"Recent posts
#1
26.7 Series / Re: frr plugin 2.0 was release...
Last post by Monviech (Cedrik) - Today at 11:23:36 AMSince I expect more people to run into this lets make it a bit more forgiving:
https://github.com/opnsense/plugins/commit/150ff2ab0fb256d0d242e4fc96a60af7f04e9398
https://github.com/opnsense/plugins/commit/150ff2ab0fb256d0d242e4fc96a60af7f04e9398
#2
General Discussion / Re: DNS wildcards in Alias (Ho...
Last post by yourfriendarmando - Today at 11:09:38 AMI use a combination of hagezi and the windowsspyblocker lists. You can get lists that work at both DNS and IP level of blocking, and only allow windows updates without windows spy and telling on you.
I did manually add some additional hosts on top of these lists such as the unique ID blocking for good measure, just enough before other functions like the store, begin to break. It is good to know those hosts in case I do want to break the store purposely.
I did manually add some additional hosts on top of these lists such as the unique ID blocking for good measure, just enough before other functions like the store, begin to break. It is good to know those hosts in case I do want to break the store purposely.
Quote from: chropnsense on January 27, 2022, 06:43:26 PMHi,
I'm also wondering, if this is possible or not (in pfSense it is not it seems). I just got the task to evaluate OPNSense and this is more or less a show stopper, if not possible to e.g. allow only MS Updates based on wildcard DNS:
https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#211-connection-from-the-wsus-server-to-the-internet
http://windowsupdate.microsoft.com
http://*.windowsupdate.microsoft.com
https://*.windowsupdate.microsoft.com
http://*.update.microsoft.com
https://*.update.microsoft.com
http://*.windowsupdate.com
http://download.windowsupdate.com
https://download.microsoft.com
http://*.download.windowsupdate.com
http://wustat.windows.com
http://ntservicepack.microsoft.com
http://go.microsoft.com
http://dl.delivery.mp.microsoft.com
https://dl.delivery.mp.microsoft.com
Windows update here only as an example (could use WSUS), but also other use cases where need to allow CDN type *.domain.com
Edit: if not out-of-the-box possible, would it be possible to use cron and dnsmasq to poll through a list say once an hour (if that wildcard doesn't need to be resolved real time) and then use that IP list in an alias or similar?
#3
General Discussion / Re: DNS wildcards in Alias (Ho...
Last post by yourfriendarmando - Today at 11:04:08 AMRemember the firewall deals with ghosts at the IP level. The convenience of using a host alias to resolve into an IP address is courtesy of opnsense, not necessarily the PF system.
You can bulk load host names into the alias by turning the tags into text. The number of hosts is finite, correct? It is better to have an accountable list so you know who can access your network. If we trusted any host from a domain that could allow some exotic spoofing.
It's not that hard, and the framework already does the heavy lifting of resolving them for you. I do something similar, including a use of dynamic DNS for most clients. I still have to set each site up and add the host in the respective alias. I wish my sites were as numerous as yours to have this problem haha. Hire more people to manage the access of your sites.
You can alternately allow a whole ASN have access, especially if an ISP is common amongst several clients. You can confine the access to a time interval so it is not open when unnecessarily, if the use case permits.
You can bulk load host names into the alias by turning the tags into text. The number of hosts is finite, correct? It is better to have an accountable list so you know who can access your network. If we trusted any host from a domain that could allow some exotic spoofing.
It's not that hard, and the framework already does the heavy lifting of resolving them for you. I do something similar, including a use of dynamic DNS for most clients. I still have to set each site up and add the host in the respective alias. I wish my sites were as numerous as yours to have this problem haha. Hire more people to manage the access of your sites.
You can alternately allow a whole ASN have access, especially if an ISP is common amongst several clients. You can confine the access to a time interval so it is not open when unnecessarily, if the use case permits.
#4
Zenarmor (Sensei) / Re: Cancelling my subscription...
Last post by colourcode - Today at 10:32:45 AMI've learned that it is better to let the firewall do its thing, and let the vms/containers do their thing.
Having a process constantly writing data, especially a database, will have at some point a CPU load high enough to slow down other functionalities on the firewall, I am not even mentioning IOPS, sqlite was basically chocking my firewall and had to dig in the logs to find the culprit, I wasn't aware of putting sqlite in the ram other than tmpfs which I always found a bit too risky for data I cared about.
But once you externalize the database things become more predictable even under high load, this being said, the free version might not necessarily give the best user experience unless you have some specific hardware (fast nvme with dram cache), but in my experience sqlite+dramless nvme was a pure recipe for headaches, because the free version the last time I tested doesn't offer the option to use an external elasticsearch instance which would definitely have consequences if a user doesn't have the "right" hardware.
[/quote]
What kind of traffic and host count are we talking about where you manage to practically kill the device?
I'd be very interested to see if your problem also dissappears with the DB mounted as TMPFS. I assume you bumped the history way up from 2 days if you care about historical data.
Unfortunately my ISP don't offer 2.5 so I can't test higher than 1gbps from my end.
The only errors i've seen running this on a n305 under proxmox (6 of 8 cores to opnsense) is netmap stalling - reproducable with torrent traffic (wg on opnsense) and steam downloads etc.
Having a process constantly writing data, especially a database, will have at some point a CPU load high enough to slow down other functionalities on the firewall, I am not even mentioning IOPS, sqlite was basically chocking my firewall and had to dig in the logs to find the culprit, I wasn't aware of putting sqlite in the ram other than tmpfs which I always found a bit too risky for data I cared about.
But once you externalize the database things become more predictable even under high load, this being said, the free version might not necessarily give the best user experience unless you have some specific hardware (fast nvme with dram cache), but in my experience sqlite+dramless nvme was a pure recipe for headaches, because the free version the last time I tested doesn't offer the option to use an external elasticsearch instance which would definitely have consequences if a user doesn't have the "right" hardware.
[/quote]
What kind of traffic and host count are we talking about where you manage to practically kill the device?
I'd be very interested to see if your problem also dissappears with the DB mounted as TMPFS. I assume you bumped the history way up from 2 days if you care about historical data.
Unfortunately my ISP don't offer 2.5 so I can't test higher than 1gbps from my end.
The only errors i've seen running this on a n305 under proxmox (6 of 8 cores to opnsense) is netmap stalling - reproducable with torrent traffic (wg on opnsense) and steam downloads etc.
#5
26.7 Series / Re: frr plugin 2.0 was release...
Last post by Monviech (Cedrik) - Today at 09:55:16 AMIt's still the group interface validation issue.
I thought I fixed that and we updated the plugin version.
I will test this myself to see if I missed anything.
For now, remove the "wireguard" and "openvpn" group interfaces from the Passive Interfaces and the OSPF interfaces and rerun the migration.
Rerun the migration from the command line like this:
# pluginctl -m
I thought I fixed that and we updated the plugin version.
I will test this myself to see if I missed anything.
For now, remove the "wireguard" and "openvpn" group interfaces from the Passive Interfaces and the OSPF interfaces and rerun the migration.
Rerun the migration from the command line like this:
# pluginctl -m
#6
General Discussion / Re: DNS wildcards in Alias (Ho...
Last post by Monviech (Cedrik) - Today at 09:49:43 AMBut why, it's already available in core?
https://docs.opnsense.org/manual/dnsmasq.html#firewall-alias-ipset
https://docs.opnsense.org/manual/dnsmasq.html#firewall-alias-ipset
#7
General Discussion / Re: DNS wildcards in Alias (Ho...
Last post by martinseener - Today at 09:17:14 AMHi everyone,
good question @ArminF and a good solution @Shayoo. I also faced this problem with OPNSense in our business environment and I took AI to help me build it (especially conformant for OPNSense usage and logic). In the end it's mostly the dnsmasq ipset solution but way easier to use for average admins and a little more user-friendly.
Please check my writing about it here: https://www.sysorchestra.com/wildcard-aliases-for-opnsense/
and the actual plugin here: https://github.com/martinseener/os-wildcard-aliases
I am using it for all queries on my Homelab for couple days now working just fine. Please let me know (here or DM) if you encounter issues or would love to see some improvements.
Hope this helps!
Best, Martin
good question @ArminF and a good solution @Shayoo. I also faced this problem with OPNSense in our business environment and I took AI to help me build it (especially conformant for OPNSense usage and logic). In the end it's mostly the dnsmasq ipset solution but way easier to use for average admins and a little more user-friendly.
Please check my writing about it here: https://www.sysorchestra.com/wildcard-aliases-for-opnsense/
and the actual plugin here: https://github.com/martinseener/os-wildcard-aliases
I am using it for all queries on my Homelab for couple days now working just fine. Please let me know (here or DM) if you encounter issues or would love to see some improvements.
Hope this helps!
Best, Martin
#8
26.7 Series / Re: frr plugin 2.0 was release...
Last post by br_opnsense - Today at 08:48:51 AMI tried today another appliance. Still failes. Migration output:
Code Select
[OPNsense\Quagga\OSPF:interfaces.interface.12acf5f9-e33e-4482-8092-fa1035437f35.interfacename] Option [] not in list.{openvpn}
[OPNsense\Quagga\OSPF:interfaces.interface.e840ea08-c93f-4993-858b-0415c64a79a1.interfacename] Option [] not in list.{wireguard}
Model OPNsense\Quagga\OSPF can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\Quagga\OSPF:interfaces.interface.12acf5f9-e33e-4482-8092-fa1035437f35.interfacename] Option [] not in list.{openvpn}
[OPNsense\Quagga\OSPF:interfaces.interface.e840ea08-c93f-4993-858b-0415c64a79a1.interfacename] Option [] not in list.{wireguard}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:821
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(946): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\Quagga\OSPF from 1.1.0 to 1.1.5 #9
26.7 Series / Fibocom FM190W-GL USB ECM dete...
Last post by ScottBrisAU - Today at 08:37:02 AMHi everyone,
I'm trying to get a Fibocom FM190W-GL 5G modem working over USB with OPNsense 26.7 on a Gigabyte BRIX mini PC.
The modem registers successfully on the Australian Optus network and establishes an active cellular data context. However, OPNsense recognises the USB Ethernet interface (cdce0 / ue0) but cannot obtain an IPv4 address using DHCP.
Hardware and firmware
Modem: Fibocom FM190W-GL
Firmware: 99103.1000.00.01.06.12
USB VID:PID: 2CB7:0105
USB mode: 33 (CDC ECM)
Host: Gigabyte BRIX, OPNsense 26.7 (FreeBSD)
Connection: USB 3.0 with separate 5V modem power supply
Network: Optus Australia, activated SIM
Confirmed AT-command results
AT+CEREG? +CEREG: 0,1
AT+CGATT? +CGATT: 1
AT+CGACT? +CGACT: 1,1
AT+CGPADDR=1 +CGPADDR: 1,"10.94.135.230"
AT+GTUSBMODE? 33
AT+GTAUTOCONNECT? 1
AT+GTAUTODHCP? 1
The modem has been fully power-cycled after enabling automatic connection and DHCP.
OPNsense behaviour
FreeBSD detects the modem's USB CDC ECM interface.
The cdce driver attaches and creates ue0.
ue0 is UP, but has no IPv4 address.
DHCP requests are transmitted, but no DHCP offers are received.
Interface statistics show outgoing traffic but zero incoming packets.
The DHCP client runs without obtaining a lease.
A packet capture using:
tcpdump -ni ue0 -c 6 'udp port 67 or udp port 68'
showed outgoing DHCP requests without responses.
Windows testing
Windows 11 detects the modem's AT, diagnostics and NMEA serial ports, but the CDC ECM interface has no installed driver (Device Manager Code 28).
ECM hardware ID:
USB\VID_2CB7&PID_0105&MI_04
Questions
Has anyone successfully used the Fibocom FM190W-GL directly over USB with OPNsense or FreeBSD?
Does this modem require additional initialization to enable its ECM data interface?
Is there a known FreeBSD cdce compatibility issue with USB device 2CB7:0105?
Would a different USB composition or networking mode be preferable?
Has anyone successfully used this modem with an external USB-to-Ethernet adapter?
I've contacted Fibocom technical support for documentation and driver guidance.
Any advice from someone who has worked with this modem or similar Qualcomm-based 5G modules would be appreciated.
Thanks,
Scott
I'm trying to get a Fibocom FM190W-GL 5G modem working over USB with OPNsense 26.7 on a Gigabyte BRIX mini PC.
The modem registers successfully on the Australian Optus network and establishes an active cellular data context. However, OPNsense recognises the USB Ethernet interface (cdce0 / ue0) but cannot obtain an IPv4 address using DHCP.
Hardware and firmware
Modem: Fibocom FM190W-GL
Firmware: 99103.1000.00.01.06.12
USB VID:PID: 2CB7:0105
USB mode: 33 (CDC ECM)
Host: Gigabyte BRIX, OPNsense 26.7 (FreeBSD)
Connection: USB 3.0 with separate 5V modem power supply
Network: Optus Australia, activated SIM
Confirmed AT-command results
AT+CEREG? +CEREG: 0,1
AT+CGATT? +CGATT: 1
AT+CGACT? +CGACT: 1,1
AT+CGPADDR=1 +CGPADDR: 1,"10.94.135.230"
AT+GTUSBMODE? 33
AT+GTAUTOCONNECT? 1
AT+GTAUTODHCP? 1
The modem has been fully power-cycled after enabling automatic connection and DHCP.
OPNsense behaviour
FreeBSD detects the modem's USB CDC ECM interface.
The cdce driver attaches and creates ue0.
ue0 is UP, but has no IPv4 address.
DHCP requests are transmitted, but no DHCP offers are received.
Interface statistics show outgoing traffic but zero incoming packets.
The DHCP client runs without obtaining a lease.
A packet capture using:
tcpdump -ni ue0 -c 6 'udp port 67 or udp port 68'
showed outgoing DHCP requests without responses.
Windows testing
Windows 11 detects the modem's AT, diagnostics and NMEA serial ports, but the CDC ECM interface has no installed driver (Device Manager Code 28).
ECM hardware ID:
USB\VID_2CB7&PID_0105&MI_04
Questions
Has anyone successfully used the Fibocom FM190W-GL directly over USB with OPNsense or FreeBSD?
Does this modem require additional initialization to enable its ECM data interface?
Is there a known FreeBSD cdce compatibility issue with USB device 2CB7:0105?
Would a different USB composition or networking mode be preferable?
Has anyone successfully used this modem with an external USB-to-Ethernet adapter?
I've contacted Fibocom technical support for documentation and driver guidance.
Any advice from someone who has worked with this modem or similar Qualcomm-based 5G modules would be appreciated.
Thanks,
Scott
#10
German - Deutsch / Re: Firmware Update Notificati...
Last post by no_Legend - Today at 07:52:57 AM@fastboot
Ich habs noch mal eingerichtet.
Schauen wir mal wie es mit der aktuellen Version läuft.
Melde mich im laufe der Woche noch mal dazu.
Danke und Grüße Robert
Ich habs noch mal eingerichtet.
Schauen wir mal wie es mit der aktuellen Version läuft.
Melde mich im laufe der Woche noch mal dazu.
Danke und Grüße Robert
