"Recent posts
#1
Virtual private networks / Access of OpenVPN clients to I...
Last post by HatalaTitla48 - Today at 07:10:03 PMHi, Im searching for solution on howto let OpenVPN users access to the subnets behind IPsec vpn tunel. I did not find any up to date howto, just some hints here and there without any comprehensive text explaining how to setup this in current version of opnsense.
Connection schema is very basic, just: |*opnsensebox1 with (openvpn(for users) + ipsec vpn(s2s)*| --> |*opnsensebox1 with ipsec vpn(s2s)*|.
All I need right now is for users of openvpn(192.168.202.0/27 on box1) to access subnets(172.25.26.0/24) on box2 behind ipsec. So far I found only this "https://forum.opnsense.org/index.php?topic=40665.0" discussion, but it did not work for me. I must ommiting some additional steps needed for configuration. Do anybody has any functional instructions howto to achieve this?
Thx in sdvance.
Connection schema is very basic, just: |*opnsensebox1 with (openvpn(for users) + ipsec vpn(s2s)*| --> |*opnsensebox1 with ipsec vpn(s2s)*|.
All I need right now is for users of openvpn(192.168.202.0/27 on box1) to access subnets(172.25.26.0/24) on box2 behind ipsec. So far I found only this "https://forum.opnsense.org/index.php?topic=40665.0" discussion, but it did not work for me. I must ommiting some additional steps needed for configuration. Do anybody has any functional instructions howto to achieve this?
Thx in sdvance.
#2
26.7 Series / os-net-snmp: OID for pending f...
Last post by DanielD - Today at 07:02:12 PMI manage several OPNsense firewalls for clients and monitor them through our RMM (NinjaOne) using SNMPv3 via os-net-snmp, on 26.7.7.
"Display Version in OID" works well. The installed version comes through as an nsExtend entry, and we monitor it. What we'd really like is an alert when a firewall has pending updates, raised on the firewall itself, the same way a Synology DSM exposes an "upgrade available" OID.
The data is there (dashboard update notice / /api/core/firmware/status), but our RMM's network monitoring can only poll SNMP, not the REST API, and I'd rather not hand-edit snmpd.conf across a fleet.
Is there an existing way to do this that I've missed? If not, would a "Display update status in OID" option be feasible, similar to the version option? For example, an extend returning none / update / upgrade from the last firmware check, or simply an integer (0 = no updates, 1 = updates available), which is easier to alert on.
Happy to test.
"Display Version in OID" works well. The installed version comes through as an nsExtend entry, and we monitor it. What we'd really like is an alert when a firewall has pending updates, raised on the firewall itself, the same way a Synology DSM exposes an "upgrade available" OID.
The data is there (dashboard update notice / /api/core/firmware/status), but our RMM's network monitoring can only poll SNMP, not the REST API, and I'd rather not hand-edit snmpd.conf across a fleet.
Is there an existing way to do this that I've missed? If not, would a "Display update status in OID" option be feasible, similar to the version option? For example, an extend returning none / update / upgrade from the last firmware check, or simply an integer (0 = no updates, 1 = updates available), which is easier to alert on.
Happy to test.
#3
General Discussion / Re: New WAN failover configura...
Last post by bob9999 - Today at 06:54:54 PMnero355:
I want my DNS ad blocker on the router because that creates fewer potential failure points. I used run pihole long ago for a different router. I had 2 pihole servers on 2 PCs running in Hyper-V on Ubuntu Server. Windows knocked both off when they stopped a restart to advertise Windows 11. Lesson learned.
The ad blocker stay on the router. Otherwise there's no point in using OPNsense. My old ER605 V2 has some easy load balancing / failover double WAN setups built right in and VLANS are also much easier with TP-Link. Going that way adds failure points because of external ad blockers for DNS. Potential failure points need to be avoided. GLINet has 2 models, the Flint 2 and Flint 3, which both have enough RAM and storage to support a realistic Adguard Home server. The other models they sell are too small to hold any more than a light basic configuration. Mikrotik can support Adguard Home in a container, but I avoid those, they have fans but I only see unreliability if I look hard enough.
My thinking is if OPNsense offers a configuration like this one, they should be able to illustrate workable configurations. My setup is not at all a strange one. To my thinking, there should be a documentation page that deals with common problems like this. The DNS LAN rule illustration was fragmentary at best.
Wikipedia has a list of ports in use and possible use. If its not mentioned then it's OK to use. I chose 3100.
The big news is that it seems to work now for LoadBalancing. The LAN rule points to the LoadBalancing gateway group. A DNS rule was put above the LAN rule. There seemed to be an error in how the DNS rule was configured. There was not enough detail in the official OPNsense documentation.
Adguard home works on the network, but I can't get to the Adguard Home interface again, even with the new port. But I tested it and it works as an ad blocker on my TVs. So now, access to the Adguard Home interface is the new problem to fix. Help would be appreciated.
I want my DNS ad blocker on the router because that creates fewer potential failure points. I used run pihole long ago for a different router. I had 2 pihole servers on 2 PCs running in Hyper-V on Ubuntu Server. Windows knocked both off when they stopped a restart to advertise Windows 11. Lesson learned.
The ad blocker stay on the router. Otherwise there's no point in using OPNsense. My old ER605 V2 has some easy load balancing / failover double WAN setups built right in and VLANS are also much easier with TP-Link. Going that way adds failure points because of external ad blockers for DNS. Potential failure points need to be avoided. GLINet has 2 models, the Flint 2 and Flint 3, which both have enough RAM and storage to support a realistic Adguard Home server. The other models they sell are too small to hold any more than a light basic configuration. Mikrotik can support Adguard Home in a container, but I avoid those, they have fans but I only see unreliability if I look hard enough.
My thinking is if OPNsense offers a configuration like this one, they should be able to illustrate workable configurations. My setup is not at all a strange one. To my thinking, there should be a documentation page that deals with common problems like this. The DNS LAN rule illustration was fragmentary at best.
Wikipedia has a list of ports in use and possible use. If its not mentioned then it's OK to use. I chose 3100.
The big news is that it seems to work now for LoadBalancing. The LAN rule points to the LoadBalancing gateway group. A DNS rule was put above the LAN rule. There seemed to be an error in how the DNS rule was configured. There was not enough detail in the official OPNsense documentation.
Adguard home works on the network, but I can't get to the Adguard Home interface again, even with the new port. But I tested it and it works as an ad blocker on my TVs. So now, access to the Adguard Home interface is the new problem to fix. Help would be appreciated.
#4
Hardware and Performance / Re: Semi parts bin new build
Last post by nero355 - Today at 06:40:49 PMQuote from: opnsenseguy on Today at 06:25:41 PMwould rather have equipment that I can replace individual components.Then why the
QuoteA. Intel onboard NIC. Bonus points for two!?!
Wouldn't you rather have a nice Quad Port NIC with either the Intel i226 NICs for 2,5 Gbps bandwidth or something older with just 1 Gbps per NIC ?
In case of the Intel i226 make sure you can flash it to Firmware 2.32 or that it's already flashed with it ;)
QuoteB. I do have SFP switch so can use SFP so any particular cards recommended?That would be Intel too, but considering :
QuoteC. Power consumption - This is going to be on 24/7. On my current setup the CPU of the Proxmox server running 3 other VM's doesn't ever hit 2% (12th Gen Intel i5-12400).You might want to avoid that ?!
QuoteAny motherboard recommendations?For some time Fujitsu motherboards were very popular for low power consumption setups.
No idea if that's still the case these days...
Have fun building/looking for parts for the right price! :)
#5
26.7 Series / Re: Failover switching with au...
Last post by nero355 - Today at 06:29:18 PMQuote from: JoeFromNowhere on Today at 09:08:17 AMWAN1 : 7Gb/s fiber connection with a 4G backup behind that switch automatically to 4G if fiber is down.Is that the same device or do both at least have a different Gateway IP Address ?!
#6
General Discussion / Re: How to handle firewall hos...
Last post by Bob.Dig - Today at 06:26:22 PMQuote from: viragomann on Today at 04:56:14 PMI've added all my interfaces to an interface group, called it "Internal", where I've defined common rules for DNS, NTP and alike.I wonder, if I could also do some more rules on such a group like block RFC1918, allow internet and do those as non-quick. Then I could create some local quick allow rules on the single interfaces...
#7
26.7 Series / Re: Setup issues with new OPNS...
Last post by nero355 - Today at 06:26:17 PMQuote from: Ratfink on Today at 03:12:09 AMRep dropped the ball, bad communication, etc...Also been there with an old Businesses only ISP and know what that feels like... :(
Hope everything keeps working for you as it should!
#8
Hardware and Performance / Semi parts bin new build
Last post by opnsenseguy - Today at 06:25:41 PMRight now I'm sporting OPNsense within Proxmox which has been humming along perfectly fine; however, this was just temporary to ensure that I was committed to OPNsense; I would rather have OPNsense on bare metal.
This is for a home application with only a handful of users and really not substantial usage. I don't run any external facing services but do VPN in (WG) here and there.
I was looking at the "off the shelf" type setups of Deciso or Protecti but I have several components already for a "custom build" and would rather have equipment that I can replace individual components.
This is what I have in my "parts-bin" just laying around:
1. 16GB DDR4 single dimm
2. 3U Rack Chassis (mATX/ATX)
3. 500GB PCIe Gen4 x 4 M.2 NVMe
My main concerns or wants are:
A. Intel onboard NIC. Bonus points for two!
B. I do have SFP switch so can use SFP so any particular cards recommended?
C Power consumption - This is going to be on 24/7. On my current setup the CPU of the Proxmox server running 3 other VM's doesn't ever hit 2% (12th Gen Intel i5-12400).
Any motherboard/CPU/NIC recommendations?
This is for a home application with only a handful of users and really not substantial usage. I don't run any external facing services but do VPN in (WG) here and there.
I was looking at the "off the shelf" type setups of Deciso or Protecti but I have several components already for a "custom build" and would rather have equipment that I can replace individual components.
This is what I have in my "parts-bin" just laying around:
1. 16GB DDR4 single dimm
2. 3U Rack Chassis (mATX/ATX)
3. 500GB PCIe Gen4 x 4 M.2 NVMe
My main concerns or wants are:
A. Intel onboard NIC. Bonus points for two!
B. I do have SFP switch so can use SFP so any particular cards recommended?
C Power consumption - This is going to be on 24/7. On my current setup the CPU of the Proxmox server running 3 other VM's doesn't ever hit 2% (12th Gen Intel i5-12400).
Any motherboard/CPU/NIC recommendations?
#9
General Discussion / Re: How to handle firewall hos...
Last post by nero355 - Today at 06:21:11 PMQuote from: mooh on Today at 04:34:32 PMAlternatively, creating more specialised rules for every interface would be a pain.TIP : Create those Firewall Rules and then clone them to another Interface and see what happens! ;)
TL;DR : Not that much work if you do it the right way!
#10
General Discussion / Re: Unbound DNS over TLS
Last post by nero355 - Today at 06:18:27 PMDoT and DNSSEC are two different things just like DoH is another one...
So NO : You did not Enable DoT ;)
So NO : You did not Enable DoT ;)
