLRPC sync are mostly for "same" devices that run in HA.
Other kind of syncs are better suited for OPNcentral in my opinion.
https://docs.opnsense.org/vendor/deciso/opncentral.html
#9
German - Deutsch / Re: Squid ACL kann nicht mehr ...
Last post by wtfia2k - Today at 03:05:28 PMDas Problem ist mit der Version OPNsense 26.7.8_2 behoben worden.
#10
26.7, 26.10 Series / Re: [Solved by reboot] 26.7 Up...
Last post by danmac - Today at 02:49:14 PMI'm in a bit of a rush just now will come back later but pulled up the source for fetch quickly (not really a C guy so bear with) but I can't see a way of politely prodding fetch itself into that kind of behaviour as it stands.
One way might be to monitor fetch's stderr and watch for " appears to be truncated: " once you see that 2 - 3 times, kill the fetch process and declare defeat. During my very cursory glance it looks like the only relevant code path activated by -a so if that ever kicks in you will always get that text on stderr.
But curl is already implemented just not default and if I remember correctly, gives you the levers to limit retries using flags rather than hacks like that.
https://github.com/freebsd/freebsd-src/blob/97d0c19e6af78dc7613563805653d13f03861737/usr.bin/fetch/fetch.c#L823 (do a CTRL-F for a_flag)
cheers o7
One way might be to monitor fetch's stderr and watch for " appears to be truncated: " once you see that 2 - 3 times, kill the fetch process and declare defeat. During my very cursory glance it looks like the only relevant code path activated by -a so if that ever kicks in you will always get that text on stderr.
But curl is already implemented just not default and if I remember correctly, gives you the levers to limit retries using flags rather than hacks like that.
https://github.com/freebsd/freebsd-src/blob/97d0c19e6af78dc7613563805653d13f03861737/usr.bin/fetch/fetch.c#L823 (do a CTRL-F for a_flag)
cheers o7
