"Recent posts
#1
26.7 Series / Had to reinstall and
Last post by Karla - Today at 08:50:43 PMthen I had to delete all partitions with Gparted to proceed with installation.
#2
Development and Code Review / Re: netflector available as pl...
Last post by UnicronHD - Today at 08:23:58 PM@RamSense I have identified the problem with the ICMP unreachable responses. It has to do with the fact that WG tunnel has no broadcast and no multicast domains. I'm working on the solution.
#3
26.7 Series / Problem where fallback DNS is ...
Last post by Lucid1010 - Today at 08:16:15 PMYou cannot view this attachment.
I am currently using AdGuard Home as my main DNS server.
AdGuard Home responds immediately and works without issue.
However, whenever a DNS query is made, my device alternates between AdGuard Home (192.168.1.1) and Cloudflare DNS(1.1.1.1).
Is it possible to set it up so AdGuard Home is used as the sole primary DNS,
and Cloudflare DNS is only used as a fallback when AdGuard Home is delayed or unresponsive?
Code Select
$ cat /etc/resolv.conf
# This file was automatically generated by system_resolvconf_generate()
# If you want to append configuration here use /etc/resolv.conf.local
domain xxxxxxxxxxxxxxxx
nameserver 192.168.1.1
nameserver 1.1.1.1
nameserver 1.0.0.1
search xxxxxxxxxxxxxxxCode Select
$ drill google.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 41425
;; flags: qr rd ra ; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; google.com. IN A
;; ANSWER SECTION:
google.com. 114 IN A xxxxxxx
xxx
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 0 msec
;; SERVER: 192.168.1.1
# --
$ drill google.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 13948
;; flags: qr rd ra ; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; google.com. IN A
;; ANSWER SECTION:
google.com. 281 IN A xxx
xxxx
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 4 msec
;; SERVER: 1.1.1.1I am currently using AdGuard Home as my main DNS server.
AdGuard Home responds immediately and works without issue.
However, whenever a DNS query is made, my device alternates between AdGuard Home (192.168.1.1) and Cloudflare DNS(1.1.1.1).
Is it possible to set it up so AdGuard Home is used as the sole primary DNS,
and Cloudflare DNS is only used as a fallback when AdGuard Home is delayed or unresponsive?
#4
German - Deutsch / Re: [Hardware] Temperaturen
Last post by HBerger - Today at 06:05:10 PMVon meiner Seite leider noch nix definitives :-)
Kann erst heute Abend wieder physisch an dem gerät tätig werden.
Aber im INet gibt es mehrere Berichte, das die passiven Teile recht warm sind, in Verbindung mit aggressiven Power Einstellungen.
Leider ohne richtige detaillierte Erfolgsmeldungen.
Es wird auch immer berichtet, das das absenken der P1 / P2 Leistung nicht so viel bringt.
Wenn ich mich richtig erinnere, steht P1 schon auf 6W (60000) und P2 auf 10W (100000), muss ich aber noch verifizieren.
Das schöne bei dem KingnovyPC ist, das Bios ist ziemlich offen. man kann sehr viel einstellen.
Das komplizierte ist, es unterscheidet sich immer bisserl von den anderen vom Naming und den Settings, z.b. Topton, wo es einige Guides zu gibt :-)
Eigentlich, wenn der nicht viel macht, müsste wenn dann P0 (sollten 6W sein) relevant sein oder besser die C States aktiviert sein.
Oder er hat einfach nur grässliche Spannungswandler / Schlechtes Power Design, das es gar nicht die CPU ist sondern die Wandler so heizen.
Am meisten wird berichtet, das ein Fan hilft ... bye bye lüfterloses Design :-)
Kann erst heute Abend wieder physisch an dem gerät tätig werden.
Aber im INet gibt es mehrere Berichte, das die passiven Teile recht warm sind, in Verbindung mit aggressiven Power Einstellungen.
Leider ohne richtige detaillierte Erfolgsmeldungen.
Es wird auch immer berichtet, das das absenken der P1 / P2 Leistung nicht so viel bringt.
Wenn ich mich richtig erinnere, steht P1 schon auf 6W (60000) und P2 auf 10W (100000), muss ich aber noch verifizieren.
Das schöne bei dem KingnovyPC ist, das Bios ist ziemlich offen. man kann sehr viel einstellen.
Das komplizierte ist, es unterscheidet sich immer bisserl von den anderen vom Naming und den Settings, z.b. Topton, wo es einige Guides zu gibt :-)
Eigentlich, wenn der nicht viel macht, müsste wenn dann P0 (sollten 6W sein) relevant sein oder besser die C States aktiviert sein.
Oder er hat einfach nur grässliche Spannungswandler / Schlechtes Power Design, das es gar nicht die CPU ist sondern die Wandler so heizen.
Am meisten wird berichtet, das ein Fan hilft ... bye bye lüfterloses Design :-)
#5
26.7 Series / Re: Need to set "far gateway" ...
Last post by franco - Today at 05:40:13 PMFar gateway is not enforced for IPv6 for historic reasons:
https://github.com/opnsense/core/blob/817f670cff30e4639bf362febdc6ed263514ea14/src/etc/inc/system.inc#L780
So something else must be going on.
Cheers,
Franco
https://github.com/opnsense/core/blob/817f670cff30e4639bf362febdc6ed263514ea14/src/etc/inc/system.inc#L780
So something else must be going on.
Cheers,
Franco
#6
26.7 Series / Need to set "far gateway" to r...
Last post by drosophila - Today at 04:51:10 PMSince the previous update (noticed it after hotfix _8 but may have existed earlier), for IPv6 I need to set the gateway to "far gateway" to make OPNsense assign a default route for IPv6. This was not necessary before. I don't mind, but it still seems off somehow. The setup may be a little unusual in that (as some may recall from previous issues) my WAN interface has a bunch of different IP6 addresses, with two prefixes (one local and one public), because it is a router-behind-router setup but with the public side on the "interconnect LAN". Both addresses are assigned by the external router via SLAAC. To have reliable routing, reliable admin access and cohesive logs I set the route through the local address of the external router via the gateway configuration.
I assume that, once again, the ordering of the IP addresses matters, like with the gateway watcher. But the ordering is essentially random, so it must not be relied on, but since there is no "main address", the code cannot pin down which is supposed to be the "main" address. Also, I re-order the addresses via a script after the fact, but that should not normally affect the default route. The script removes and re-adds IP addresses, so it might be reasonable to assume that the default route gets purged when the respective address vanishes, but 1) there always is at least one address available in each prefix and 2) the issue persists across reboots, and it never failed before, and "far gateway" seems to reliably fix the problem.
So, long story short: is this intended? IOW, is it to be expected that the default route isn't set if the gateway has multiple prefixes, assigned by SLAAC?
I assume that, once again, the ordering of the IP addresses matters, like with the gateway watcher. But the ordering is essentially random, so it must not be relied on, but since there is no "main address", the code cannot pin down which is supposed to be the "main" address. Also, I re-order the addresses via a script after the fact, but that should not normally affect the default route. The script removes and re-adds IP addresses, so it might be reasonable to assume that the default route gets purged when the respective address vanishes, but 1) there always is at least one address available in each prefix and 2) the issue persists across reboots, and it never failed before, and "far gateway" seems to reliably fix the problem.
So, long story short: is this intended? IOW, is it to be expected that the default route isn't set if the gateway has multiple prefixes, assigned by SLAAC?
#7
Virtual private networks / Twingate Connector
Last post by Glitch01 - Today at 02:37:10 PMI have an issue where I've established people can connect to my Twingate connector and connect to my endpoint resources where I can authenticate to the remote connector, but cannot connect to their endpoints through Opnsense. If I bypass Twingate completely, I can authenticate to the remote Twingate connector and connect to their endpoints. When connected through Opnsense, I cannot ping or establish remote connections (ssh, rdp, ftps, etc...). Originally, I would see the FW logs blocking outbound for the allowed TCP ports below. After creating an allow outbound rule, the traffic is successfully going out but I'm still having issues connecting to the remote clients through Twingate. Appreciate any insights. Thanks.
Block rules implemented
Block Private Ranges
10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16
Crowdsec_blocklists for the most common 3 block list for known threats
GeoBlocking from Maxmind
Allowed outbound for ports TCP 30000-31000
Exclusion for subnets on my network and the remote network.
Block rules implemented
Block Private Ranges
10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16
Crowdsec_blocklists for the most common 3 block list for known threats
GeoBlocking from Maxmind
Allowed outbound for ports TCP 30000-31000
Exclusion for subnets on my network and the remote network.
#8
26.7 Series / [CALL FOR TESTING] Wireless MV...
Last post by franco - Today at 01:52:45 PMHello!
To ease future interface settings via the new assignments MVC/API, the wireless code was reworked and removed from interface settings.
https://github.com/opnsense/core/commit/708994978f
If you have a wireless setup on 26.7.3 please consider help testing the backport that is scheduled for 26.7.4 next week. We don't expect a lot of noise regarding this change, but want to have an extra opportunity to find issues early.
To install:
# opnsense-patch https://github.com/opnsense/core/commit/708994978f
# pluginctl -m
The easiest way would be to reboot and see if wireless still comes up as expected. If it does that's good. Please do let us know in either case.
Cheers,
Franco
To ease future interface settings via the new assignments MVC/API, the wireless code was reworked and removed from interface settings.
https://github.com/opnsense/core/commit/708994978f
If you have a wireless setup on 26.7.3 please consider help testing the backport that is scheduled for 26.7.4 next week. We don't expect a lot of noise regarding this change, but want to have an extra opportunity to find issues early.
To install:
# opnsense-patch https://github.com/opnsense/core/commit/708994978f
# pluginctl -m
The easiest way would be to reboot and see if wireless still comes up as expected. If it does that's good. Please do let us know in either case.
Cheers,
Franco
#9
German - Deutsch / Re: [Hardware] Temperaturen
Last post by viragomann - Today at 01:46:17 PMUnd was sagt die Recherche zu den Systemtemperaturen? Über 60° im Idle sollten doch nicht normal sein.
Ich habe eine ähnliche Kiste, doch Jahre älter, mit einem i5-4200U (TDP 15W, lüfterlos). Allerdings läuft darauf openSUSE, auf dem OPNsense und noch ein Webserver virtuaisiert sind. Daneben laufen noch ein paar Services. Die CPU hat aber auch selten viel zu tun.
Die Kerntemperatur beträgt da um 40°, die der mSATA um 43°
Das Ding läuft nun das 9. Jahr. Ersetzt habe ich im letzten Jahr nur die magn. SSD, die als Datenspeicher für Nextcloud und Backups genutzt wird.
Ja, für/tmp nutze ich eine RAM Disk und die CPU-Einstellung im BIOS ist eher auf Sparsamkeit gestellt. Diese Einstellung lässt auch nur 60° max. zu.
Ich habe eine ähnliche Kiste, doch Jahre älter, mit einem i5-4200U (TDP 15W, lüfterlos). Allerdings läuft darauf openSUSE, auf dem OPNsense und noch ein Webserver virtuaisiert sind. Daneben laufen noch ein paar Services. Die CPU hat aber auch selten viel zu tun.
Die Kerntemperatur beträgt da um 40°, die der mSATA um 43°
Das Ding läuft nun das 9. Jahr. Ersetzt habe ich im letzten Jahr nur die magn. SSD, die als Datenspeicher für Nextcloud und Backups genutzt wird.
Ja, für/tmp nutze ich eine RAM Disk und die CPU-Einstellung im BIOS ist eher auf Sparsamkeit gestellt. Diese Einstellung lässt auch nur 60° max. zu.
#10
26.7 Series / Re: SOLVED: Transparent Filter...
Last post by psehorne - Today at 01:45:15 PMQuote from: lmoore on Today at 08:23:43 AMOf the few articles I viewed, written and videos, they all mentioned disabling the anti-lockout rules for the LAN interface.
I chose not to disable the anti-lockout rules
