Recent posts

#1

26.7, 26.10 Series / Re: ACME, sftp upload - New Cl...

Last post by bensommer - Today at 12:26:14 PM

The problem was the opnsense. The ssh key was just inside /root/.ssh/known_hosts but not inside /var/etc/acme-client/sftp-config/known_hosts. After I copied the key manually, it worked with all Ubuntu Debian versions that had previously caused problems.

Regards Ben

#2

26.7, 26.10 Series / Re: issue with legacy firewall...

Last post by thebraz - Today at 12:07:06 PM

So, it's better to migrate the rules before doing the .8 upgrade?

Thanks in advance

#3

Development and Code Review / Re: netflector available as pl...

Last post by vicking - Today at 10:37:26 AM

Nice!
Currently I run mdns repeater and ssdpreflector between my lan and iot vlan.

If I am correct I can drop these packages for this single package? :D

It would seem so, yes. Let me know if you need help with the configuration. If you will want to enable dial - you will probably require some firewall adjustments (for input chain to accept DIAL responses from IOT VLAN). If everything works for you now though - you will probably only need mdns and ssdp set to true. Dial is for things like my stupid LG TV that does not accept DIAL connections from other networks even after successful SSDP discovery.

Nice! Will give it a try later today!
About Dial, I do have a LG TV in my IoT vlan so maybe I should implement it correctly. Never noticed an issue, but I only have my network setup like this, with iot and iptv vlans for a week now haha. Could you give me some directions about the firewall changes for dial? :D

Main reason I use MDNS and SSDP are my chromecasts and wireless sonos speakers which both are in IoT vlan!

#4

26.7, 26.10 Series / Re: issue with legacy firewall...

Last post by Andreas1 - Today at 10:35:21 AM

Ahh, didn't saw it (I was searching for firewall migration assistent and missed out NAT).
Thanks nero355 for your help I'll try it and report back.

#5

26.7, 26.10 Series / [SOLVED] No health graphs sinc...

Last post by szty0pa - Today at 09:38:32 AM

Hmm, after a reboot it seems to work fine now. Wonder why it didn't help before.* Thanks for the replies.

*(Found the culprit: the openvpn watcher script was hogging the CPU, so there was no time for the data collector to run...)

#6

Zenarmor (Sensei) / Malware/Virus tagged on TLS st...

Last post by mokaz - Today at 09:28:40 AM

Hi there,

I recently spotted some ZA alerts which, according to my readings, is solely matched by an SNI and gave it a Malware/Virus tag:

Destination hostname: fdroid.link
Destination IP: 37.218.243.44
Destination port: 443
Destination username: -
Direction: out
Dst Nbytes: 5514
Dst Npackets: 11
Encryption: TLS-Encrypted
Tags: Malware/Virus Encrypted SSL SSL V3 Web Browsing

Can you confirm my verdict? In fact simply browsing "fdroid.link" would trigger such alerts, this while zero DPI/ssl inspection are enabled.
On what exactly is your judgment made?

Let me know,
m.

#7

26.7, 26.10 Series / Re: No link with Intel E810 on...

Last post by tuto2 - Today at 08:53:46 AM

Yup, that seems to have done the trick! Updated the kernel, removed the FEC tunables from ice0/ice1, rebooted, and the link came up with no intervention, exactly as expected.

Nice, thanks for testing!

Skimming dmesg, I did notice a few VLAN errors on those NICs (which I also saw in @paoba's post #31), but I couldn't tell you whether these existed prior to either 26.10 or this patched kernel, so I just thought I'd mention it.

These are unrelated to this patch, but shouldn't cause any issues as far as I know.

#8

General Discussion / Re: CrowdSec integrated with L...

Last post by mokaz - Today at 08:08:38 AM

Oki did a quick experiment on the CS API node:

Code Select Expand

systemctl stop crowdsec
cp /var/lib/crowdsec/data/crowdsec.db /root/crowdsec.db.bak
systemctl start crowdsec

Followed by a total prune of both alerts and decisions and I did add a manual decision to test:

Code Select Expand

cscli alerts delete -a
cscli decisions delete --all
cscli decisions add --ip x.x.x.x --duration 90d --reason manual-restore --type ban

And the unique and new decision has been instantly displayed within the OPNsense GUI.

Timeout issue somewhat?

Thanks,
m.

#9

General Discussion / CrowdSec integrated with LAPI ...

Last post by mokaz - Today at 07:45:39 AM

Hi all,

I'm using CrowdSec locally and integrated it with a local "Brain" node, over the LAPI.
It works fine however, my only concern is that for some reasons, under GUI > Services > CrowdSec > Decisions -- I'm provided with a waiting wheel forever.

Though, running the given "cscli decisions list -a" through an SSH session would effectively list me all the decisions although it takes a while to display. Most probably because there are loads of data pulled somehow.. And my guess is that these entries are parsed as well "14291 duplicated entries skipped"..

It is a cosmetic issue altogether / I just perhaps wanted to poll if there are any central cleanings to be conducted to light this up? Or adjust any timeout values around the CrowdSec OPNsense plugin itself perhaps ?

Thanks,
m.

#10

26.7, 26.10 Series / Re: No link with Intel E810 on...

Last post by franco - Today at 04:20:35 AM

Yup, that seems to have done the trick! Updated the kernel, removed the FEC tunables from ice0/ice1, rebooted, and the link came up with no intervention, exactly as expected.

That's good news for 26.7.9 and 26.10.0p1.  :)


Cheers,
Franco