"Recent posts
#1
26.7 Series / Re: Will there still be any up...
Last post by Greelan - Today at 11:00:23 AMBest to ask the maintainer: https://github.com/opnsense/plugins/blob/master/security/maltrail/Makefile
#2
26.7 Series / Will there still be any update...
Last post by chewbacca - Today at 10:45:53 AMThe Maltrail version in OPNSense is still version 1.4 but the latest version now is 3.4
Will there be any updates comming?
Will there be any updates comming?
#3
General Discussion / Re: Caddy + Let's Encrypt , ce...
Last post by Pete5 - Today at 09:28:58 AMThanks for the hint. I read the docs again and figured it out by myself :-).
Now the connection to a trunas instance is working and secured. Then I'tried to add a device like a managed switch, this connection is still unsecured.
Now the connection to a trunas instance is working and secured. Then I'tried to add a device like a managed switch, this connection is still unsecured.
#4
General Discussion / Re: Caddy + Let's Encrypt , ce...
Last post by Monviech (Cedrik) - Today at 08:54:00 AMThe wildcard domain should be:
*.example.com
The subdomain:
myservice.example.com
The handler:
*.example.com
myservice.example.com
The subdomain must be entered fully qualified.
If theres still an issue with the caddyfile then I have to investigate.
*.example.com
The subdomain:
myservice.example.com
The handler:
*.example.com
myservice.example.com
The subdomain must be entered fully qualified.
If theres still an issue with the caddyfile then I have to investigate.
#5
General Discussion / Re: Caddy + Let's Encrypt , ce...
Last post by Pete5 - Today at 08:33:52 AMOk, I configured the domains and handlers from scratch.
When i call up myservice.maydomain.de the page is blank but the connection seems to be secured. At least firefox shows the shield on the left of the address bar.
The caddy log says
But where is a dot missing?
When i call up myservice.maydomain.de the page is blank but the connection seems to be secured. At least firefox shows the shield on the left of the address bar.
The caddy log says
Code Select
2026-10-25T08:29:12 Error caddy "error","ts":"2026-10-25T07:29:12Z","logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"myservices","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid identifiers requested :: Cannot issue for \"myservices\": Domain name needs at least one dot"}But where is a dot missing?
#6
General Discussion / Re: Caddy + Let's Encrypt , ce...
Last post by Pete5 - Today at 06:09:49 AMQuote from: Monviech (Cedrik) on October 24, 2026, 12:08:14 PMCause it looks like the shared certificate config isn't attached to the subdomains you configured.
I used HAProxy for let's encrypt and Unbound for lokal DNS before. Might it be possible that lokal DNS with Unbound is not configured correctly in conjunction with caddy?
#7
General Discussion / Re: Caddy + Let's Encrypt , ce...
Last post by Pete5 - Today at 06:02:03 AMThanks a lot for your reply,
The caddy domain looks like this
You cannot view this attachment.
The selected certificate is not Auto HTTPS of course, the certficate "mydomain.de (ACME Client)" is selected here.
You cannot view this attachment.
You cannot view this attachment.
The caddy handler
You cannot view this attachment.
The caddy domain looks like this
You cannot view this attachment.
The selected certificate is not Auto HTTPS of course, the certficate "mydomain.de (ACME Client)" is selected here.
You cannot view this attachment.
You cannot view this attachment.
The caddy handler
You cannot view this attachment.
#8
General Discussion / Re: weird issues with network
Last post by meyergru - Today at 12:24:45 AMFrom your description, the main obstacle is the complexity of your setup and the lack of a controlled baseline for troubleshooting. You describe several different symptoms without having established where each failure occurs. Systematic fault isolation comes before BSD-specific expertise.
A crucial distinction here is between configuration and runtime state. An unchanged configuration does not imply unchanged behaviour. DNS answers, DHCP leases, ARP caches and firewall connection states change during normal operation. Security products can update signatures, reputation data and blocklists automatically. The same configured policy can therefore produce different results as its inputs and state change. Looking for manual configuration changes will not explain those differences, and the absence of configuration-change logs is entirely unsurprising.
You have also combined several access-control mechanisms whose interactions need to be understood. Some combinations have documented restrictions: Zenarmor and Suricata in IPS mode, when using netmap, require separate interfaces because they cannot both own the same netmap interface. That is one concrete example of why individually useful security products cannot simply be combined without checking interoperability.
Running the Proxmox firewall alongside the OPNsense firewall introduces another independent filtering layer. Traffic dropped before reaching the VM cannot appear in the guest firewall's logs. Each layer needs to be investigated at the point where it acts.
Wireless networking - being unreliable at best - adds further variables. Access points may perform ARP broadcast-to-unicast conversion or multicast-to-unicast conversion, introducing additional processing and learned state. These features can require disabling for particular applications; TP-Link's own Omada guidance for Sonos is an example. A connected Wi-Fi client therefore does not establish that every relevant type of traffic is being delivered correctly.
These examples illustrate the diagnostic problem; they do not establish suspected causes of your particular failures.
The important point is that these variables create combinations. The diagnostic search space grows multiplicatively as configuration choices, runtime states and interactions are combined. Understanding each component individually is insufficient if you cannot also account for their combined behaviour. Thus, you need a minimal, known-working baseline, one reproducible symptom at a time, and tests that locate where communication breaks down. Reinstalling everything and restoring the same configuration also restores any configuration problems it contains, so Proxmox does not help you there, either.
Realistically, you are unlikely to find volunteers willing to reconstruct and untangle this entire environment free of charge. A forum can help with specific, sufficiently isolated problems. You need to do the groundwork yourself: reduce the complexity of your setup and present one clearly isolated, reproducible failure at a time.
A crucial distinction here is between configuration and runtime state. An unchanged configuration does not imply unchanged behaviour. DNS answers, DHCP leases, ARP caches and firewall connection states change during normal operation. Security products can update signatures, reputation data and blocklists automatically. The same configured policy can therefore produce different results as its inputs and state change. Looking for manual configuration changes will not explain those differences, and the absence of configuration-change logs is entirely unsurprising.
You have also combined several access-control mechanisms whose interactions need to be understood. Some combinations have documented restrictions: Zenarmor and Suricata in IPS mode, when using netmap, require separate interfaces because they cannot both own the same netmap interface. That is one concrete example of why individually useful security products cannot simply be combined without checking interoperability.
Running the Proxmox firewall alongside the OPNsense firewall introduces another independent filtering layer. Traffic dropped before reaching the VM cannot appear in the guest firewall's logs. Each layer needs to be investigated at the point where it acts.
Wireless networking - being unreliable at best - adds further variables. Access points may perform ARP broadcast-to-unicast conversion or multicast-to-unicast conversion, introducing additional processing and learned state. These features can require disabling for particular applications; TP-Link's own Omada guidance for Sonos is an example. A connected Wi-Fi client therefore does not establish that every relevant type of traffic is being delivered correctly.
These examples illustrate the diagnostic problem; they do not establish suspected causes of your particular failures.
The important point is that these variables create combinations. The diagnostic search space grows multiplicatively as configuration choices, runtime states and interactions are combined. Understanding each component individually is insufficient if you cannot also account for their combined behaviour. Thus, you need a minimal, known-working baseline, one reproducible symptom at a time, and tests that locate where communication breaks down. Reinstalling everything and restoring the same configuration also restores any configuration problems it contains, so Proxmox does not help you there, either.
Realistically, you are unlikely to find volunteers willing to reconstruct and untangle this entire environment free of charge. A forum can help with specific, sufficiently isolated problems. You need to do the groundwork yourself: reduce the complexity of your setup and present one clearly isolated, reproducible failure at a time.
#9
26.7 Series / Re: [SOLVED] Quectel EC25‑E / ...
Last post by (MARLOO) - October 24, 2026, 11:07:01 PMI'm leaning towards the Huawei B535-232 LTE Cat 7, mainly for the price. For less money, I don't think I'd find anything comparable with external SMA connectors, Gigabit Ethernet, and good backup-WAN suitability.
For more control I'd consider an industrial router like the Teltonika RUT950 100+ euros (but less powerfull) or the TELTONIKA RUTX11 which is 400+ euros.
Also I'm unsure about LTE band support and whether it's carrier-locked. The Huawei may offer fewer option controls, but I know it works reliably with my band provider.
Once everything is working behind OPNsense, I may open a new post with my WAN failover configuration
For more control I'd consider an industrial router like the Teltonika RUT950 100+ euros (but less powerfull) or the TELTONIKA RUTX11 which is 400+ euros.
Also I'm unsure about LTE band support and whether it's carrier-locked. The Huawei may offer fewer option controls, but I know it works reliably with my band provider.
Once everything is working behind OPNsense, I may open a new post with my WAN failover configuration
#10
26.7 Series / Re: [SOLVED] Quectel EC25‑E / ...
Last post by nero355 - October 24, 2026, 10:27:21 PMQuote from: (MARLOO) on October 24, 2026, 08:08:43 PMDo you have any experience with either of them, or would you recommend a different external LTE router for this use case?Actually I am looking forward to your own experience with either one of those (...or perhaps a totally different 3th/4th model that you might discover...) in case I ever need one in the future ;)
