Recent posts

#1

General Discussion / Re: Best firewall solution for...

Last post by therapistfarflung - Today at 07:34:18 PM

I have 3 kids at home that are gamers and streamers.  I have setup OPNsense and enabled Unbound DNS using the AdGuard List.  This caused all their gaming sites to no longer work.  I added a bunch of sites to the Allowlist Domains.

My question is, is this the best solution? or is there another solution? I was thinking of installing AdGuard Home plugin, but not sure if its just going to give me the same results.

What I am looking for is an ongoing Allow list that I don't have to come back up update manually.

I'd stick with Unbound for now rather than adding AdGuard Home just to solve this. OPNsense already has an allowlist and support for different blocklists, so switching tools probably won't eliminate the problem by itself.

What I'd do first is check the Unbound reporting page to see exactly which domains are getting blocked when a game or launcher stops working. Sometimes it's not the main gaming domain that's being blocked, but an authentication, update or CDN domain the game depends on. I'd whitelist only the domains that are confirmed false positives rather than adding broad wildcards that might defeat the filtering.

For your situation, I'd also consider using a less aggressive blocklist instead of trying to maintain a huge allowlist manually. There's no universal allowlist that can guarantee every game and launcher will keep working, because their dependencies change over time.

AdGuard Home might still be worth considering if you want more granular, per-device filtering for your kids' gaming PCs versus your other devices. But I'd get the basic setup working properly first. Having to troubleshoot a new layer of DNS filtering when a game refuses to launch can become a headache pretty quickly.

#2

26.7 Series / Re: Port forwarding settings u...

Last post by nero355 - Today at 07:33:54 PM

You don't read?

I guess not... ^_^

Not your reply or the official documentation @ https://docs.opnsense.org/ sadly...

#3

26.7 Series / Re: Gradual Internet Performan...

Last post by pfry - Today at 07:33:40 PM

A bit of an aside:

[...]And since it seems to be a SSD rebranded by Protectli I can't find any manufacturer documentation about it...[...]

Apparently Smartbuy (from the firmware version)... go figure. Basic SATA SSD, Phison controller.

My Intel SATA SSDs from 2016 or so have mostly unknown SMART attributes as well. Some are identifiable by value. I have older devices with more complete and readable SMART attributes.

#4

Zenarmor (Sensei) / Re: Cancelling my subscription...

Last post by Greg_E - Today at 07:33:16 PM

Funny enough, last week I sent them an email to get current pricing for my work system... No replies yet. I have another support contract for a different product that we aren't renewing, and I wanted to see if ZA could fit in its spot.

I do wish they would make a reduced price lab license with full multithreaded support. Not sure how to keep people honest, but it would be nice.

#5

General Discussion / Re: Virtual IP/NAT/Virtual Mac...

Last post by nero355 - Today at 07:28:28 PM

I need to assign a static WAN IP to the WAN interface of the OPNsense virtual machine.

I have setup Virtual IP and NAT and firewall rules, but cannot reach the WAN IP of the OPNsense virtual machine.

Why use the Virtual IP for WAN ?!

You can simply configure the WAN IP Address in the WAN Interface Settings ?!

#6

Zenarmor (Sensei) / Re: Zenarmor 2.7 release webin...

Last post by Greg_E - Today at 07:25:42 PM

Is there a recording available for those who couldn't attend?
Thanks

Me too.

#7

Dutch - Nederlands / Re: Chromebook van school op t...

Last post by nero355 - Today at 07:25:08 PM

Ik heb een WireGuard op de OPNSense draaien. Ik kan het proberen. :)

Laat effe weten hoe het uitpakt :)

#8

26.7 Series / Re: Gradual Internet Performan...

Last post by nero355 - Today at 07:22:22 PM

I'm going to run for another day without rebooting the router and see if the LAN degrades further.

Good luck! :)

By the way this was the topic about Unbound a while ago : https://forum.opnsense.org/index.php?topic=52429.msg273588#msg273588

iotop is a command for checking storage activity but maybe OPNsense does not have it by default.

Use

Code Select Expand

iostat 2

instead, of if running on ZFS

Code Select Expand

zpool iostat 2


Thanks! :)

#9

26.7 Series / Re: Gradual Internet Performan...

Last post by tonys - Today at 07:02:58 PM

Attached is the smartctl output.

Looks clean, but these are unknown :

Code Select Expand

170 Unknown_Attribute       0x0003   100   100   010    Pre-fail  Always       -       171
173 Unknown_Attribute       0x0012   100   100   000    Old_age   Always       -       7930004And since it seems to be a SSD rebranded by Protectli I can't find any manufacturer documentation about it...

Also note there is no ioctl command on my system??

iotop is a command for checking storage activity but maybe OPNsense does not have it by default.

Unbound logging level is set at error.

What happens when you completely disable it ?

Switching to debug mode, all I see are information and notices, no warnings and no errors.

That's good, but I think disabling it should avoid the storage issues that I have mentioned before!

Yes, I'm using Stevens Blacklist with about a dozen domains whitelisted that affected the Mac laptops and phones.
No unusual blocks being seen in the Unbound logs.

Most of my settings are the same as they were in the final release of 21.x. I had absolutely no problems at all under 21.x, all of my problems started after upgrading to the first and subsequent releases of 26.7.

I have a feeling that all of this is related to Unbound targeting quad9 DNS servers because a key point is that turning on Proton VPN in any LAN device instantly restores fast connectivity to the internet. Turning Proton off causes stalls on some sites which I can sometimes get to by reloading the page. The browsers constantly throw "page took too long to load" errors regardless of the browser I'm using.

The OPNSense web gui is very slow to load at all times, even after a reboot. Logins can take 30-60 seconds and changing pages in the GUI is also very slow. After a day or two of running, I can't even get into the GUI and typically reboot the router at the command line. External web sites may or may not load immediately after a reboot so I turn on Proton. After reboot today, I couldn't get to this site without turning Proton on.

I've now turned off Stevens Blacklist and will test under these conditions. Unbound continues to route to Quad DNS.

There was a topic a while ago that mentioned something about the way Unbound does the processing of the blocklist and how inefficient it is compared to let's say Pi-Hole and AdGuard.

Since I am a Pi-Hole user and follow their Discourse Forum frequently I have read something about the whole processing flow of the blocklists/whitelists not too long ago and after comparing it to the Unbound version it once again proved that Unbound is simply the wrong choice for network-wide adblocking functionality :)

So I would say consider leaving Unbound for what it is : A Recursive Resolver that only talks to the Root DNS Servers.
And use something else for adblocking...

This is interesting. In OPNSense 21.x, I had both Stevens Blacklist and Adguard turned on and never saw any network stalls or slow performance. I rarely even logged into OPNSense because I had no reason to.

So after 21 hours since the last reboot, with the blacklist disabled, I'm noticing network slowdowns and stalls again. Additionally, the OPNSense GUI is slowing down again but not nearly as bad as with the blacklist enabled. Turning on Proton VPN restores the network to normal speed. From what I've been reading, Unbound is bypassed when a device is using an external encrypted VPN so this seems to make sense. Another clue is that my IoT and Guest VLANS use public DNS - only the LAN uses encrypted Unbound/Quad9 - and I haven't seen any slowdowns on the IoT or Guest VLANS.

I'm going to run for another day without rebooting the router and see if the LAN degrades further.

#10

26.7 Series / Re: 26.7.6: unbound (and syslo...

Last post by magnust - Today at 06:50:01 PM

On Hyper-V here too, same problem. Just did the "opnsense-update -zkr 26.7.6-hyperv" and hope for the best :-D