"Recent posts
#1
French - Français / Règles NAT/ACL pour serveurs d...
Last post by Arlunz - Today at 04:09:45 PMSalut à tous, je gère plusieurs serveurs de crawl et scraping pour des clients, chacun sur son propre VLAN derrière OPNsense, un rack chez un hébergeur. Depuis début du mois j'ai monté une architecture plus lourde pour un client e-commerce (site avec plus de 100k pages générées automatiquement) et depuis la table d'états explose. Ça monte à plus de 40k entrées en pointe sur les 4 VLAN et régulièrement des connexions sortantes se coupent alors que les règles NAT/ACL me paraissent bonnes.
En fait sur une des architectures de SEO programmatique qu'on opère pour ce client, les crawlers tapent en continu et la table d'états finit par saturer. Du coup je me demande si c'est juste une histoire de dimensionnement (RAM, sysctl) ou s'il faut carrément repenser la segmentation entre les VLAN pour isoler ce trafic là. Quelqu'un a déjà eu ce genre de souci avec du trafic automatisé à grande échelle? Genre des crawlers ou scrapers qui tournent 24/7 et qui plombent la table d'états même avec des règles propres. Dites-moi si c'est pas clair, je peux détailler la la conf.
En fait sur une des architectures de SEO programmatique qu'on opère pour ce client, les crawlers tapent en continu et la table d'états finit par saturer. Du coup je me demande si c'est juste une histoire de dimensionnement (RAM, sysctl) ou s'il faut carrément repenser la segmentation entre les VLAN pour isoler ce trafic là. Quelqu'un a déjà eu ce genre de souci avec du trafic automatisé à grande échelle? Genre des crawlers ou scrapers qui tournent 24/7 et qui plombent la table d'états même avec des règles propres. Dites-moi si c'est pas clair, je peux détailler la la conf.
#2
Announcements / OPNsense 26.7.4 released
Last post by franco - Today at 03:43:57 PMHey!
Today we are rolling out the wireless device MVC/API rework and a
final push for better source NAT replacement over outbound NAT.
Strongswan was updated to 6.1.0 and the GUI now offers a small
recommended set of post-quantum key exchanges.
You may also find the GUI tweaks for advanced option marker and
a dialog search field helpful.
There is a lot more going on as you can see from this changelog,
but more on this and future plans later!
Here are the full patch notes:
o system: audit log injection via login username in auth_log()[1]
o system: add pfsync version 1500 to HA settings (contributed by Bjoern Jakobsen)
o system: add hidden services so they can be operated by pluginctl -s
o system: privlege separated reload in static PHP pages
o system: lower priority of automatic wg/ipsec gateways
o system: fix disk widget loading issue (contributed by Konstantinos Spartalis)
o system: add back the service widget link
o system: make compare operator in authTOTP() more strict
o interfaces: migrate wireless configuration to MVC/API
o interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()
o interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()
o interfaces: provide "uuid" in legacy_config_get_interfaces()
o interfaces: split media and mediaopt with tabs instead of spaces
o interfaces: a few config_read_array() replacements
o interfaces: refactor device matching around interface_parent_devices()
o interfaces: remove cua matching from PPP device pattern
o firewall: source NAT: add pool options and source hash key
o firewall: source NAT: fix port alias and well known port usage in target_port
o firewall: make source and destination NAT automatic rules visible in GUI
o firewall: implement JsonAuditField in all MVC components
o firewall: update the internally reserved pf keywords for FreeBSD 15
o firewall: add source NAT migration banner to outbound NAT
o firewall: add private network exclusions to default IPv6 bogons (contributed by Maurice Walker)
o dnsmasq: leases sorting fixes (contributed by Greelan)
o firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase
o firmware: opnsense-prefetch: new tool for sets prefetching
o firmware: opnsense-sign: shell compatibility update
o firmware: adjust the incompatible pkg test
o firmware: disable FreeBSD-base repository and remove old definitions
o intrusion detection: fix displaying URL in descriptions (contributed by Konstantinos Spartalis)
o ipsec: add some hybrid post-quantum variants as additional key exchange
o kea: fix leases sorting (contributed by Greelan)
o openvpn: moved legacy CARP hook to os-openvpn-legacy plugin
o acl: fix API patters for GIF/GRE device settings
o acl: add missing and fix some issues (contributed by Konstantinos Spartalis)
o backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance
o mvc: advanced marker for form/dialog fields
o mvc: fix stale imports for Message classes
o mvc: JsonAduditField: shared implementation for configuration revision tracking
o rc: add watchdog to shutdown, reboot and reload_all cases
o ui: fix widget bottom gap in standard theme files (contributed by Konstantinos Spartalis)
o ui: sidebar fixes and rework (contributed by Team Rebellion)
o ui: remove spurious _formDialog portion of dialog IDs
o ui: implement dialog search field
o ui: ensure a minimum amount of rows to render in grids
o plugins: os-acme-client 4.17[2]
o plugins: os-theme-rebellion 1.9.8 (contributed by Team Rebellion)
o plugins: os-turnserver 1.4[3]
o src: ciss: revert patch that added max physical target
o src: pf: do not set a null rule pointer during test
o src: pf: fix securelevel off-by-one
o src: pfctl: fix printing of wildcard anchors
o src: e1000: more assorted upstream patches from stable/15
o src: ixgbe: assorted upstream patches from stable/15
o src: virtio_p9fs: disallow detach if a session is in progress
o src: route/fib_algo: free leaked radix_masks in radix_lockless
o src: netipsec: implement pr_disconnect for PF_KEY sockets
o src: iflib: assorted upstream patches from stable/15
o src: net: add ifmedia support for 10GBase-BX BiDi
o src: bnxt: report initialization failures to iflib
o src: bnxt: add led(4) identification support
o src: ice: add led(4) identification support
o src: ice: report initialization failures to iflib
o src: ice: add support for E835 CNSA 2.0 adapters
o src: ice: add two more 4-part IDs for E835 adapters
o src: if_vxlan: fix panic by validating unused drvspec values
o src: qat: driver updates to enhance qat infrastructure
o src: ath10k: remove some early FreeBSD-specific debugging
o src: ip(6)_mroute: assorted upstream patches from stable/15
o src: in_mcast: fix uninitialized variable usage in inm_merge()
o src: bind: lookup local address in current FIB if '*.bind_all_fibs' is active
o src: net: add fib-aware ifa_ifwithaddr()
o ports: ca_root_nss / nss 3.129[4]
o ports: curl 8.22.0[5]
o ports: dhcp6c fix for truncated env vars in dhcp6c-script (contributed by Michael Zimmermann)
o ports: expat 2.8.4[6]
o ports: filterlog 0.9 support for pflog actions on FreeBSD 15
o ports: libxml 2.15.4[7]
o ports: openldap 2.6.15[8]
o ports: pcre2 10.48[9]
o ports: php 8.5.10[10]
o ports: phpseclib 3.0.57[11]
o ports: strongswan 6.1.0[12]
Stay safe,
Your OPNsense team
--
[1] https://github.com/opnsense/core/security/advisories/GHSA-jjm2-jg4p-3v9q
[2] https://github.com/opnsense/plugins/blob/stable/26.7/security/acme-client/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/26.7/net/turnserver/pkg-descr
[4] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_129.html
[5] https://curl.se/changes.html#8_22_0
[6] https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes
[7] https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.15.4/NEWS
[8] https://www.openldap.org/software/release/changes_lts.html
[9] https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
[10] https://www.php.net/ChangeLog-8.php#8.5.10
[11] https://github.com/phpseclib/phpseclib/releases/tag/3.0.57
[12] https://github.com/strongswan/strongswan/releases/tag/6.1.0
Today we are rolling out the wireless device MVC/API rework and a
final push for better source NAT replacement over outbound NAT.
Strongswan was updated to 6.1.0 and the GUI now offers a small
recommended set of post-quantum key exchanges.
You may also find the GUI tweaks for advanced option marker and
a dialog search field helpful.
There is a lot more going on as you can see from this changelog,
but more on this and future plans later!
Here are the full patch notes:
o system: audit log injection via login username in auth_log()[1]
o system: add pfsync version 1500 to HA settings (contributed by Bjoern Jakobsen)
o system: add hidden services so they can be operated by pluginctl -s
o system: privlege separated reload in static PHP pages
o system: lower priority of automatic wg/ipsec gateways
o system: fix disk widget loading issue (contributed by Konstantinos Spartalis)
o system: add back the service widget link
o system: make compare operator in authTOTP() more strict
o interfaces: migrate wireless configuration to MVC/API
o interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()
o interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()
o interfaces: provide "uuid" in legacy_config_get_interfaces()
o interfaces: split media and mediaopt with tabs instead of spaces
o interfaces: a few config_read_array() replacements
o interfaces: refactor device matching around interface_parent_devices()
o interfaces: remove cua matching from PPP device pattern
o firewall: source NAT: add pool options and source hash key
o firewall: source NAT: fix port alias and well known port usage in target_port
o firewall: make source and destination NAT automatic rules visible in GUI
o firewall: implement JsonAuditField in all MVC components
o firewall: update the internally reserved pf keywords for FreeBSD 15
o firewall: add source NAT migration banner to outbound NAT
o firewall: add private network exclusions to default IPv6 bogons (contributed by Maurice Walker)
o dnsmasq: leases sorting fixes (contributed by Greelan)
o firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase
o firmware: opnsense-prefetch: new tool for sets prefetching
o firmware: opnsense-sign: shell compatibility update
o firmware: adjust the incompatible pkg test
o firmware: disable FreeBSD-base repository and remove old definitions
o intrusion detection: fix displaying URL in descriptions (contributed by Konstantinos Spartalis)
o ipsec: add some hybrid post-quantum variants as additional key exchange
o kea: fix leases sorting (contributed by Greelan)
o openvpn: moved legacy CARP hook to os-openvpn-legacy plugin
o acl: fix API patters for GIF/GRE device settings
o acl: add missing and fix some issues (contributed by Konstantinos Spartalis)
o backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance
o mvc: advanced marker for form/dialog fields
o mvc: fix stale imports for Message classes
o mvc: JsonAduditField: shared implementation for configuration revision tracking
o rc: add watchdog to shutdown, reboot and reload_all cases
o ui: fix widget bottom gap in standard theme files (contributed by Konstantinos Spartalis)
o ui: sidebar fixes and rework (contributed by Team Rebellion)
o ui: remove spurious _formDialog portion of dialog IDs
o ui: implement dialog search field
o ui: ensure a minimum amount of rows to render in grids
o plugins: os-acme-client 4.17[2]
o plugins: os-theme-rebellion 1.9.8 (contributed by Team Rebellion)
o plugins: os-turnserver 1.4[3]
o src: ciss: revert patch that added max physical target
o src: pf: do not set a null rule pointer during test
o src: pf: fix securelevel off-by-one
o src: pfctl: fix printing of wildcard anchors
o src: e1000: more assorted upstream patches from stable/15
o src: ixgbe: assorted upstream patches from stable/15
o src: virtio_p9fs: disallow detach if a session is in progress
o src: route/fib_algo: free leaked radix_masks in radix_lockless
o src: netipsec: implement pr_disconnect for PF_KEY sockets
o src: iflib: assorted upstream patches from stable/15
o src: net: add ifmedia support for 10GBase-BX BiDi
o src: bnxt: report initialization failures to iflib
o src: bnxt: add led(4) identification support
o src: ice: add led(4) identification support
o src: ice: report initialization failures to iflib
o src: ice: add support for E835 CNSA 2.0 adapters
o src: ice: add two more 4-part IDs for E835 adapters
o src: if_vxlan: fix panic by validating unused drvspec values
o src: qat: driver updates to enhance qat infrastructure
o src: ath10k: remove some early FreeBSD-specific debugging
o src: ip(6)_mroute: assorted upstream patches from stable/15
o src: in_mcast: fix uninitialized variable usage in inm_merge()
o src: bind: lookup local address in current FIB if '*.bind_all_fibs' is active
o src: net: add fib-aware ifa_ifwithaddr()
o ports: ca_root_nss / nss 3.129[4]
o ports: curl 8.22.0[5]
o ports: dhcp6c fix for truncated env vars in dhcp6c-script (contributed by Michael Zimmermann)
o ports: expat 2.8.4[6]
o ports: filterlog 0.9 support for pflog actions on FreeBSD 15
o ports: libxml 2.15.4[7]
o ports: openldap 2.6.15[8]
o ports: pcre2 10.48[9]
o ports: php 8.5.10[10]
o ports: phpseclib 3.0.57[11]
o ports: strongswan 6.1.0[12]
Stay safe,
Your OPNsense team
--
[1] https://github.com/opnsense/core/security/advisories/GHSA-jjm2-jg4p-3v9q
[2] https://github.com/opnsense/plugins/blob/stable/26.7/security/acme-client/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/26.7/net/turnserver/pkg-descr
[4] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_129.html
[5] https://curl.se/changes.html#8_22_0
[6] https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes
[7] https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.15.4/NEWS
[8] https://www.openldap.org/software/release/changes_lts.html
[9] https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
[10] https://www.php.net/ChangeLog-8.php#8.5.10
[11] https://github.com/phpseclib/phpseclib/releases/tag/3.0.57
[12] https://github.com/strongswan/strongswan/releases/tag/6.1.0
#3
26.7 Series / Re: Can settings from ver OPNs...
Last post by nero355 - Today at 03:08:55 PMQuote from: seamus on Today at 02:30:21 AMI am hoping that my network is simple enough that I don't take that big step in front of an oncoming bus :)I think one of my recent posts is a nice summarized list of the things you might encounter while doing that : https://forum.opnsense.org/index.php?topic=52859.msg274156#msg274156
It's all pretty straight forward in the end, but you need to prepare/double check some things in advance :)
#4
General Discussion / Re: [SOLVED] P2P gaming betwee...
Last post by nero355 - Today at 03:02:26 PMQuote from: Bob.Dig on September 14, 2026, 08:13:22 PMHere you go.Thanks! :)
Ok, it isn't that good but contains some info which is relevant here too.
Too bad they don't mention a full list of protocols that might benefit from it aside from P2P (Gaming) and VoIP stuff...
QuoteAlthough I doubt that it makes gaming better than static port does. It would only make a difference if your gaming clients would use the same UDP source ports. But why should they in the first place, these days that would be stupid.To be honest : A lot of games are made in a very stupid way these days :(
Mainly because a lot of them are P2P based and ported that way to PCs instead of having Dedicated Servers and everything that goes with that...
QuoteI think Endpoint-independent Port Restricted Cone NAT is more for very big networks, maybe ISPs and their CG-NAT stuff etc.I am not entirely sure at this point : There might be one device on my network that needs it and is in it's own Guest-like VLAN so I think I am going to test it at some point.
#5
26.7 Series / Re: Upgrade 26.7.1 to 26.7.1_1...
Last post by Patrick M. Hausen - Today at 09:57:12 AMShow the "not working" aliases and rules - it's impossible to come up with a qualified answer without this information.
#6
26.7 Series / Re: Intel E810 fails to link o...
Last post by HenrikS - Today at 09:47:45 AMSame problem with no link on 25GbE, running both E810 and E823 and DDP after upgrading to 26.7
Without loading DDP we get link and about 1Gbps throughput on each NIC :/
E810-XXV fw 7.6.2 api 1.7 nvm 4.60
E823-C fw 7.1.6 api 1.7 nvm 3.26
ICE OS Default Package version 1.3.41.0
Without loading DDP we get link and about 1Gbps throughput on each NIC :/
E810-XXV fw 7.6.2 api 1.7 nvm 4.60
E823-C fw 7.1.6 api 1.7 nvm 3.26
ICE OS Default Package version 1.3.41.0
#7
26.7 Series / Re: No link with Intel E810 on...
Last post by HenrikS - Today at 09:47:09 AMSame problem with no link on 25GbE, running both E810 and E823 and DDP after upgrading to 26.7
Without loading DDP we get link and about 1Gbps throughput on each NIC :/
E810-XXV fw 7.6.2 api 1.7 nvm 4.60
E823-C fw 7.1.6 api 1.7 nvm 3.26
ICE OS Default Package version 1.3.41.0
Without loading DDP we get link and about 1Gbps throughput on each NIC :/
E810-XXV fw 7.6.2 api 1.7 nvm 4.60
E823-C fw 7.1.6 api 1.7 nvm 3.26
ICE OS Default Package version 1.3.41.0
#8
26.7 Series / Re: Upgrade 26.7.1 to 26.7.1_1...
Last post by trdeal - Today at 09:37:42 AMHi,
Checking the DNS Server rule and the cloned NTP server rule which I modified the rules were identical in terms of the options selected.
Even when I tried manually to recreate the DNS Server rule it still did not work, which is why I tried cloning the NTP Rule and modifying it and found that it worked. Do not know if it was part of the process when I imported the rules after the upgrade, so it looked as if it was a rule issue rather than an alias issue but I did create all new aliases which were used in the original rule before replacing to get a working solution.
Checking the DNS Server rule and the cloned NTP server rule which I modified the rules were identical in terms of the options selected.
Even when I tried manually to recreate the DNS Server rule it still did not work, which is why I tried cloning the NTP Rule and modifying it and found that it worked. Do not know if it was part of the process when I imported the rules after the upgrade, so it looked as if it was a rule issue rather than an alias issue but I did create all new aliases which were used in the original rule before replacing to get a working solution.
#9
General Discussion / Re: Rclone backup support
Last post by franco - Today at 09:24:28 AMInstead of push methods a simple pull from the machine via backup API is also more than enough as a backup strategy...
Cheers,
Franco
Cheers,
Franco
#10
26.1, 26,4 Series / Re: samplicate pegging cpu
Last post by ubu - Today at 02:51:12 AMCode Select
{
"@attributes": {
"version": "1.0.1",
"persisted_at": "1773874029.39",
"description": "NetFlow configuration"
},
"capture": {
"interfaces": "wan",
"egress_only": "wan",
"version": "v9",
"targets": "127.0.0.1:2055,127.0.0.1:2056"
},
"collect": {
"enable": "0"
},
"activeTimeout": "1800",
"inactiveTimeout": "15"
}
