"Recent posts
#1
Web Proxy Filtering and Caching / Re: postfix service run into t...
Last post by Igor - Today at 10:16:42 PMThe 300s timeout is Postfix's `milter_content_timeout` default, so the chain you describe is plausible — but IPv6 loopback isn't inherently slow, so something is dropping the traffic. Could you check a few things?
1. Is Redis actually listening on `::1`? `sockstat -6 | grep 6379` — and what does `bind` say in your redis.conf?
2. If it isn't listening there, you'd expect an instant connection refused rather than a delay. A delay that grows on retries (roughly 1s, 3s, 7s) is the signature of SYN packets being silently dropped.
3. Do you have any rule blocking IPv6, or any floating rule that isn't scoped away from `lo0`? Try `pfctl -s rules | grep lo0`, and enable logging on your block rules to see whether loopback IPv6 is being dropped.
4. What does `redis-cli -h ::1 -p 6379 --latency` show versus the same on 127.0.0.1?
As a workaround you can pin rspamd to IPv4 with `servers = "127.0.0.1:6379";` in `/usr/local/etc/rspamd/local.d/redis.conf` — there's no GUI option for it. But that's masking the symptom; the firewall rule is worth finding.
#2
Web Proxy Filtering and Caching / Re: Access Lists: support dyna...
Last post by Monviech (Cedrik) - Today at 09:55:37 PMDiscussed it here a while ago and not planning to do it.
https://github.com/opnsense/plugins/issues/5358
https://github.com/opnsense/plugins/issues/5358
#3
General Discussion / Re: Firewall aliases #Loaded v...
Last post by keeka - Today at 09:03:42 PMThe example alias I gave is referenced in a destination NAT rule, a corresponding (unlinked/manual) firewall rule, and also in another firewall rule. All configured on WAN interface only.
#4
Web Proxy Filtering and Caching / Access Lists: support dynamic/...
Last post by dinguz - Today at 09:01:14 PMIn Firewall > Aliases you can create a "URL Table (IPs)" alias that periodically re-fetches its contents from a remote source (e.g. Cloudflare's official IP ranges), so the alias stays current without manual maintenance.
The Caddy plugin's Access Lists (Services > Caddy > Access) only support static, manually entered CIDR blocks. For something like a Cloudflare IP list, this means every range change on Cloudflare's end has to be applied by hand, otherwise the list silently drifts out of sync.
Would it be possible to either:
so lists like this stay in sync automatically instead of requiring manual upkeep?
The Caddy plugin's Access Lists (Services > Caddy > Access) only support static, manually entered CIDR blocks. For something like a Cloudflare IP list, this means every range change on Cloudflare's end has to be applied by hand, otherwise the list silently drifts out of sync.
Would it be possible to either:
- let an Access List reference an existing Firewall alias, or
- give Access Lists their own periodic remote-fetch option, similar to URL Table aliases
so lists like this stay in sync automatically instead of requiring manual upkeep?
#5
General Discussion / Re: Firewall aliases #Loaded v...
Last post by pfry - Today at 07:15:56 PMI don't see that behavior offhand, although I didn't check my larger aliases (e.g. bogons). So it seems unlikely to be a table optimization, as I have several aliases that contain subnets of others and are evaluated in the same ruleset.
#6
26.7 Series / Re: Asking for Sanity Check be...
Last post by Patrick M. Hausen - Today at 07:10:40 PM #7
26.7 Series / Re: Asking for Sanity Check be...
Last post by Chiny - Today at 06:58:31 PMQuote from: nero355 on Today at 05:08:49 PMBut he needs to know if the microcode stuff will boot and work correctly ?!Exactly how would he check the microcode stuff is loaded and functioning ?
#8
General Discussion / Re: Firewall inspection stats
Last post by OPNenthu - Today at 06:41:12 PMSorry, this is not answering your original question but it's the part of the firewall that I get the most enjoyment from :) If pf didn't have this quick/non-quick mechanic it would be far less interesting, IMO.
As a purely logical construct, I think you can imagine your rules that way- as a set of 'quick' rules followed by a set of 'non-quick' rules evaluated after all the quick ones. However, in that case you have to also think of the two sets differently:
The 'quick' set will be first-match and processing stops immediately on a match.
The 'non-quick' set will continue to be last-match and they are all processed no matter what. The last one that matched wins.
Again, sorry for the digression. I hope my last post helps in the discussion about evaluation counts.
P.S. If you imagine the rules this way, there may be cases where it breaks down... i.e. with tagging or something. Interesting thought exercise.
Quote from: keeka on Today at 05:22:55 PMHowever the last match concept has proven diffcult to grasp, so I just look at it as evaluated last!
As a purely logical construct, I think you can imagine your rules that way- as a set of 'quick' rules followed by a set of 'non-quick' rules evaluated after all the quick ones. However, in that case you have to also think of the two sets differently:
The 'quick' set will be first-match and processing stops immediately on a match.
The 'non-quick' set will continue to be last-match and they are all processed no matter what. The last one that matched wins.
Again, sorry for the digression. I hope my last post helps in the discussion about evaluation counts.
P.S. If you imagine the rules this way, there may be cases where it breaks down... i.e. with tagging or something. Interesting thought exercise.
#9
26.7 Series / Re: OPNsense Protectli boot fa...
Last post by Patrick M. Hausen - Today at 05:56:50 PMQuote from: nero355 on Today at 05:18:47 PMI would look around for something Workstation/Enterprise grade worthy or simply any SSD with high write endurance
Transcend brand are favoured by me personally and Deciso seems to also use them by default in their appliances. Various m.2 or mSATA alternatives and most have exceptionally high TBW for the size.
#10
General Discussion / Firewall aliases #Loaded value
Last post by keeka - Today at 05:52:26 PMSome aliases (network aliases as far as I can tell) show an unexpected #Loaded value.
e.g. I have a networks alias currently containing a single CIDR 82.132.128.0/17. This shows #Loaded=5. Gemini AI suggests the higher than expected #Loaded may be due to pf internal alias optimisation and that a corresponding breakdown (5 entries) would be visible under diagnostics. That doesn't seem to be the case. Diagnostics just shows the same single CIDR for that particular alias.
e.g. I have a networks alias currently containing a single CIDR 82.132.128.0/17. This shows #Loaded=5. Gemini AI suggests the higher than expected #Loaded may be due to pf internal alias optimisation and that a corresponding breakdown (5 entries) would be visible under diagnostics. That doesn't seem to be the case. Diagnostics just shows the same single CIDR for that particular alias.
