Recent posts

#1

Virtual private networks / Re: Creating VLANs with Dnsmas...

Last post by nero355 - Today at 10:06:37 PM

VLANs are assigned to my LAN port (10Gb) which is uplinked to my switch.

- Is the Port on the Switch configured as TAGGED ?
- How did you configure the Port where the Accesspoint is connected ?
- How did you configure the Accesspoint ?
- Do you have more than 1 Switch ?
- Did you copy the Default Allow Any to Any Firewall Rule from the Default LAN network to the VLAN Interface network ?

For a VLAN tag 20 with range X.X.20.2-X.X.20.254 I'm assuming the DHCP server IP I specify on the switch is X.X.20.1  ?

That is one of the correct options and in this case the most used one :)

But I assume you don't do it on the Switch and configure on your OPNsense instead ?!

#2

26.7, 26.10 Series / Re: Changing to Business editi...

Last post by DEC740airp414user - Today at 10:01:27 PM

Upgrade successful

🙌🏻

#3

Virtual private networks / Re: Creating VLANs with Dnsmas...

Last post by malebron - Today at 09:58:27 PM

Thanks nero355

VLANs are assigned to my LAN port (10Gb) which is uplinked to my switch.

They show listed under the interfaces tab and under Interfaces: Devices: VLAN

Correct DHCP ranges are shown on interfaces: Assignments

Under Services: Dndmasq DNS and DHCP: General the VLANS are listed under Devices ("All" is selected)

QUESTION:
For a VLAN tag 20 with range X.X.20.2-X.X.20.254 I'm assuming the DHCP server IP I specify on the switch is X.X.20.1  ?

Thx

#4

Virtual private networks / Re: Creating VLANs with Dnsmas...

Last post by nero355 - Today at 09:27:04 PM

Sounds like you have not created any VLAN Interfaces and assigned them to one of your unused NICs ?

Please post what you have done so far step-by-step and what is working or not exactly ;)

#5

26.7, 26.10 Series / Re: OPNsense as mail gateway, ...

Last post by nero355 - Today at 09:19:38 PM

The user base for postfix/rspamd is probably more silent that you might wish. Impossible to say what size it is. More postfix and rspamd plugin development would probably change that, but that is also purely dependent on the user base.

What are you saying exactly ?
Is Postfix becoming deprecated ?
Or is there just less and less support for it when the OS it runs on is FreeBSD ?

I ran Plesk as mail gateway, which also gives you more than postfix.

You can configure amavis and spamassassin and more in it.

Of course the convenience of getting all these features easily configured and up to date + modern Webgui costs some subscription money.

Plesk/cPanel/DirectAdmin were pretty much THE ONES to use when I use to work for a Hosting/Server Rental Company in the past :)

But it's a lot of software for just e-mailing to be honest...

But I would rather use a dedicated server for mail stuff.

+1 here!

My opinion is that a lot of people "overload" their OPNsense with too much stuff that does not belong on it and could also avoid a lot of update/upgrade issues!

Nowadays I'd stick to proxmox Mail gateway.

Also a good option IMHO considering the fact that it has been developed for a decent amount of years by now so it should be a solid product! :)

#6

Virtual private networks / Creating VLANs with Dnsmasq DH...

Last post by malebron - Today at 09:09:40 PM

Using OPNsense 26.7.7 on bare metal with a Unify managed switch (USW Pro SG8) and several Unify APs. My very basic flat network has worked well for years.

I finally decided to add VLANs for Guest and IOT. Before starting I upgraded everything to the most recent releases, including migrating from ISC DHCP to Dnsmasq DHCP as recommended. Everything went smoothly.

I followed the steps in several videos as carefully as possible, but they were based on older software versions with different UIs.

Everything looks right as far as I can tell, but when I try to connect via WiFi to the IOT SSID connection fails with "cannot get IP address". I assume the problem is in the DHCP setup somewhere, but I can't find it. (Everything else is working as before)

Observations
In the videos using ISC DHCP there is a simple checkbox to activate DHCP for each VLAN. I can't find anything equivalent for Dnsmasq. It seems you just set the range and enable for all interfaces under Dnsmasq-General.

One video showed the VLANs listed under Interfaces on the dashboard. I only see the physical interfaces listed (LAN and WAN).

Any help in troubleshooting this would be appreciated. It's very basic setup so I'm probably missing something obvious.

Thank you!

#7

Zenarmor (Sensei) / Re: CPU spikes from Elasticsea...

Last post by Greg_E - Today at 08:59:26 PM

Not on mine, seeing about 9% cpu when someone is doing work on the web.

#8

Zenarmor (Sensei) / Re: Newest version zenarmor ca...

Last post by Greg_E - Today at 08:58:30 PM

Mine did not do this when I upgraded to the latest engine.

#9

26.7, 26.10 Series / Re: Cert Based WIFI Authentica...

Last post by nero355 - Today at 08:53:08 PM

Devices without that support (printers, TVs) need a separate WPA2-PSK SSID instead.

They could use MAC Address Authentication, but that's considered very weak in general so maybe just avoid it completely :)


But I wonder...


If someone needs a HowTo/Tutorial to setup the whole thing : Is it a good idea at all to start using such a setup ?!
Because when things break you need to know how to fix it !!
And there is no HowTo/Tutorial for that... ;)

#10

Development and Code Review / Re: netflector available as pl...

Last post by UnicronHD - Today at 08:48:19 PM

Any chance for SSDP via wireguard? Adding peers did not help.

SSDP over WireGuard should work, but peers are not the part that makes it work. Discovery over a tunnel depends on the client searching. When the phone's M-SEARCH arrives on the WireGuard interface, netflector relays it to the LAN and sends the devices' unicast replies back to the phone. That leg needs no peers. Peers only cover the devices' periodic NOTIFY advertisements, which reach a peer as unicast on port 1900. A client sees those only if it listens on that port, and most find devices by searching anyway.

Things to check:

• Searches go from Source to Target. With the phones behind the tunnel, set the reflector up as:
  
  • Source: your WireGuard interface
  • Target: LAN
  • SSDP: checked
  • Source peers: the phones' tunnel addresses, e.g. 10.10.10.2
  With the WireGuard interface as Target and Bidirectional unchecked, the phone's searches are counted as skipped and never relayed.
• Check that the search reaches the firewall at all. Run this in a shell while the app is searching, with your WireGuard interface's device name:
  
  Code Select Expand
  tcpdump -ni wg0 udp port 1900The phone's WireGuard only sends to destinations in its AllowedIPs, so 239.255.255.250 has to be covered (0.0.0.0/0, or add 239.255.255.250/32). Some apps also search only on Wi-Fi whatever the VPN does. If tcpdump shows nothing, netflector has nothing to relay.
• Once a device is found, the app connects to its LAN address, so the phone's AllowedIPs need the LAN subnet, and a firewall rule on the WireGuard interface has to let it reach the LAN. Some TVs refuse clients from another subnet; for casting, checking DIAL works around that.

If it still fails, please post /usr/local/etc/netflector.toml, the netflector and os-netflector versions, the client and app, the tcpdump output, and the log (Services > Netflector > Log File) with Log level set to Debug on the General tab. The line I'm looking for starts with "reflected SSDP search from 10.10.10.2".