"Recent posts
#1
Intrusion Detection and Prevention / Suricata configruation questio...
Last post by Vincent Chen - Today at 02:29:11 AMHi all,
My wan use pppoe to get a public ipv4, services are port forwarded to dmz subnet.
I got suricata enabled for a while. I have <wan ip>/32,<dmz net>/24 defined as homenet.
If I enable ips on dmz, traffic pass or block as rules defined. But transfer from dmz will slow down because packet inspect.
If I enable ips only on wan, no alter at all. But transfer from dmz will be full speed.
Here is my question:
Threats usually come from wan then pass to dmz. Why enable ips only on wan not block anything or alert anything.
Thanks for any help,
My wan use pppoe to get a public ipv4, services are port forwarded to dmz subnet.
I got suricata enabled for a while. I have <wan ip>/32,<dmz net>/24 defined as homenet.
If I enable ips on dmz, traffic pass or block as rules defined. But transfer from dmz will slow down because packet inspect.
If I enable ips only on wan, no alter at all. But transfer from dmz will be full speed.
Here is my question:
Threats usually come from wan then pass to dmz. Why enable ips only on wan not block anything or alert anything.
Thanks for any help,
#2
General Discussion / Re: New WAN failover configura...
Last post by bob9999 - October 20, 2026, 07:39:41 PMThanks. I read this as try it again and then reboot. Ok.
Edit.
I played around with the dns rule and it finally accepted the /32 address without the gui telling me it didn't exist. I have the rule set to inactive until I have the time to go at it again. Maybe Thursday.
Edit.
I played around with the dns rule and it finally accepted the /32 address without the gui telling me it didn't exist. I have the rule set to inactive until I have the time to go at it again. Maybe Thursday.
#3
26.7 Series / Re: Setting up WAN failover
Last post by bob9999 - October 20, 2026, 07:36:23 PMDeleted
#4
26.7 Series / Re: OPNsense 26.7.6_3 → 26.7.7...
Last post by nero355 - October 20, 2026, 07:30:05 PMThat's nice and all, but I simply wonder :
- What kind of SSD are you using ?
- Which file system are you using ?
- Has your OPNsense ever experienced unsafe shutdowns in the past ?
- Did you update/upgrade the FreeBSD Boot Loader when upgrading from 26.1.x to 26.7.x ?
- Did you perhaps update/upgrade the ZFS Pool without updating/upgrading the FreeBSD Boot Loader first ?
- Any chance the PSU or adapter of your OPNsense machine got weak after many years and had some reboots in the past without you knowing it ?
Since this is pretty much a file system issue and not an update issue I would look at these things first together with the output of 'smartctl -a /dev/<yourstoragedevice>' :)
- What kind of SSD are you using ?
- Which file system are you using ?
- Has your OPNsense ever experienced unsafe shutdowns in the past ?
- Did you update/upgrade the FreeBSD Boot Loader when upgrading from 26.1.x to 26.7.x ?
- Did you perhaps update/upgrade the ZFS Pool without updating/upgrading the FreeBSD Boot Loader first ?
- Any chance the PSU or adapter of your OPNsense machine got weak after many years and had some reboots in the past without you knowing it ?
Since this is pretty much a file system issue and not an update issue I would look at these things first together with the output of 'smartctl -a /dev/<yourstoragedevice>' :)
#5
General Discussion / Re: New WAN failover configura...
Last post by viragomann - October 20, 2026, 06:14:35 PMQuote from: bob9999 on October 20, 2026, 05:52:47 PMAs soon as I put a gateway group, either one, in the LAN rule everything chokes. No dns. Nothing gets fixed if I add a DNS rule above the LAN gateway rule.Seems you made the same mistake as another guy recently. Look here: Setting up WAN failover
#6
German - Deutsch / Re: ACME all-inkl DNS-01 Chall...
Last post by Andi.K - October 20, 2026, 06:13:29 PMDanke für die Antwort, soviel gibts da ja nicht einzustellen.
Name: irgendwas
Discription: irgendwas
Challenge Type: DNS-01
DNS Service: All-Inkl.com
DSN Sleep Time: 30sec
KAS login: mein KAS Username
KAS Authdata: mein KAS Passwort
KAS Authtype: plain
User/Pass sind die normalen Daten, die ich auch für die Webseite nutze. MFA ist deaktiviert.
Paket ist Business-Premium
VG Andi
Name: irgendwas
Discription: irgendwas
Challenge Type: DNS-01
DNS Service: All-Inkl.com
DSN Sleep Time: 30sec
KAS login: mein KAS Username
KAS Authdata: mein KAS Passwort
KAS Authtype: plain
User/Pass sind die normalen Daten, die ich auch für die Webseite nutze. MFA ist deaktiviert.
Paket ist Business-Premium
VG Andi
#7
General Discussion / New WAN failover configuration...
Last post by bob9999 - October 20, 2026, 05:52:47 PMI have a problem setting up wan failover / load sharing.
Specifically, it seems to work acceptably when I leave a few steps out but dns fails if I follow all the steps that are commonly recommended.
I can't even log into 192.168.1.1:3000 (adguard home) when the final steps are attempted. Although 192.168.1.1 for Opnsense access works normally.
I have 2 gateway groups, Failover and LoadBalance. I have 2 but will probably settle on LoadBalance. Monitor IP addresses are correct.
Manually shutting one down fails over correctly to the other. Setting both WAN priorities the same seems to let the router decide. LoadBalance is RoundRobin Sticky on the gateway group. Currently, WAN1 is priority 254 and WAN2 is priority 255. 'Allow default gateway switching' makes no difference checked or unchecked.
As soon as I put a gateway group, either one, in the LAN rule everything chokes. No dns. Nothing gets fixed if I add a DNS rule above the LAN gateway rule.
Everything springs back to life when I remove the Gateway from the LAN.
Along the way I discovered DNS speeds up considerably when I stopped using unbound and allowed Adguard Home to be the sole DNS forwarder. That configuration stays. Unbound and DNSMasq are both disabled. I have some DNS servers also listed on the main system general page, FWIW.
Internets are Comcast and T-Mobile 5G. CGNAT from TM appears to work great double natted. T-Mobile is 192.168.12.1 from them as WAN2 address.
Question: Should I leave well enough alone? Or is there a way to make all the known and recommended configuration steps work as described in almost every article I can find on the subject?
Specifically, it seems to work acceptably when I leave a few steps out but dns fails if I follow all the steps that are commonly recommended.
I can't even log into 192.168.1.1:3000 (adguard home) when the final steps are attempted. Although 192.168.1.1 for Opnsense access works normally.
I have 2 gateway groups, Failover and LoadBalance. I have 2 but will probably settle on LoadBalance. Monitor IP addresses are correct.
Manually shutting one down fails over correctly to the other. Setting both WAN priorities the same seems to let the router decide. LoadBalance is RoundRobin Sticky on the gateway group. Currently, WAN1 is priority 254 and WAN2 is priority 255. 'Allow default gateway switching' makes no difference checked or unchecked.
As soon as I put a gateway group, either one, in the LAN rule everything chokes. No dns. Nothing gets fixed if I add a DNS rule above the LAN gateway rule.
Everything springs back to life when I remove the Gateway from the LAN.
Along the way I discovered DNS speeds up considerably when I stopped using unbound and allowed Adguard Home to be the sole DNS forwarder. That configuration stays. Unbound and DNSMasq are both disabled. I have some DNS servers also listed on the main system general page, FWIW.
Internets are Comcast and T-Mobile 5G. CGNAT from TM appears to work great double natted. T-Mobile is 192.168.12.1 from them as WAN2 address.
Question: Should I leave well enough alone? Or is there a way to make all the known and recommended configuration steps work as described in almost every article I can find on the subject?
#8
Web Proxy Filtering and Caching / eMudhra Intermediate CA Compro...
Last post by bamf - October 20, 2026, 05:42:18 PMHi,
Using Squid on my OPNsense and the test website tells me that 6 (emSign Root TLS CA - G3) out of 12 Domains are able to connect https://emudhra.we-have-a-problem.com/
How do we get the updated revocation list into Squid?
Using Squid on my OPNsense and the test website tells me that 6 (emSign Root TLS CA - G3) out of 12 Domains are able to connect https://emudhra.we-have-a-problem.com/
How do we get the updated revocation list into Squid?
#9
26.7 Series / Re: frr plugin 2.0 was release...
Last post by Monviech (Cedrik) - October 20, 2026, 05:20:08 PMSounds like a core issue to me, better go there:
https://github.com/opnsense/core
I would imagine you have the same issue e.g in the wireguard instance selectpicker where its also using the same depend on carp logic.
https://github.com/opnsense/core
I would imagine you have the same issue e.g in the wireguard instance selectpicker where its also using the same depend on carp logic.
#10
Zenarmor (Sensei) / Re: Cancelling my subscription...
Last post by abenaou - October 20, 2026, 05:11:35 PMQuote from: colourcode on October 19, 2026, 10:32:45 AMWhat kind of traffic and host count are we talking about where you manage to practically kill the device?I run a 1gb download/200 mbps upload, but it wasn't the traffic that was causing the crashes/freezes, it was SQLite litterally strangling the nvme through successive writing requests, since the nvme doesn't have a cache and relies on memory, soon it runs out of "borrowed" cache memory and starts queuing up the write requests, then using all of the swap, then making ZFS ARC memory balloon, Zenarmor didn't like to be waiting for SQLite so everything was super super slow.
I didn't try TMPFS because any reboot would have resulted in me losing my data plus I wanted to kick out anything database related from the firewall, that's how I always functionned, from my experience (even professional) it is never a good idea to place the database and apps on the same server.
