"Recent posts
#1
Development and Code Review / Re: netflector available as pl...
Last post by UnicronHD - Today at 11:20:41 PMQuote from: vicking on <strong>Today</strong> at 08:48:28 PMNice!
Currently I run mdns repeater and ssdpreflector between my lan and iot vlan.
If I am correct I can drop these packages for this single package? :D
It would seem so, yes. Let me know if you need help with the configuration. If you will want to enable dial - you will probably require some firewall adjustments (for input chain to accept DIAL responses from IOT VLAN). If everything works for you now though - you will probably only need mdns and ssdp set to true. Dial is for things like my stupid LG TV that does not accept DIAL connections from other networks even after successful SSDP discovery.
#2
26.7, 26.10 Series / Re: Gradual Internet Performan...
Last post by tonys - Today at 10:56:45 PMUpdate: The aforementioned removal of all IPV6 enables helped for a while but last night, the network began stalling again, mostly on streaming services like SiriusXM, Facebook, and Youtube. So I reenabled the external VPN on my phone and the streaming services worked again. Before reenabling the VPN, I checked the Unbound logs and found no blocks occurring at all so I don't think these streaming stalls are related to DNS. I also noted that when the VPN is on, I don't see any transactions from the device I'm using in the firewall logs - turning the VPN off does show transactions and they're all going through. All this really says is that the use of external VPNs allows packets to sail through the firewall rules as well as DNS.
This morning, all my devices were laggy or unavailable on the internet... I couldn't even retrieve my email. Also, on my Mac, I was unable to log into this board so I reenabled the VPN on both the phone and the Mac. Checking the current the OPNSense state list:
# pfctl -s states | wc -l
1299
1299 states? Really? Yesterday, the state count was hovering around 300 earlier in the day. Next, I checked the WAIT states:
# pfctl -s states | grep "_WAIT" | wc -l
49
Not too bad but this doesn't explain where all the other states are coming from after an overnight of very little activity. Looking in the state table for each VLAN (IoT and Guest), I see about 25 states each, not bad at all. Looking at the state table for the LAN however, I see 1226 established states! Past experience with 26.7.x has shown that a large state table really slows down all the LAN/VLANs so on the surface, it seems that these established states may be preventing me from turning off the VPN on my Mac and phone. Note that I don't use any state tracking other than "Keep State" - there are no sloppy states defined in any of my LAN/VLANs.
My experiment just now was to clear the LAN state table completely. Now I see:
# pfctl -s states | wc -l
143
# pfctl -s states | grep "_WAIT" | wc -l
77
This is very typical during daytime activity and I don't need to turn the VPN on. The 77 _WAIT states are all on the LAN. Most notable is that after reseting the LAN states, all my streaming services are back up and running without having to turn on the VPN.
At this point, I'm wondering why the state table grows so large over the course of a day, mostly in the evening and overnight. I'm fairly certain that the growing state table ovwe 12-15 hours (both established and _WAIT states), is the cause of my network stalls and streaming service blockages. I have no idea why, I'm simply correlating the size of the state table vs ability to access the internet. The larger the state table grows, the slower my internet access gets and eventually nearly comes to a complete halt without an external VPN enabled.
Going back to disabling IPV6 yesterday - the OPNSense GUI is now responsive again, all the time, even when the state table is huge. So there's a direct correlation between disabling IPV6 and usability of the web gui. Also, I did (and still do) have "prefer IPV4 over IPV6" turned on but that didn't help at all when IPV6 was still enabled in the WAN gateway. Simply disabling IPV6 in the gateway was all it took to get the OPNSense GUI responsive again, so this goes back to OPNSense 26.7.x and my ISP not playing nice together regarding IPV6. OPNSense 21.x had no problems getting an IPV6 address from my ISP... why can't 26.7.x?
Back in the 21.x days, I always had both an IPV4 and IPV6 address with my ISP and I never saw any of these OPNSense GUI stalls/extreme slowness. I have to wonder whether the IPV6 state bug was resolved since I can't get an IPV6 address from my ISP afte4r upgrading to 26.7. The one time I did get an IPV6 address was during numerous debug cycles and reboots and that IPV6 address didn't survive the following reboot. For now, I need to focus on why my state table is growing during the day and gets very large at night. Tonight, I'll clear the LAN state table as soon as SiriusXM and Youtube refuse to load without the VPN, and see if doing just this alone restores the streaming services again.
This morning, all my devices were laggy or unavailable on the internet... I couldn't even retrieve my email. Also, on my Mac, I was unable to log into this board so I reenabled the VPN on both the phone and the Mac. Checking the current the OPNSense state list:
# pfctl -s states | wc -l
1299
1299 states? Really? Yesterday, the state count was hovering around 300 earlier in the day. Next, I checked the WAIT states:
# pfctl -s states | grep "_WAIT" | wc -l
49
Not too bad but this doesn't explain where all the other states are coming from after an overnight of very little activity. Looking in the state table for each VLAN (IoT and Guest), I see about 25 states each, not bad at all. Looking at the state table for the LAN however, I see 1226 established states! Past experience with 26.7.x has shown that a large state table really slows down all the LAN/VLANs so on the surface, it seems that these established states may be preventing me from turning off the VPN on my Mac and phone. Note that I don't use any state tracking other than "Keep State" - there are no sloppy states defined in any of my LAN/VLANs.
My experiment just now was to clear the LAN state table completely. Now I see:
# pfctl -s states | wc -l
143
# pfctl -s states | grep "_WAIT" | wc -l
77
This is very typical during daytime activity and I don't need to turn the VPN on. The 77 _WAIT states are all on the LAN. Most notable is that after reseting the LAN states, all my streaming services are back up and running without having to turn on the VPN.
At this point, I'm wondering why the state table grows so large over the course of a day, mostly in the evening and overnight. I'm fairly certain that the growing state table ovwe 12-15 hours (both established and _WAIT states), is the cause of my network stalls and streaming service blockages. I have no idea why, I'm simply correlating the size of the state table vs ability to access the internet. The larger the state table grows, the slower my internet access gets and eventually nearly comes to a complete halt without an external VPN enabled.
Going back to disabling IPV6 yesterday - the OPNSense GUI is now responsive again, all the time, even when the state table is huge. So there's a direct correlation between disabling IPV6 and usability of the web gui. Also, I did (and still do) have "prefer IPV4 over IPV6" turned on but that didn't help at all when IPV6 was still enabled in the WAN gateway. Simply disabling IPV6 in the gateway was all it took to get the OPNSense GUI responsive again, so this goes back to OPNSense 26.7.x and my ISP not playing nice together regarding IPV6. OPNSense 21.x had no problems getting an IPV6 address from my ISP... why can't 26.7.x?
Back in the 21.x days, I always had both an IPV4 and IPV6 address with my ISP and I never saw any of these OPNSense GUI stalls/extreme slowness. I have to wonder whether the IPV6 state bug was resolved since I can't get an IPV6 address from my ISP afte4r upgrading to 26.7. The one time I did get an IPV6 address was during numerous debug cycles and reboots and that IPV6 address didn't survive the following reboot. For now, I need to focus on why my state table is growing during the day and gets very large at night. Tonight, I'll clear the LAN state table as soon as SiriusXM and Youtube refuse to load without the VPN, and see if doing just this alone restores the streaming services again.
#3
26.7, 26.10 Series / Re: PPPoE over an unassigned V...
Last post by johndoeuser - Today at 10:07:50 PMWill have a go at it asap. You're the best, tnx.
#4
Development and Code Review / Re: netflector available as pl...
Last post by vicking - Today at 08:48:28 PMNice!
Currently I run mdns repeater and ssdpreflector between my lan and iot vlan.
If I am correct I can drop these packages for this single package? :D
Currently I run mdns repeater and ssdpreflector between my lan and iot vlan.
If I am correct I can drop these packages for this single package? :D
#5
26.7, 26.10 Series / Re: Is sloppy state tracking a...
Last post by FlyveHest - Today at 08:27:49 PMQuote from: nero355 on <strong>Today</strong> at 08:10:59 PMDo you use MACVLAN for your Docker Network ?
If not : You should! :)
I don't no, but the fix was pretty easy, I just had to add another PBR rule for the Docker network bridge and now everything works as it should.
Once again, thanks a bunch for the great help, now that the basic setup is done, I can get into the fun stuff and the main reason I chose to run OPNSense.
#6
26.7, 26.10 Series / Re: issue with legacy firewall...
Last post by nero355 - Today at 08:19:37 PMQuote from: Andreas1 on <strong>Today</strong> at 05:55:04 PMNow I have the current version 26.7.8_2 and no migration assistent anymore.IIRC you don't even need it : Just Export and Import the Rules again and you are done ??
Deleting the old Rules can also be done via your config.xml I think ?
There was a similar topic a week ago : https://forum.opnsense.org/index.php?topic=53280.0
#7
26.7, 26.10 Series / Re: Gradual Internet Performan...
Last post by nero355 - Today at 08:13:51 PMQuote from: pfry on <strong>Today</strong> at 04:26:10 PMrc.conf:The second setting via the webGUI solves update issues for some in certain cases, but none of those things changes anything to a Android/Apple/Linux/Windows Client ofcourse ;)
ip6addrctl_enable = "YES"
ip6addrctl_policy = "ipv4_prefer"
OPNsense: "System: Settings: General" -> "Networking" -> "Prefer IPv4 over IPv6"
I also only use IPv4 only, with no IPv6 address assignments or discovery, and "net.inet6.ip6.auto_linklocal = 0", so I can't comment on effect.
#8
26.7, 26.10 Series / Re: Is sloppy state tracking a...
Last post by nero355 - Today at 08:10:59 PMQuote from: FlyveHest on <strong>Today</strong> at 07:00:46 PMThis has unearthed a new problem, unfortunately, because the issue is still present, but only on services published through Docker.Do you use MACVLAN for your Docker Network ?
So, this is probably because there is some form of masquerading or other package mangling happening after routing has happened, leading to the traffic still being sent out the wrong interface.
If not : You should! :)
#9
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - Today at 07:54:58 PMI think I was in the middle of setting this part up when chat gpt messed up last week, vlan 99 doesn't have anything setup.
My laptop is running CachyOS and in network manager its a wired manual ipv4 address of the one in the photo below.
I have various manual IPS on that connection and when I switch to personal vlan 20 I just switch it to wired automatic ipv4 to receive an IP in that personal range thats shown below. I confirm it does receive an IP ending between 20.100 - .20.200
Im still learning how IPs work, If I set it up like the rest of ranges ie: x.x.99.100-x.x.99.200 wont that exclude the manual laptop IP 192.168.99.10 because its lower than .99.100?
For the Xbox vlan I will have to check that to make sure.
My laptop is running CachyOS and in network manager its a wired manual ipv4 address of the one in the photo below.
I have various manual IPS on that connection and when I switch to personal vlan 20 I just switch it to wired automatic ipv4 to receive an IP in that personal range thats shown below. I confirm it does receive an IP ending between 20.100 - .20.200
Im still learning how IPs work, If I set it up like the rest of ranges ie: x.x.99.100-x.x.99.200 wont that exclude the manual laptop IP 192.168.99.10 because its lower than .99.100?
For the Xbox vlan I will have to check that to make sure.
#10
26.7, 26.10 Series / Re: Messages in firewall log w...
Last post by vimage22 - Today at 07:52:30 PMIs this related to issue? No label? All firewall logging rules are disabled.
