"Recent posts
#1
26.7 Series / Can anyone at OPNsense create ...
Last post by Sonicmixmaster - Today at 04:26:34 PMI am having PFSense issues where the config page no longer functions after updating to 9.0 so I switched to OPNsense but Surfshark has an outdated guide to set up their service to work with OPNsense. I looked everywhere to see if I could install an outdated version of OPNsense like 22.x and then gradually update to the current version after I confirm that Surfshark works, but I cannot find an old OPNsense iso to download and try. So here I am with 26.7.3_8 and I cannot get Surfshark to work with it even with many hours chatting with their support. Help please.
#2
General Discussion / Re: Networking Question - Isol...
Last post by talespin - Today at 04:12:28 PMQuote from: meyergru on Today at 03:29:30 PMI can only tell you how I am doing that kind of thing with PVE (which also uses KVM, so this should be similar enough):
I have one bridge vmbr0 connected to a physical ethernet adapter that connects to the "real" network and it also has the IP of the PVE host.
A second bridge interface vmbr1, is VLAN-aware and is purely virtual, in that it has no physical NICs attached to it at all.
For each VM, I create a separate VLAN X with a an associated subnet, say 10.0.X.0/24. The VM X itself has 10.0.X.2/24 as its IP address and 10.0.x.1 as gateway and DNS server.
I use one OpnSense VM that has its virtio "WAN" attached to vmbr0 and thus gets an IP on my LAN. It also has a virtio "VLANBRIDGE" interface, off of which I define "VLANX" interfaces accordingly with VLAN X and IP address 10.0.x.1/24.
Each of the VLANXs is allowed to access the internet, but not RFC1918, so it cannot access either LAN devices or other VMs.
On the other hand, I can create rules that allow access from the "WAN" (aka LAN) to each VM (or the whole 10.0.0.0/16 range).
You can use such a setup in a datacenter or at home, like described here: https://forum.opnsense.org/index.php?topic=44159.0
Thank you for sharing your approach.
From what I understand, you are using virtual switch (software) and subnet. I want to explore hardware option before using virtual switch to reduce latency for gaming VM's.
#3
General Discussion / Re: How to actually migrate to...
Last post by datenimperator - Today at 03:55:51 PMThx for that, I do know about the "late import". I'd really like to learn how to get it right first time. Because, if a default DHCP server starts handing out faulty IP addresses, lots of devices are confused. So, I'd need to first start it in a separate LAN, to stop that. After all, getting the config right from the start would make my installation a lot easier.
#4
General Discussion / Re: how insecure is FreeBSD 14...
Last post by franco - Today at 03:44:26 PMmuch appreciated, thank you :)
#5
26.7 Series / Re: General feedback
Last post by franco - Today at 03:43:30 PMI think you'll dismiss at least 3 things:
1. These update points are fixed and vetted. Asking for forward compatibility from 25.1 with e.g. 27.1 is nice, but requires a time machine or keeping 25.1 up to date which is just not what we (want to) do.
2. Use a recent image for faster upgrades.
3. Migration notes accumulate in such scenarios.
Cheers,
Franco
1. These update points are fixed and vetted. Asking for forward compatibility from 25.1 with e.g. 27.1 is nice, but requires a time machine or keeping 25.1 up to date which is just not what we (want to) do.
2. Use a recent image for faster upgrades.
3. Migration notes accumulate in such scenarios.
Cheers,
Franco
#6
26.7 Series / Re: Are ports currently broken...
Last post by franco - Today at 03:38:17 PMDid you tamper with your local /usr/tools repository? It's probably stuck on another branch or self-committed change.
Cheers,
Franco
Cheers,
Franco
#7
General Discussion / Re: Networking Question - Isol...
Last post by meyergru - Today at 03:29:30 PMI can only tell you how I am doing that kind of thing with PVE (which also uses KVM, so this should be similar enough):
I have one bridge vmbr0 connected to a physical ethernet adapter that connects to the "real" network and it also has the IP of the PVE host.
A second bridge interface vmbr1, is VLAN-aware and is purely virtual, in that it has no physical NICs attached to it at all.
For each VM, I create a separate VLAN X with a an associated subnet, say 10.0.X.0/24. The VM X itself has 10.0.X.2/24 as its IP address and 10.0.x.1 as gateway and DNS server.
I use one OpnSense VM that has its virtio "WAN" attached to vmbr0 and thus gets an IP on my LAN. It also has a virtio "VLANBRIDGE" interface, off of which I define "VLANX" interfaces accordingly with VLAN X and IP address 10.0.x.1/24.
Each of the VLANXs is allowed to access the internet, but not RFC1918, so it cannot access either LAN devices or other VMs.
On the other hand, I can create rules that allow access from the "WAN" (aka LAN) to each VM (or the whole 10.0.0.0/16 range).
You can use such a setup in a datacenter or at home, like described here: https://forum.opnsense.org/index.php?topic=44159.0
I have one bridge vmbr0 connected to a physical ethernet adapter that connects to the "real" network and it also has the IP of the PVE host.
A second bridge interface vmbr1, is VLAN-aware and is purely virtual, in that it has no physical NICs attached to it at all.
For each VM, I create a separate VLAN X with a an associated subnet, say 10.0.X.0/24. The VM X itself has 10.0.X.2/24 as its IP address and 10.0.x.1 as gateway and DNS server.
I use one OpnSense VM that has its virtio "WAN" attached to vmbr0 and thus gets an IP on my LAN. It also has a virtio "VLANBRIDGE" interface, off of which I define "VLANX" interfaces accordingly with VLAN X and IP address 10.0.x.1/24.
Each of the VLANXs is allowed to access the internet, but not RFC1918, so it cannot access either LAN devices or other VMs.
On the other hand, I can create rules that allow access from the "WAN" (aka LAN) to each VM (or the whole 10.0.0.0/16 range).
You can use such a setup in a datacenter or at home, like described here: https://forum.opnsense.org/index.php?topic=44159.0
#8
26.7 Series / Re: General feedback
Last post by meyergru - Today at 03:15:20 PM@talespin: Or you should update more often to keep up with patches for known vulnerabilities, like most people do. That way, you will only have to do small. incremental steps in case something changes w/r to functionality. This is the reason why you cannot expect an automatic mechanism that spans more than one version in one big leap.
There is also the possibility to backup your configuration, install fresh and import your configuration. However, that may fail for the same reason.
There is also the possibility to backup your configuration, install fresh and import your configuration. However, that may fail for the same reason.
#9
26.7 Series / Re: General feedback
Last post by notspam - Today at 03:11:50 PMSorry, this is a totally wrong head line.
Nothing you wrote is a general feedback.
It is the specific question of not understanding the update path.
One year behind ? Absolutelly unusal use case.
Nothing you wrote is a general feedback.
It is the specific question of not understanding the update path.
One year behind ? Absolutelly unusal use case.
#10
General Discussion / Re: How to actually migrate to...
Last post by newsense - Today at 03:06:00 PMNo need really to import things from the start.
Install OPNsense.
Do some initial config on wan and lan so you can access it and the internet
Update
Install the plugins you need
Import the configuration
Make sure you have all the needed config files. The OPN one you can download from GUI, Adguardhome you'll need to scp. Others...similar with Adguardhome.
Install OPNsense.
Do some initial config on wan and lan so you can access it and the internet
Update
Install the plugins you need
Import the configuration
Make sure you have all the needed config files. The OPN one you can download from GUI, Adguardhome you'll need to scp. Others...similar with Adguardhome.
