"Recent posts
#1
26.7 Series / Log rate limiting - any better...
Last post by meyergru - Today at 09:07:47 PMRecently, I had a problem when some of my friends told me that out voice chat was choppy. When I investigated, I found my OpnSense at 100% CPU. That turned out to be due to 7 WAN block rules for various blocklists and an ongoing DDOS attack.
I had logging enabled for those rules and the log was constantly being written to. I could not even reliably use the web UI.
This made me think about how to rate-limit the logs. Apparently, with 26.7.2, there is now max-pkg-rate from pf available.
So, now, you can create two block rules, one with logging enabled, quick block and "Max packet rate [packets]" = 1 and "Max packet rate [seconds]" = 1 to have a rule that matches at most once per second and logs and another quick block rule without logging and without rate limits immediately following that.
By using that, you still have (rate-limited) logging, but without the risk for a totally overwhelmed OpnSense.
Alas, you need two rules, because the first one will not match any more when the rate limit has been exceeded. Would there be a better way of having such a thing (i.e. eat the cake and still have it)?
I had logging enabled for those rules and the log was constantly being written to. I could not even reliably use the web UI.
This made me think about how to rate-limit the logs. Apparently, with 26.7.2, there is now max-pkg-rate from pf available.
So, now, you can create two block rules, one with logging enabled, quick block and "Max packet rate [packets]" = 1 and "Max packet rate [seconds]" = 1 to have a rule that matches at most once per second and logs and another quick block rule without logging and without rate limits immediately following that.
By using that, you still have (rate-limited) logging, but without the risk for a totally overwhelmed OpnSense.
Alas, you need two rules, because the first one will not match any more when the rate limit has been exceeded. Would there be a better way of having such a thing (i.e. eat the cake and still have it)?
#2
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by comet424 - Today at 08:02:05 PMok so Source NAT is Outbound NAT then
so then this should open up the thing
well that didnt work i can not port forward through the darn wan connection ugh... so much headache to just simply open up port 80 to access the gui
so then this should open up the thing
well that didnt work i can not port forward through the darn wan connection ugh... so much headache to just simply open up port 80 to access the gui
#3
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by Patrick M. Hausen - Today at 08:00:20 PMDestination NAT is port forward. Source NAT is just regular outbound masquerading.
#4
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by comet424 - Today at 07:57:23 PMah ok
ya its still checked
and under Firewall Nat
is Source NAT the same as Port Forward?
as there is no + option to say open a port 80 under Source NAT
ya its still checked
and under Firewall Nat
is Source NAT the same as Port Forward?
as there is no + option to say open a port 80 under Source NAT
#5
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by viragomann - Today at 07:51:39 PMQuote from: comet424 on Today at 07:44:23 PMill have to look up what a reply-to isIn mentioned it in #7.
I think, I'm out here...
#6
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by comet424 - Today at 07:44:23 PMi have no idea what that is? i only started opense yesterday as i trying to transition from pfsense to opensense incase they can the CE version
and what was all above was Vitual Cards
so now i found a computer to use
i shoved a Dual Intel 1Gb nic in
if i plug into the LAN i get 192.168.0.152 and i can access the gui
if i plug into the WAN port i get 192.168.0.156 and i can not access the gui
ill have to look up what a reply-to is
and what was all above was Vitual Cards
so now i found a computer to use
i shoved a Dual Intel 1Gb nic in
if i plug into the LAN i get 192.168.0.152 and i can access the gui
if i plug into the WAN port i get 192.168.0.156 and i can not access the gui
ill have to look up what a reply-to is
#7
General Discussion / Re: Can I create locked down w...
Last post by jerrac - Today at 07:40:00 PMThanks for all the replies! It sounds like the Router/AP on one of the extra Ethernet ports is the way to go.
For the app I want to use via an old phone, there is no need for any real speed. And the point of the tv bit would be to prevent ALL communication in or out. I'll be using a computer for media playback rather than the built in stuff. Which means that if I can get that old wifi router I have sitting around working with OpenWRT I should be able to set up at least 2 mini-networks on it.
And now I'm wondering if I should just set up the router as it's own thing, and then figure out a way to connect my server to it... Or maybe a vm with a wireless nic passed through to the vm that hosts my app...
In any case, I have a good starting point. Thanks to @Frank886t for the search term suggestions. And thanks for the tips about USB @connervt and @drosophila.
For the app I want to use via an old phone, there is no need for any real speed. And the point of the tv bit would be to prevent ALL communication in or out. I'll be using a computer for media playback rather than the built in stuff. Which means that if I can get that old wifi router I have sitting around working with OpenWRT I should be able to set up at least 2 mini-networks on it.
And now I'm wondering if I should just set up the router as it's own thing, and then figure out a way to connect my server to it... Or maybe a vm with a wireless nic passed through to the vm that hosts my app...
In any case, I have a good starting point. Thanks to @Frank886t for the search term suggestions. And thanks for the tips about USB @connervt and @drosophila.
#8
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by Patrick M. Hausen - Today at 07:30:19 PMIf your WAN is an Ethernet (broadcast network) and you are trying to access OPNsense from a system connected to that same network, did you disable reply-to?
#9
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by viragomann - Today at 07:06:05 PMI recently installed two OPNsense instances in a public cloud. It's KVM-based.
The VM had only a single network interface, and this was connected to the internet.
I just allowed access from my IP in the SG, went into the console and disabled the firewall. Then got access to the GUI and did all the settings.
I've no idea, why this shouldn't work in your case.
The VM had only a single network interface, and this was connected to the internet.
I just allowed access from my IP in the SG, went into the console and disabled the firewall. Then got access to the GUI and did all the settings.
I've no idea, why this shouldn't work in your case.
#10
26.7 Series / Re: ntp/chrony
Last post by defaultuserfoo - Today at 06:54:54 PMThanks, that seems to have worked :)
